All of lore.kernel.org
 help / color / mirror / Atom feed
* [libvirt bisection] complete test-amd64-amd64-libvirt-vhd
@ 2015-11-29 20:59 osstest service owner
  0 siblings, 0 replies; only message in thread
From: osstest service owner @ 2015-11-29 20:59 UTC (permalink / raw)
  To: xen-devel, osstest-admin

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 6376831 bytes --]

branch xen-unstable
xenbranch xen-unstable
job test-amd64-amd64-libvirt-vhd
testid debian-di-install

Tree: libvirt git://libvirt.org/libvirt.git
Tree: libvirt_gnulib git://git.sv.gnu.org/gnulib.git
Tree: linux git://xenbits.xen.org/linux-pvops.git
Tree: linuxfirmware git://xenbits.xen.org/osstest/linux-firmware.git
Tree: qemu git://xenbits.xen.org/qemu-xen-traditional.git
Tree: qemuu git://xenbits.xen.org/qemu-xen.git
Tree: xen git://xenbits.xen.org/xen.git

*** Found and reproduced problem changeset ***

  Bug is in tree:  qemuu git://xenbits.xen.org/qemu-xen.git
  Bug introduced:  3fb401edbd8e9741c611bfddf6a2032ca91f55ed
  Bug not present: 816609b2841297925a223ec377c336360e044ee5
  Last fail repro: http://logs.test-lab.xenproject.org/osstest/logs/65231/


  commit 3fb401edbd8e9741c611bfddf6a2032ca91f55ed
  Merge: a44c280 816609b
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Nov 23 16:55:36 2015 +0000

      Merge remote-tracking branch 'qemu-xen/staging' into qemu-xen-4.7

  commit a44c2800d990252b3632bbb35af34ec5ff99e2f1
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Sep 18 12:07:18 2015 +0200

      spice: surface switch fast path requires same format too.

      Commit "555e72f spice: rework mirror allocation, add no-resize fast path"
      adds a fast path for surface switches which does't go through the full
      primary surface destroy and re-recreation in case the new surface is
      identical to the old one (page-flip).  It checks the size only though,
      but the format must be identical too.  This patch adds the format check.

      Commit "0002a51 ui/spice: Support shared surface for most pixman
      formats" increases the chance to actually trigger this.

      https://bugzilla.redhat.com/show_bug.cgi?id=1247479

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 10ef480941522fc8bbcbc190bc0546991361bfd5
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jul 24 03:38:28 2015 -0600

      xen/HVM: atomically access pointers in bufioreq handling

      The number of slots per page being 511 (i.e. not a power of two) means
      that the (32-bit) read and write indexes going beyond 2^32 will likely
      disturb operation. The hypervisor side gets I/O req server creation
      extended so we can indicate that we're using suitable atomic accesses
      where needed, allowing it to atomically canonicalize both pointers when
      both have gone through at least one cycle.

      The Xen side counterpart (which is not a functional prereq to this
      change, albeit a build one) went in already (commit b7007bc6f9).

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 32d24131b2d1d98384b96c80f6cd3482550dc68a
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu Oct 29 13:49:30 2015 -0500

      Update version for 2.4.1 release

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit fc63922556a5064173411d8cea1e303256ee3c8c
  Author: Pavel Butsykin <pbutsykin@virtuozzo.com>
  Date:   Mon Oct 26 14:42:57 2015 +0300

      virtio: sync the dataplane vring state to the virtqueue before virtio_save

      When creating snapshot with the dataplane enabled, the snapshot file gets
      not the actual state of virtqueue, because the current state is stored in
      VirtIOBlockDataPlane. Therefore, before saving snapshot need to sync
      the dataplane vring state to the virtqueue. The dataplane will resume its
      work at the next notify virtqueue.

      When snapshot loads with loadvm we get a message:
      VQ 0 size 0x80 Guest index 0x15f5 inconsistent with Host index 0x0:
          delta 0x15f5
      error while loading state for instance 0x0 of device
          '0000:00:08.0/virtio-blk'
      Error -1 while loading VM state

      to reproduce the error I used the following hmp commands:
      savevm snap1
      loadvm snap1

      qemu parameters:
      --enable-kvm -smp 4 -m 1024 -drive file=/var/lib/libvirt/images/centos6.4.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,aio=native -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk0,id=virtio-disk0 -set device.virtio-disk0.x-data-plane=on

      Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1445859777-2982-1-git-send-email-den@openvz.org
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: "Michael S. Tsirkin" <mst@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 10a06fd65f667a972848ebbbcac11bdba931b544)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 36e1eee7603ad1683df9446e104c6f5849d854c6
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Jul 19 10:02:37 2015 +0300

      target-xtensa: add window overflow check to L32E/S32E

      Despite L32E and S32E primary use is for window underflow and overflow
      exception handlers they are just normal instructions, and thus need to
      check for window overflow.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      (cherry picked from commit f822b7e497fa6a662094b491f86441015f363362)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 9137bd24c8165192917471dca67b778c301fcd54
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Oct 14 12:11:27 2015 +0300

      net: don't set native endianness

      commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991
          vhost-net: tell tap backend about the vnet endianness
      makes vhost net always try to set LE - even if that matches the
      native endian-ness.

      This makes it fail on older kernels on x86 without TUNSETVNETLE support.

      To fix, make qemu_set_vnet_le/qemu_set_vnet_be skip the
      ioctl if it matches the host endian-ness.

      Reported-by: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      (cherry picked from commit 052bd52fa978d3f04bc476137ad6e1b9a697f9bd)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 08231cbb7660876903019ef1b59ef332deea2a83
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:56 2015 +0200

      device-introspect-test: New, covering device introspection

      The test doesn't check that the output makes any sense, only that QEMU
      survives.  Useful since we've had an astounding number of crash bugs
      around there.

      In fact, we have a bunch of them right now: a few devices crash or
      hang, and some leave dangling pointers behind.  The test skips testing
      the broken parts.  The next commits will fix them up, and drop the
      skipping.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-Id: <1443689999-12182-8-git-send-email-armbru@redhat.com>
      (cherry picked from commit 2d1abb850fd15fd6eb75a92290be5f93b2772ec5)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 70a4483abbbe3ec938b6c39a3cd0b486b96da93e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:55 2015 +0200

      libqtest: New hmp() & friends

      New convenience function hmp() to facilitate use of
      human-monitor-command in tests.  Use it to simplify its existing uses.

      To blend into existing libqtest code, also add qtest_hmpv() and
      qtest_hmp().  That, and the egregiously verbose GTK-Doc comment format
      make this patch look bigger than it is.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-Id: <1443689999-12182-7-git-send-email-armbru@redhat.com>
      (cherry picked from commit 5fb48d9673b76fc53507a0e717a12968e57d846e)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 39809852a7769e4271928ce7d5f2f1c4baf16fcf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:53 2015 +0200

      tests: Fix how qom-test is run

      We want to run qom-test for every architecture, without having to
      manually add it to every architecture's list of tests.  Commit 3687d53
      accomplished this by adding it to every architecture's list
      automatically.

      However, some architectures inherit their tests from others, like this:

          check-qtest-x86_64-y = $(check-qtest-i386-y)
          check-qtest-microblazeel-y = $(check-qtest-microblaze-y)
          check-qtest-xtensaeb-y = $(check-qtest-xtensa-y)

      For such architectures, we ended up running the (slow!) test twice.
      Commit 2b8419c attempted to avoid this by adding the test only when
      it's not already present.  Works only as long as we consider adding
      the test to the architectures on the left hand side *after* the ones
      on the right hand side: x86_64 after i386, microblazeel after
      microblaze, xtensaeb after xtensa.

      Turns out we consider them in $(SYSEMU_TARGET_LIST) order.  Defined as

          SYSEMU_TARGET_LIST := $(subst -softmmu.mak,,$(notdir \
             $(wildcard $(SRC_PATH)/default-configs/*-softmmu.mak)))

      On my machine, this results in the oder xtensa, x86_64, microblazeel,
      microblaze, i386.  Consequently, qom-test runs twice for microblazeel
      and x86_64.

      Replace this complex and flawed machinery with a much simpler one: add
      generic tests (currently just qom-test) to check-qtest-generic-y
      instead of check-qtest-$(target)-y for every target, then run
      $(check-qtest-generic-y) for every target.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-Id: <1443689999-12182-5-git-send-email-armbru@redhat.com>
      (cherry picked from commit e253c287153c6f3ce4177686ac12c196f9bd8292)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit db97d9d886f7e16571e5eb242d814b6d345affb2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:52 2015 +0200

      macio: move DBDMA_init from instance_init to realize

      DBDMA_init is not idempotent, and calling it from instance_init
      breaks a simple object_new/object_unref pair.  Work around this,
      pending qdev-ification of DBDMA, by moving the call to realize.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-4-git-send-email-armbru@redhat.com>
      (cherry picked from commit c7104402353bf32ac1d3a276e3619a20e910506b)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 243b80c9c5e8be52c141ff976aecd40667aebd61
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:51 2015 +0200

      hw: do not pass NULL to memory_region_init from instance_init

      This causes the region to outlive the object, because it attaches the
      region to /machine.  This is not nice for the "realize" method, but
      much worse for "instance_init" because it can cause dangling pointers
      after a simple object_new/object_unref pair.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-3-git-send-email-armbru@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      (cherry picked from commit 81e0ab48dda611e9571dc2e166840205a4208567)

      Conflicts:
      	hw/display/cg3.c
      	hw/display/tcx.c

      * removed context dependencies on &error_fatal/&error_abort

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 91232d98da2bfe042d4c5744076b488880de3040
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:50 2015 +0200

      memory: allow destroying a non-empty MemoryRegion

      This is legal; the MemoryRegion will simply unreference all the
      existing subregions and possibly bring them down with it as well.
      However, it requires a bit of care to avoid an infinite loop.
      Finalizing a memory region cannot trigger an address space update,
      but memory_region_del_subregion errs on the side of caution and
      might trigger a spurious update: avoid that by resetting mr->enabled
      first.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-2-git-send-email-armbru@redhat.com>
      (cherry picked from commit 2e2b8eb70fdb7dfbec39f3a19b20f9a73f2f813e)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d68ba3cab357f73aa74525f86f5da448b39ae34a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 8 18:11:39 2015 +0200

      update-linux-headers: Rename SW_MAX to SW_MAX_

      The next commit will compile hw/input/virtio-input.c and
      hw/input/virtio-input-hid.c even when CONFIG_LINUX is off.  These
      files include both "include/standard-headers/linux/input.h" and
      <windows.h> then.  Doesn't work, because both define SW_MAX.  We don't
      actually use it.  Patch input.h to define SW_MAX_ instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1444320700-26260-2-git-send-email-armbru@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit ac98fa849e834f48e5a64cf4b22218ba4047e142)

      Conflicts:
      	scripts/update-linux-headers.sh

      * remove dependency on eddb4de3

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 381a290266df4161de71afc8a44e67ae66bde5be
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Sep 16 17:38:44 2015 +0200

      trace: remove malloc tracing

      The malloc vtable is not supported anymore in glib, because it broke
      when constructors called g_malloc.  Remove tracing of g_malloc,
      g_realloc and g_free calls.

      Note that, for systemtap users, glib also provides tracepoints
      glib.mem_alloc, glib.mem_free, glib.mem_realloc, glib.slice_alloc
      and glib.slice_free.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1442417924-25831-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 98cf48f60aa4999f5b2808569a193a401a390e6a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 696317f1895e836d53b670c7b77b7be93302ba08
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:30 2015 +0800

      virtio-net: correctly drop truncated packets

      When packet is truncated during receiving, we drop the packets but
      neither discard the descriptor nor add and signal used
      descriptor. This will lead several issues:

      - sg mappings are leaked
      - rx will be stalled if a lots of packets were truncated

      In order to be consistent with vhost, fix by discarding the descriptor
      in this case.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 0cf33fb6b49a19de32859e2cdc6021334f448fb3)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit c2a550d3dfa1f22eac77842aceed6047f6db2320
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:29 2015 +0800

      virtio: introduce virtqueue_discard()

      This patch introduces virtqueue_discard() to discard a descriptor and
      unmap the sgs. This will be used by the patch that will discard
      descriptor when packet is truncated.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a64d4cafa9dedad93da475f2f1e41133f433be67
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:28 2015 +0800

      virtio: introduce virtqueue_unmap_sg()

      Factor out sg unmapping logic. This will be reused by the patch that
      can discard descriptor.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Andrew James <andrew.james@hpe.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit ce317461573bac12b10d67699b4ddf1f97cf066c)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2f99c80963658b491d2f5fb98e6e602dd8d9ede2
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Oct 16 13:33:07 2015 +0200

      virtio-input: ignore events until the guest driver is ready

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit d9460a7557672af9c4d9d4f153200d1075ed5a78)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f62c10bd206b81644336f7e3c071ed76eab61ce6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Oct 13 12:21:27 2015 +0100

      Migration: Generate the completed event only when we complete

      The current migration-completed event is generated a bit too early,
      which means that an eager libvirt that's ready to go as soon
      as it sees the event ends up racing with the actual end of migration.

      This corresponds to RH bug:
      https://bugzilla.redhat.com/show_bug.cgi?id=1271145

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      xSigned-off-by: Juan Quintela <quintela@redhat.com>
      (cherry picked from commit ed1f3e0090069dcb9458aa9e450df12bf8eba0b0)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 8c4fa92d010db2ac88ed7a9e5bb51bbe43019872
  Author: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
  Date:   Mon Oct 12 11:36:21 2015 -0400

      util/qemu-config: fix missing machine command line options

      Commit 0a7cf217 ("util/qemu-config: fix regression of
      qmp_query_command_line_options") aimed to restore parsing of global
      machine options, but missed two: "aes-key-wrap" and
      "dea-key-wrap" (which were present in the initial version of that
      patch). Let's add them to the machine_opts again.

      Fixes: 0a7cf217 ("util/qemu-config: fix regression of
                        qmp_query_command_line_options")
      CC: Marcel Apfelbaum <marcel@redhat.com>
      CC: qemu-stable@nongnu.org
      Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1444664181-28023-1-git-send-email-akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

      (cherry picked from commit 5bcfa0c543b42a560673cafd3b5225900ef617e1)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 7c22dcdeb85dc8b1eb5f923e4c075d3046750513
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Oct 7 10:29:42 2015 +0200

      s390x/kvm: Fix vector validity bit in device machine checks

      Device hotplugs trigger a crw machine check. All machine checks
      have validity bits for certain register types. With vector support
      we also have to claim that vector registers are valid.
      This is a band-aid suitable for stable. Long term we should
      create the full  mcic value dynamically depending on the active
      features in the kernel interrupt handler.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      (cherry picked from commit 2ab75df38e34fe9bc271b5115ab52114e6e63a89)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 16514367efea1172e7b702c61c6f5637bf577f5b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Fri Oct 16 11:14:53 2015 +0100

      misc: zynq_slcr: Fix MMIO writes

      The /4 for offset calculation in MMIO writes was happening twice giving
      wrong write offsets. Fix.

      While touching the code, change the if-else to be a short returning if
      and convert the debug message to a GUEST_ERROR, which is more accurate
      for this condition.

      Cc: qemu-stable@nongnu.org
      Cc: Guenter Roeck <linux@roeck-us.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit c209b0537203c58a051e5d837320335cea23e494)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 55b4efb034155aa22d8392f4d6b7339807e3ab44
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:59 2015 +0200

      Revert "qdev: Use qdev_get_device_class() for -device <type>,help"

      This reverts commit 31bed5509dfcbdfc293154ce81086a4dbd7a80b6.

      The reverted commit changed qdev_device_help() to reject abstract
      devices and devices that have cannot_instantiate_with_device_add_yet
      set, to fix crash bugs like -device x86_64-cpu,help.

      Rejecting abstract devices makes sense: they're purely internal, and
      the implementation of the help feature can't cope with them.

      Rejecting non-pluggable devices makes less sense: even though you
      can't use them with -device, the help may still be useful elsewhere,
      for instance with -global.  This is a regression: -device FOO,help
      used to help even for FOO that aren't pluggable.

      The previous two commits fixed the crash bug at a lower layer, so
      reverting this one is now safe.  Fixes the -device FOO,help
      regression, except for the broken devices marked
      cannot_even_create_with_object_new_yet.  For those, the error message
      is improved.

      Example of a device where the regression is fixed:

          $ qemu-system-x86_64 -device PIIX4_PM,help
          PIIX4_PM.command_serr_enable=bool (on/off)
          PIIX4_PM.multifunction=bool (on/off)
          PIIX4_PM.rombar=uint32
          PIIX4_PM.romfile=str
          PIIX4_PM.addr=int32 (Slot and optional function number, example: 06.0 or 06)
          PIIX4_PM.memory-hotplug-support=bool
          PIIX4_PM.acpi-pci-hotplug-with-bridge-support=bool
          PIIX4_PM.s4_val=uint8
          PIIX4_PM.disable_s4=uint8
          PIIX4_PM.disable_s3=uint8
          PIIX4_PM.smb_io_base=uint32

      Example of a device where it isn't fixed:

          $ qemu-system-x86_64 -device host-x86_64-cpu,help
          Can't list properties of device 'host-x86_64-cpu'

      Both failed with "Parameter 'driver' expects pluggable device type"
      before.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-Id: <1443689999-12182-11-git-send-email-armbru@redhat.com>
      (cherry picked from commit 33fe96833015cf15f4c0aa5bf8d34f60526e0732)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2874c6565e989b7f9ab852ccac437f6d40c61a6b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:58 2015 +0200

      qdev: Protect device-list-properties against broken devices

      Several devices don't survive object_unref(object_new(T)): they crash
      or hang during cleanup, or they leave dangling pointers behind.

      This breaks at least device-list-properties, because
      qmp_device_list_properties() needs to create a device to find its
      properties.  Broken in commit f4eb32b "qmp: show QOM properties in
      device-list-properties", v2.1.  Example reproducer:

          $ qemu-system-aarch64 -nodefaults -display none -machine none -S -qmp stdio
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 4, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device-list-properties", "arguments": { "typename": "pxa2xx-pcmcia" } }
          qemu-system-aarch64: /home/armbru/work/qemu/memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
          Aborted (core dumped)
          [Exit 134 (SIGABRT)]

      Unfortunately, I can't fix the problems in these devices right now.
      Instead, add DeviceClass member cannot_destroy_with_object_finalize_yet
      to mark them:

      * Hang during cleanup (didn't debug, so I can't say why):
        "realview_pci", "versatile_pci".

      * Dangling pointer in cpus: most CPUs, plus "allwinner-a10", "digic",
        "fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such
        CPUs

      * Assert kvm_enabled(): "host-x86_64-cpu", host-i386-cpu",
        "host-powerpc64-cpu", "host-embedded-powerpc-cpu",
        "host-powerpc-cpu" (the powerpc ones can't currently reach the
        assertion, because the CPUs are only registered when KVM is enabled,
        but the assertion is arguably in the wrong place all the same)

      Make qmp_device_list_properties() fail cleanly when the device is so
      marked.  This improves device-list-properties from "crashes, hangs or
      leaves dangling pointers behind" to "fails".  Not a complete fix, just
      a better-than-nothing work-around.  In the above reproducer,
      device-list-properties now fails with "Can't list properties of device
      'pxa2xx-pcmcia'".

      This also protects -device FOO,help, which uses the same machinery
      since commit ef52358 "qdev-monitor: include QOM properties in -device
      FOO, help output", v2.2.  Example reproducer:

          $ qemu-system-aarch64 -machine none -device pxa2xx-pcmcia,help

      Before:

          qemu-system-aarch64: .../memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.

      After:

          Can't list properties of device 'pxa2xx-pcmcia'

      Cc: "Andreas Färber" <afaerber@suse.de>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: qemu-ppc@nongnu.org
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-Id: <1443689999-12182-10-git-send-email-armbru@redhat.com>
      (cherry picked from commit 4c315c27661502a0813b129e41c0bf640c34a8d6)

      Conflicts:
      	hw/arm/fsl-imx25.c
      	hw/arm/fsl-imx31.c
      	target-tilegx/cpu.c
      	tests/device-introspect-test.c

      * removed hunks pertaining to devices/tests not in 2.4

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2d0583fc79ab119def5cfd38b1c695654e332cf2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:57 2015 +0200

      qmp: Fix device-list-properties not to crash for abstract device

      Broken in commit f4eb32b "qmp: show QOM properties in
      device-list-properties", v2.1.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-Id: <1443689999-12182-9-git-send-email-armbru@redhat.com>
      (cherry picked from commit edb1523d90415cb79f60f83b4028ef3820d15612)

      Conflicts:
      	tests/device-introspect-test.c

      * removed hunk specific to QAPI introspection (not in 2.4)

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 40161bf27b6f0143062f588b496f0a66b6ec769b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 10:26:27 2015 +0800

      vmxnet3: Drop net_vmxnet3_info.can_receive

      Commit 6e99c63 ("net/socket: Drop net_socket_can_send") changed the
      semantics around .can_receive for sockets to now require the device to
      flush queued pkts when transitioning to a .can_receive=true state. But
      it's OK to drop incoming packets when the link is not active.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 2734a20b8161831ba68c9166014e00522599d1e2)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2935ae915a618bab5b555b8963224fbeac4a5fa9
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 11 16:01:56 2015 +0800

      virtio-net: unbreak self announcement and guest offloads after migration

      After commit 019a3edbb25f1571e876f8af1ce4c55412939e5d ("virtio: make
      features 64bit wide"). Device's guest_features was actually set after
      vdc->load(). This breaks the assumption that device specific load()
      function can check guest_features. For virtio-net, self announcement
      and guest offloads won't work after migration.

      Fixing this by defer them to virtio_net_load() where guest_features
      were guaranteed to be set. Other virtio devices looks fine.

      Fixes: 019a3edbb25f1571e876f8af1ce4c55412939e5d
             ("virtio: make features 64bit wide")
      Cc: qemu-stable@nongnu.org
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>

      (cherry picked from commit 1f8828ef573c83365b4a87a776daf8bcef1caa21)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2f3c3108186acc992858d2866d3aa20eb2eaf598
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Aug 17 11:48:29 2015 +0200

      virtio: avoid leading underscores for helpers

      Commit ef546f1275f6563e8934dd5e338d29d9f9909ca6 ("virtio: add
      feature checking helpers") introduced a helper __virtio_has_feature.
      We don't want to use reserved identifiers, though, so let's
      rename __virtio_has_feature to virtio_has_feature and virtio_has_feature
      to virtio_vdev_has_feature.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 95129d6fc9ead97155627a4ca0cfd37282883658)
      * prereq for 1f8828e
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 1f21d3b8dc11231c58b1f53804d33151ceeac84b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Sep 13 23:03:45 2015 +0200

      target-ppc: fix xscmpodp and xscmpudp decoding

      The xscmpodp and xscmpudp instructions only have the AX, BX bits in
      there encoding, the lowest bit (usually TX) is marked as an invalid
      bit. We therefore can't decode them with GEN_XX2FORM, which decodes
      the two lowest bit.

      Introduce a new form GEN_XX2FORM, which decodes AX and BX and mark
      the lowest bit as invalid.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 8f60f8e2e574f341709128ff7637e685fd640254)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit bac9ce97d33c8034e41bedc1e8d4c0604f069f5e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Sep 13 23:03:44 2015 +0200

      target-ppc: fix vcipher, vcipherlast, vncipherlast and vpermxor

      For vector instructions, the helpers get pointers to the vector register
      in arguments. Some operands might point to the same register, including
      the operand holding the result.

      When emulating instructions which access the vector elements in a
      non-linear way, we need to store the result in an temporary variable.

      This fixes openssl when emulating a POWER8 CPU.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 65cf1f65be0fc4883edbd66feeab3ddaceb11c00)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 33fca8589cf2aa7bf91564e6a8f26b3ba0910541
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Mon Sep 14 11:34:54 2015 +0100

      tcg/mips: Fix clobbering of qemu_ld inputs

      The MIPS TCG backend implements qemu_ld with 64-bit targets using the v0
      register (base) as a temporary to load the upper half of the QEMU TLB
      comparator (see line 5 below), however this happens before the input
      address is used (line 8 to mask off the low bits for the TLB
      comparison, and line 12 to add the host-guest offset). If the input
      address (addrl) also happens to have been placed in v0 (as in the second
      column below), it gets clobbered before it is used.

           addrl in t2              addrl in v0

       1 srl     a0,t2,0x7        srl     a0,v0,0x7
       2 andi    a0,a0,0x1fe0     andi    a0,a0,0x1fe0
       3 addu    a0,a0,s0         addu    a0,a0,s0
       4 lw      at,9136(a0)      lw      at,9136(a0)      set TCG_TMP0 (at)
       5 lw      v0,9140(a0)      lw      v0,9140(a0)      set base (v0)
       6 li      t9,-4093         li      t9,-4093
       7 lw      a0,9160(a0)      lw      a0,9160(a0)      set addend (a0)
       8 and     t9,t9,t2         and     t9,t9,v0         use addrl
       9 bne     at,t9,0x836d8c8  bne     at,t9,0x836d838  use TCG_TMP0
      10  nop                      nop
      11 bne     v0,t8,0x836d8c8  bne     v0,a1,0x836d838  use base
      12  addu   v0,a0,t2          addu   v0,a0,v0         use addrl, addend
      13 lw      t0,0(v0)         lw      t0,0(v0)

      Fix by using TCG_TMP0 (at) as the temporary instead of v0 (base),
      pushing the load on line 5 forward into the delay slot of the low
      comparison (line 10). The early load of the addend on line 7 also needs
      pushing even further for 64-bit targets, or it will clobber a0 before
      we're done with it. The output for 32-bit targets is unaffected.

       srl     a0,v0,0x7
       andi    a0,a0,0x1fe0
       addu    a0,a0,s0
       lw      at,9136(a0)
      -lw      v0,9140(a0)      load high comparator
       li      t9,-4093
      -lw      a0,9160(a0)      load addend
       and     t9,t9,v0
       bne     at,t9,0x836d838
      - nop
      + lw     at,9140(a0)      load high comparator
      +lw      a0,9160(a0)      load addend
      -bne     v0,a1,0x836d838
      +bne     at,a1,0x836d838
        addu   v0,a0,v0
       lw      t0,0(v0)

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      (cherry picked from commit 5eb4f645eba8a79ea643b228c74a79183d436c97)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a479b21c111a87a50203a7413c4e5ec419fc88dd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Aug 25 20:00:46 2015 +0200

      qom: Fix invalid error check in property_get_str()

      When a function returns a null pointer on error and only on error, you
      can do

          if (!foo(foos, errp)) {
              ... handle error ...
          }

      instead of the more cumbersome

          Error *err = NULL;

          if (!foo(foos, &err)) {
              error_propagate(errp, err);
              ... handle error ...
          }

      A StringProperty's getter, however, may return null on success!  We
      then fail to call visit_type_str().

      Screwed up in 6a146eb, v1.1.

      Fails tests/qom-test in my current, heavily hacked QAPI branch.  No
      reproducer for master known (but I didn't look hard).

      Cc: Anthony Liguori <anthony@codemonkey.ws>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      (cherry picked from commit e1c8237df5395f6a453f18109bd9dd33fb2a397c)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d11ff15fd5236bdb82b2def0ecc568290bfdba35
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Aug 25 20:00:45 2015 +0200

      qom: Do not reuse errp after a possible error

      The argument for an Error **errp parameter must point to a null
      pointer.  If it doesn't, and an error happens, error_set() fails its
      assertion.

      Instead of

          foo(foos, errp);
          bar(bars, errp);

      you need to do something like

          Error *err = NULL;

          foo(foos, &err);
          if (err) {
              error_propagate(errp, err);
              goto out;
          }

          bar(bars, errp);
      out:

      Screwed up in commit 0e55884 (v1.3.0): property_get_bool().

      Screwed up in commit 1f21772 (v2.1.0): object_property_get_enum() and
      object_property_get_uint16List().

      Screwed up in commit a8e3fbe (v2.4.0): property_get_enum(),
      property_set_enum().

      Found by inspection, no actual crashes observed.

      Fix them up.

      Cc: Anthony Liguori <anthony@codemonkey.ws>
      Cc: Hu Tao <hutao@cn.fujitsu.com>
      Cc: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      (cherry picked from commit 4715d42efe8632b0f9d2594a80e917de45e4ef88)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 1b8e1f7ad9dcf415e985e943cb7f18a686803fdd
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Sep 17 14:17:04 2015 -0400

      ide: unify io_buffer_offset increments

      IDEState's io_buffer_offset was originally added to keep track of offsets
      in AHCI rather exclusively, but it was added to IDEState instead of an
      AHCI-specific structure.

      AHCI fakes all PIO transfers using DMA and a scatter-gather list. When
      the core or atapi layers invoke HBA-specific mechanisms for transfers,
      they do not always know that it is being backed by DMA or a sglist, so
      this offset is not always updated by the HBA code everywhere.

      If we modify it in dma_buf_commit, however, any HBA that needs to use
      this offset to manage operating on only part of a sglist will have
      access to it.

      This will fix ATAPI PIO transfers performed through the AHCI HBA,
      which were previously not modifying this value appropriately.

      This will fix ATAPI PIO transfers larger than one sector.

      Reported-by: Hannes Reinecke <hare@suse.de>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1440546331-29087-2-git-send-email-jsnow@redhat.com
      CC: qemu-stable@nongnu.org
      (cherry picked from commit aaeda4a3c9e4d1d25c65ce8ca98e2de06daf1eec)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit e00bf9ee701b65a0fa7c6b011b0050845c798aa8
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Thu Jul 30 23:08:12 2015 +0200

      slirp: Fix non blocking connect for w32

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      (cherry picked from commit a246a01631f90230374c2b8ffce608232e2aa654)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 78aeb6984cedf8efdc6a007fddaed46d55a07edf
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Sep 16 16:35:46 2015 +0800

      nbd: release exp->blk after all clients are closed

      If the socket fd is shutdown, there may be some data which is received before
      shutdown. We will read the data and do read/write in nbd_trip(). But the exp's
      blk is NULL, and it will cause qemu crashed.

      Reported-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-Id: <55F929E2.1020501@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit d6268348493f32ecc096caa637620757472a1196)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 6d62d0e3dd47cbdc8a486a7c99cb0c07a1b916d8
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Sep 15 16:34:59 2015 -0500

      spapr_pci: fix device tree props for MSI/MSI-X

      PAPR requires ibm,req#msi and ibm,req#msi-x to be present in the
      device node to define the number of msi/msi-x interrupts the device
      supports, respectively.

      Currently we have ibm,req#msi-x hardcoded to a non-sensical constant
      that happens to be 2, and are missing ibm,req#msi entirely. The result
      of that is that msi-x capable devices get limited to 2 msi-x
      interrupts (which can impact performance), and msi-only devices likely
      wouldn't work at all. Additionally, if devices expect a minimum that
      exceeds 2, the guest driver may fail to load entirely.

      SLOF still owns the generation of these properties at boot-time
      (although other device properties have since been offloaded to QEMU),
      but for hotplugged devices we rely on the values generated by QEMU
      and thus hit the limitations above.

      Fix this by generating these properties in QEMU as expected by guests.

      In the future it may make sense to modify SLOF to pass through these
      values directly as we do with other props since we're duplicating SLOF
      code.

      Cc: qemu-ppc@nongnu.org
      Cc: qemu-stable@nongnu.org
      Cc: David Gibson <david@gibson.dropbear.id.au>
      Cc: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      (cherry picked from commit a8ad731a001d41582c9cec4015f73ab3bc11a28d)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5644f6f9242895db837d2c825cfe083f2a1d71ab
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Sep 10 18:19:32 2015 +0300

      gtk: use setlocale() for LC_MESSAGES only

      The QEMU code is not internationalized and assumes that it runs under
      the C locale, but if we use the GTK+ UI we'll end up importing the
      locale settings from the environment. This can break things, such as
      the JSON generator and iotest 120 in locales that use a decimal comma.

      We do however have translations for a few simple strings for the GTK+
      menu items, so in order to run QEMU using the C locale, and yet have a
      translated UI let's use setlocale() for LC_MESSAGES only.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit 2cb5d2a47c655331bcf0ab16bab8fe4701182c58)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 63d761388d6fea994ca498c6e7a210851a99ad93
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Sep 17 14:17:05 2015 -0400

      ide: fix ATAPI command permissions

      We're a little too lenient with what we'll let an ATAPI drive handle.
      Clamp down on the IDE command execution table to remove CD_OK permissions
      from commands that are not and have never been ATAPI commands.

      For ATAPI command validity, please see:
      - ATA4 Section 6.5 ("PACKET Command feature set")
      - ATA8/ACS Section 4.3 ("The PACKET feature set")
      - ACS3 Section 4.3 ("The PACKET feature set")

      ACS3 has a historical command validity table in Table B.4
      ("Historical Command Assignments") that can be referenced to find when
      a command was introduced, deprecated, obsoleted, etc.

      The only reference for ATAPI command validity is by checking that
      version's PACKET feature set section.

      ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
      therefore are assumed to have never been ATAPI commands.

      Mandatory commands, as listed in ATA8-ACS3, are:

      - DEVICE RESET
      - EXECUTE DEVICE DIAGNOSTIC
      - IDENTIFY DEVICE
      - IDENTIFY PACKET DEVICE
      - NOP
      - PACKET
      - READ SECTOR(S)
      - SET FEATURES

      Optional commands as listed in ATA8-ACS3, are:

      - FLUSH CACHE
      - READ LOG DMA EXT
      - READ LOG EXT
      - WRITE LOG DMA EXT
      - WRITE LOG EXT

      All other commands are illegal to send to an ATAPI device and should
      be rejected by the device.

      CD_OK removal justifications:

      0x06 WIN_DSM              Defined in ACS2. Not valid for ATAPI.
      0x21 WIN_READ_ONCE        Retired in ATA5. Not ATAPI in ATA4.
      0x94 WIN_STANDBYNOW2      Retired in ATA4. Did not coexist with ATAPI.
      0x95 WIN_IDLEIMMEDIATE2   Retired in ATA4. Did not coexist with ATAPI.
      0x96 WIN_STANDBY2         Retired in ATA4. Did not coexist with ATAPI.
      0x97 WIN_SETIDLE2         Retired in ATA4. Did not coexist with ATAPI.
      0x98 WIN_CHECKPOWERMODE2  Retired in ATA4. Did not coexist with ATAPI.
      0x99 WIN_SLEEPNOW2        Retired in ATA4. Did not coexist with ATAPI.
      0xE0 WIN_STANDBYNOW1      Not part of ATAPI in ATA4, ACS or ACS3.
      0xE1 WIN_IDLEIMMDIATE     Not part of ATAPI in ATA4, ACS or ACS3.
      0xE2 WIN_STANDBY          Not part of ATAPI in ATA4, ACS or ACS3.
      0xE3 WIN_SETIDLE1         Not part of ATAPI in ATA4, ACS or ACS3.
      0xE4 WIN_CHECKPOWERMODE1  Not part of ATAPI in ATA4, ACS or ACS3.
      0xE5 WIN_SLEEPNOW1        Not part of ATAPI in ATA4, ACS or ACS3.
      0xF8 WIN_READ_NATIVE_MAX  Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.

      This patch fixes a divide by zero fault that can be caused by sending
      the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
      attempt to use zeroed CHS values to perform sector arithmetic.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
      CC: qemu-stable@nongnu.org
      (cherry picked from commit d9033e1d3aa666c5071580617a57bd853c5d794a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit c13b1c8314d1178161a1fa1a0c4d460bd4d66a64
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Sep 14 16:39:47 2015 +0200

      qcow2: Make size_to_clusters() return uint64_t

      Sadly, some images may have more clusters than what can be represented
      using a plain int. We should be prepared for that case (in
      qcow2_check_refcounts() we actually were trying to catch that case, but
      since size_to_clusters() truncated the returned value, that check never
      did anything useful).

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      (cherry picked from commit b6d36def6d9e9fd187327182d0abafc9b7085d8f)

      Conflicts:
      	block/qcow2-cluster.c
      	block/qcow2.h

      * removed context dependency on ff99129a
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 052677b2c87779a6da6181b848825b29e65c0f54
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Sep 14 14:39:47 2015 +0100

      target-arm: Share all common TCG temporaries

      This is a bug fix for aarch64.  At present, we have branches using
      the 32-bit (translate.c) versions of cpu_[NZCV]F, but we set the flags
      using the 64-bit (translate-a64.c) versions of cpu_[NZCV]F.  From
      the view of the TCG code generator, these are unrelated variables.

      The bug is hard to see because we currently only read these variables
      from branches, and upon reaching a branch TCG will first spill live
      variables and then reload the arguments of the branch.  Since the
      32-bit versions were never live until reaching the branch, we'd re-read
      the data that had just been spilled from the 64-bit versions.

      There is currently no such problem with the cpu_exclusive_* variables,
      but there's no point in tempting fate.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1441909103-24666-2-git-send-email-rth@twiddle.net
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit 78bcaa3e37afbd0c5316634f917c13487384b6ca)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0fdf9f756fff60ec1c02dbd59698ba3dbb30eabe
  Author: Pierre Morel <pmorel@linux.vnet.ibm.com>
  Date:   Mon Sep 7 13:33:56 2015 +0200

      virtio dataplane: adapt dataplane for virtio Version 1

      Let dataplane allocate different region for the desc/avail/used
      ring regions.
      Take VIRTIO_RING_F_EVENT_IDX into account to increase the used/avail
      rings accordingly.

      [Fix 32-bit builds by changing 16lx format specifier to HWADDR_PRIx.
      --Stefan]

      Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
      Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Message-id: 1441625636-23773-1-git-send-email-pmorel@linux.vnet.ibm.com
      (changed __virtio16 into uint16_t,
       map descriptor table and available ring read-only)
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

      (cherry picked from commit a9718ef0005d6910097788936dc40c0204713729)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d077545dfef3d59f0286e0cb28cdb1c6d0570c22
  Author: Aníbal Limón <anibal.limon@linux.intel.com>
  Date:   Thu Sep 3 15:48:33 2015 -0500

      cpus.c: qemu_mutex_lock_iothread fix race condition at cpu thread init

      When QEMU starts the RCU thread executes qemu_mutex_lock_thread
      causing error "qemu:qemu_cpu_kick_thread: No such process" and exits.

      This isn't occur frequently but in glibc the thread id can exist and
      this not guarantee that the thread is on active/running state. If is
      inserted a sleep(1) after newthread assignment [1] the issue appears.

      So not make assumption that thread exist if first_cpu->thread is set
      then change the validation of cpu to created that is set into cpu
      threads (kvm, tcg, dummy).

      [1] https://sourceware.org/git/?p=glibc.git;a=blob;f=nptl/pthread_create.c;h=d10f4ea8004e1d8f3a268b95cc0f8d93b8d89867;hb=HEAD#l621

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
      Message-Id: <1441313313-3040-1-git-send-email-anibal.limon@linux.intel.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 46036b2462c7ff56c0af6466ea6b9248197a38a8)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f6737604da3b44322a91ebaa4b184aa519bbb66a
  Author: Vladislav Yasevich <vyasevic@redhat.com>
  Date:   Tue Sep 1 11:26:46 2015 -0400

      rtl8139: Do not consume the packet during overflow in standard mode.

      When operation in standard mode, we currently return the size
      of packet during buffer overflow.  This consumes the overflow
      packet.  Return 0 instead so we can re-process the overflow packet
      when we have room.

      This fixes issues with lost/dropped fragments of large messages.

      Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1441121206-6997-3-git-send-email-vyasevic@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 26c4e7ca72d970d120f0f51244bc8d37458512a0)
      *removed dependency on b76f21a7
      *removed context dependency on 4cbea598
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d2b0f96fe2762e2863a6fbbb0acb02606537cc9e
  Author: Vladislav Yasevich <vyasevic@redhat.com>
  Date:   Tue Sep 1 11:26:45 2015 -0400

      rtl8139: Fix receive buffer overflow check

      rtl8139_do_receive() tries to check for the overflow condition
      by making sure that packet_size + 8 does not exceed the
      available buffer space.  The issue here is that RxBuffAddr,
      used to calculate available buffer space, is aligned to a
      a 4 byte boundry after every update.  So it is possible that
      every packet ends up being slightly padded when written
      to the receive buffer.  This padding is not taken into
      account when checking for overflow and we may end up missing
      the overflow condition can causing buffer overwrite.

      This patch takes alignment into consideration when
      checking for overflow condition.

      Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1441121206-6997-2-git-send-email-vyasevic@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit fabdcd3392f16fc666b1d04fc1bbe5f1dbbf10a4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a00431853f6faef36618dad238a859e3d6805054
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Jul 24 12:08:37 2015 +0200

      s390x/css: start with cleared cstat/dstat

      When executing the start function, we should start with a clear state
      regarding subchannel and device status; it is easy to forget updating one
      of them after the ccw has been processed.

      Note that we don't need to care about resetting the various control
      fields: They are cleared by tsch(), and if they were still pending,
      we wouldn't be able to execute the start function in the first
      place.

      Also note that we don't want to clear cstat/dstat if a suspended
      subchannel is resumed.

      This fixes a bug where we would continue to present channel-program
      check in cstat even though later ccw requests for the subchannel
      finished without error (i.e. cstat should be 0).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      (cherry picked from commit 6b7741c2bedeae2e8c54fffce81723ca0a0c25c0)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit b51715e1c072ecc59a326f31c282501930f7c3ac
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Aug 28 13:10:17 2015 +0200

      PPC: E500: Update u-boot to commit 79c884d7e4

      The current U-Boot binary in QEMU has a bug where it fails to support
      dynamic CCSR addressing. Without this support, u-boot can not boot the
      ppce500 machine anymore. This has been fixed upstream in u-boot commit
      e834975b.

      Update the u-boot blob we carry in QEMU to the latest u-boot upstream,
      so that we can successfully run u-boot with the ppce500 machine again.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Tested-by: Thomas Huth <thuth@redhat.com>
      (cherry picked from commit d4574435a6530bbd96ae130eddfe5b676f91367a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 267bc474382f55eca082065a0f290695a5aa5242
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Aug 27 12:06:23 2015 +0300

      scripts/dump-guest-memory.py: fix after RAMBlock change

      commit 9b8424d5735278ca382f11adc7c63072b632ab83
          "exec: split length -> used_length/max_length"
      changed field names in struct RAMBlock

      It turns out that scripts/dump-guest-memory.py was
      poking at this field, update it accordingly.

      Cc: qemu-stable@nongnu.org
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1440666378-3152-1-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 0c71d41e2aa3c7356500ae624166f3bb8c201aee)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 955ff148de252b2fec92a1beef7f91c0987bb713
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Aug 26 09:52:51 2015 +0800

      vhost-scsi: fix wrong vhost-scsi firmware path

      vhost-scsi bootindex does't work because Qemu passes
      wrong fireware path to seabios.

      before:
        /pci@i0cf8/scsi@7channel@0/vhost-scsi@0,0
      after applying the patch:
        /pci@i0cf8/scsi@7/channel@0/vhost-scsi@0,0

      Reported-by: Subo <subo7@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1440553971-11108-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit f42bf6a262ab5923a1a3bc8f731b830396937c47)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 71b685832de15374e75e382a6ff60c95ced37f82
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Sun Aug 23 11:50:55 2015 +0100

      mac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete

      The code to flush the DBDMA channel was effectively duplicated in
      dbdma_control_write(), except for the fact that the copy executed outside of a
      RUN bit transition was broken by not clearing the FLUSH bit once the flush was
      complete.

      Newer PPC Linux kernels would timeout waiting for the FLUSH bit to clear again
      after submitting a FLUSH command. Fix this by always clearing the FLUSH bit
      once the channel flush is complete and removing the repeated code.

      Reported-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 1cde732d88af34849343dc1f0e68072eab0841b9)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 9a20ccaecd45f21ac4766ae6634aaa5499ddc772
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Aug 20 16:00:38 2015 -0700

      qemu-img: Fix crash in amend invocation

      Example:
      $ ./qemu-img create -f qcow2 /tmp/t.qcow2 64M
      $ ./qemu-img amend -f qcow2 -o backing_file=/tmp/t.qcow2, -o help \
          /tmp/t.qcow2

      This should not crash. This actually is tested by iotest 082, but not
      caught due to the segmentation fault being silent (which is something
      that needs to be fixed, too).

      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      (cherry picked from commit e814dffcc9810ed77fe99081be9751b620a894c4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d9af73191cc4a1f23ca8149ca2d5f71f74f5329d
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Aug 20 12:46:47 2015 +0200

      block/nfs: fix calculation of allocated file size

      st.st_blocks is always counted in 512 byte units. Do not
      use st.st_blksize as multiplicator which may be larger.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1440067607-14547-1-git-send-email-pl@kamp.de
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      (cherry picked from commit 055c6f912c8d3cd9a901972ae432c47e5872f71a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 637dd0bb7c0e8a3275230b771085439f256b403d
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Aug 17 20:28:18 2015 -0700

      exec-all: Translate TCI return addresses backwards too

      This subtraction of return addresses applies directly to TCI as well as
      host-TCG. This fixes Linux boots for at least Microblaze, CRIS, ARM and
      SH4 when using TCI.

      [sw: Removed indentation for preprocessor statement]
      [sw: The patch also fixes Linux boot for x86_64]

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      (cherry picked from commit a17d448274575efbfcc1c04ec2641a0afeb74e17)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2ac9fa162e25019eaa548f1fadfee256af88ca0f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Aug 14 13:33:36 2015 +0200

      block/iscsi: validate block size returned from target

      It has been reported that at least tgtd returns a block size of 0
      for LUN 0. To avoid running into divide by zero later on and protect
      against other problematic block sizes validate the block size right
      at connection time.

      Cc: qemu-stable@nongnu.org
      Reported-by: Andrey Korolyov <andrey@xdel.ru>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-Id: <1439552016-8557-1-git-send-email-pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 6d1f252d8c1ba73bf6ed9af28731a9c9c3d473a2)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5b7d840e741aa06751b0fcec02ccda50a6bd574d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Sep 7 10:39:27 2015 +0100

      target-arm/arm-semi.c: Fix broken SYS_WRITE0 via gdb

      A spurious trailing "\n" in the gdb syscall format string used
      for SYS_WRITE0 meant that gdb would reject the remote syscall,
      with the effect that the output from the guest was silently dropped.
      Remove the newline so that gdb accepts the packet.

      Cc: qemu-stable@nongnu.org

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit 857b55adb77004d9ec9202078b7f1f3a1a076112)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0de7d2b793f2e3cfeedfc822429a6bce6e48bda3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Aug 13 10:41:50 2015 +0200

      mirror: Fix coroutine reentrance

      This fixes a regression introduced by commit dcfb3beb ("mirror: Do zero
      write on target if sectors not allocated"), which was reported to cause
      aborts with the message "Co-routine re-entered recursively".

      The cause for this bug is the following code in mirror_iteration_done():

          if (s->common.busy) {
              qemu_coroutine_enter(s->common.co, NULL);
          }

      This has always been ugly because - unlike most places that reenter - it
      doesn't have a specific yield that it pairs with, but is more
      uncontrolled.  What we really mean here is "reenter the coroutine if
      it's in one of the four explicit yields in mirror.c".

      This used to be equivalent with s->common.busy because neither
      mirror_run() nor mirror_iteration() call any function that could yield.
      However since commit dcfb3beb this doesn't hold true any more:
      bdrv_get_block_status_above() can yield.

      So what happens is that bdrv_get_block_status_above() wants to take a
      lock that is already held, so it adds itself to the queue of waiting
      coroutines and yields. Instead of being woken up by the unlock function,
      however, it gets woken up by mirror_iteration_done(), which is obviously
      wrong.

      In most cases the code actually happens to cope fairly well with such
      cases, but in this specific case, the unlock must already have scheduled
      the coroutine for wakeup when mirror_iteration_done() reentered it. And
      then the coroutine happened to process the scheduled restarts and tried
      to reenter itself recursively.

      This patch fixes the problem by pairing the reenter in
      mirror_iteration_done() with specific yields instead of abusing
      s->common.busy.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1439455310-11263-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      (cherry picked from commit e424aff5f307227b1c2512bbb8ece891bb895cef)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f399ea092ea46c82b819ba1fdbcb082eb8019a32
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 29 16:45:11 2015 +0800

      scsi-disk: Fix assertion failure on WRITE SAME

      The last portion of an unaligned WRITE SAME command could fail the
      assertion in bdrv_aligned_pwritev:

          assert(!qiov || bytes == qiov->size);

      Because we updated data->iov.iov_len right above this if block, but
      data->qiov still has the old size.

      Reinitialize the qiov to make them equal and keep block layer happy.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1438159512-3871-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit a56537a12757a8cdee24ad8c83e5af7a9833ea70)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 83c92b45140be773f0c5545dddea35a89db1ad03
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Sep 22 16:53:17 2015 -0500

      Update version for 2.4.0.1 release

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5a1ccdfe44946e726b4c6fda8a4493b3931a68c1
  Author: P J P <pjp@fedoraproject.org>
  Date:   Tue Sep 15 16:46:59 2015 +0530

      net: avoid infinite loop when receiving packets(CVE-2015-5278)

      Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
      bytes to process network packets. While receiving packets
      via ne2000_receive() routine, a local 'index' variable
      could exceed the ring buffer size, leading to an infinite
      loop situation.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 737d2b3c41d59eb8f94ab7eb419b957938f24943)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755
  Author: P J P <pjp@fedoraproject.org>
  Date:   Tue Sep 15 16:40:49 2015 +0530

      net: add checks to validate ring buffer pointers(CVE-2015-5279)

      Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
      bytes to process network packets. While receiving packets
      via ne2000_receive() routine, a local 'index' variable
      could exceed the ring buffer size, which could lead to a
      memory buffer overflow. Added other checks at initialisation.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 9bbdbc66e5765068dce76e9269dce4547afd8ad4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b
  Author: P J P <pjp@fedoraproject.org>
  Date:   Fri Sep 4 17:21:06 2015 +0100

      e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)

      While processing transmit descriptors, it could lead to an infinite
      loop if 'bytes' was to become zero; Add a check to avoid it.

      [The guest can force 'bytes' to 0 by setting the hdr_len and mss
      descriptor fields to 0.
      --Stefan]

      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1441383666-6590-1-git-send-email-stefanha@redhat.com
      (cherry picked from commit b947ac2bf26479e710489739c465c8af336599e7)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit efec4dcd2552e85ed57f276b58f09fc385727450
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Aug 17 19:56:53 2015 +0200

      vnc: fix memory corruption (CVE-2015-5225)

      The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential
      memory corruption issues" can become negative.  Result is (possibly
      exploitable) memory corruption.  Reason for that is it uses the stride
      instead of bytes per scanline to apply limits.

      For the server surface is is actually fine.  vnc creates that itself,
      there is never any padding and thus scanline length always equals stride.

      For the guest surface scanline length and stride are typically identical
      too, but it doesn't has to be that way.  So add and use a new variable
      (guest_ll) for the guest scanline length.  Also rename min_stride to
      line_bytes to make more clear what it actually is.  Finally sprinkle
      in an assert() to make sure we never use a negative _cmp_bytes again.

      Reported-by: 范祚至(库特) <zuozhi.fzz@alibaba-inc.com>
      Reviewed-by: P J P <ppandit@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit eb8934b0418b3b1d125edddc4fc334a54334a49b)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5c79ae3615d5dafdf1bb09b7a356a3a005714e3d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 11 15:30:34 2015 +0100

      Update version for v2.4.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2d697366a14ce95da2e9a59ea9872d3034eb49e4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Aug 5 17:02:58 2015 +0100

      Update version for v2.4.0-rc4 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0175409df42c20257171df87657dd705558aa94d
  Merge: e94867e 74aae7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Aug 5 16:02:00 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio fix for 2.4

      Fixes migration in virtio 1 mode.
      We still have a known bug with memory hotplug, it doesn't
      look like we can fix that in time for 2.4.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio: fix 1.0 virtqueue migration

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e94867ed5f241008d0f53142b2704a075f9ed505
  Author: Sascha Silbe <silbe@linux.vnet.ibm.com>
  Date:   Tue Aug 4 16:48:25 2015 +0200

      block: don't register quorum driver if SHA256 support is unavailable

      Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs]
      broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a
      compile-time check to a run-time check at device open time. The result
      is that we now advertise a feature (the quorum block driver) that will
      never work (on those hosts). There's no way (short of parsing
      human-readable error messages) for qemu-iotests or any other API
      consumer to recognise that the quorum block driver isn't _actually_
      available and shouldn't be used or tested.

      Move the run-time check to bdrv_quorum_init() to avoid registering the
      quorum block driver if we know it cannot work. This way API consumers
      can recognise it's unavailable.

      Fixes: 488981a4af396551a3178d032cc2b41d9553ada2
      Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1438699705-21761-1-git-send-email-silbe@linux.vnet.ibm.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 74aae7b22b8a67cf31937b2f4bdefe2881e799e9
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Wed Aug 5 17:50:07 2015 +0800

      virtio: fix 1.0 virtqueue migration

      1.0 does not requires physically-contiguous pages layout for a
      virtqueue. So we could not infer avail and used from desc. This means
      we need to migrate vring.avail and vring.used when host support virtio
      1.0. This fixes malfunction of virtio 1.0 device after migration.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2be4f242b50a84bf360df02480b173bfed161107
  Merge: 426d0e7 27751aa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 4 16:51:24 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-08-04

      # gpg: Signature made Tue 04 Aug 2015 16:49:42 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 27751aabd1e0359d84314bc230beccdef2168d1f
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Aug 4 16:17:21 2015 +0200

      target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

      Previous patch changed xlevel and missed the compatibility code.

      Fixes: 3046bb5debc8 ("target-i386: emulate CPUID level of real hardware")
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 426d0e7b7e031a1592292b3eb275483b341a2f28
  Merge: 260425a b7f26e5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 4 12:57:06 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging

      MIPS patches 2015-08-04

      Changes:
      * fix semihosting for microMIPS R6
      * fix an abort when booting mips64 kernel with --enable-tcg-debug

      # gpg: Signature made Tue 04 Aug 2015 12:32:17 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150804:
        target-mips: Copy restrictions from ext/ins to dext/dins
        target-mips: fix semihosting for microMIPS R6

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7f26e523914b982a1c1bfa8295f77ff9787c33c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Aug 3 12:35:53 2015 -0700

      target-mips: Copy restrictions from ext/ins to dext/dins

      The checks in dins is required to avoid triggering an assertion
      in tcg_gen_deposit_tl.  The check in dext is just for completeness.
      Fold the other D cases in via fallthru.

      In this case the errant dins appears to be data, not code, as
      translation failed to stop after a break insn.

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 060ebfef1a09b58fb219b3769b72efb407515bf1
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Aug 3 13:01:19 2015 +0100

      target-mips: fix semihosting for microMIPS R6

      In semihosting mode the SDBBP 1 instructions should trigger UHI syscall,
      but in QEMU this does not happen for recently added microMIPS R6.
      Consequently bare metal microMIPS R6 programs supporting UHI will not run.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 260425ab405ea76c44dd59744d05176d4f579a52
  Merge: e95edef 6cd3878
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 18:52:55 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging

      cve-2015-5166

      # gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/cve-2015-5166-tag:
        Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e95edefbd0559e1d0aa09549641b5d9af1f96fac
  Merge: f60c871 8c6dc68
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 17:33:35 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into staging

      xen-migration-2.4

      # gpg: Signature made Mon 03 Aug 2015 17:18:36 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-migration-2.4-tag:
        migration: Fix regression for xenfv and pc,accel=xen machine.
        migration: Fix global state with Xen.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c6dc68f4cff9eef870497a19a5373dde9dbdcc2
  Author: Anthony PERARD <anthony.perard@citrix.com>
  Date:   Mon Aug 3 15:29:21 2015 +0100

      migration: Fix regression for xenfv and pc,accel=xen machine.

      This fix migration from the same QEMU version and from previous QEMU
      version.

      >From the global state section, we don't need runstate with Xen. Right now,
      the way the Xen toolstack knows when QEMU is ready is when QEMU reach
      "running" runstate.

      The configuration section and the section footers are not going to be
      present in previous version of QEMU with xenfv machine, so we skip them.

      The Xen toolstack libxenlight does not specify a particular version of the
      'pc' machine, so migration from older version of QEMU used by Xen to newer
      one would break due to missing "configuration" section and section footers.

      Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit c69adea462a97c02001b2dd1edd2a0692d27f5a2
  Author: Anthony PERARD <anthony.perard@citrix.com>
  Date:   Mon Aug 3 15:29:19 2015 +0100

      migration: Fix global state with Xen.

      When doing migration via the QMP command xen_save_devices_state, the
      current runstate is not store into the global state section. Also the
      current runstate is not the one we want on the receiver side.

      During migration, the Xen toolstack paused QEMU before save the devices
      state. Also, the toolstack expect QEMU to autostart when the migration is
      finished.
      So this patch store "running" as it's current runstate.

      Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit f60c87154ac722c528fd5582f7137914a93c5eec
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Jul 24 16:47:37 2015 +0200

      configure: Drop vnc-ws feature from help text

      Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped
      the --enable-vnc-ws option but forgot to update the help text. Fix this.

      Cc: Daniel P. Berrange <berrange@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Message-id: 1437749257-3313-1-git-send-email-afaerber@suse.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cd387833d05e8ad31829d97e474dc420625aed9
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Aug 3 13:56:57 2015 +0000

      Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

      pci_piix3_xen_ide_unplug should completely unhook the unplugged
      IDEDevice from the corresponding BlockBackend, otherwise the next call
      to release_drive will try to detach the drive again.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef
  Merge: bd80b59 8357946
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 13:09:10 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging

      Pull request

      # gpg: Signature made Mon Aug  3 13:08:25 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request:
        rtl8139: check TCP Data Offset field (CVE-2015-5165)
        rtl8139: skip offload on short TCP header (CVE-2015-5165)
        rtl8139: check IP Total Length field (CVE-2015-5165)
        rtl8139: check IP Header Length field (CVE-2015-5165)
        rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
        rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
        rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8357946b15f0a31f73dd691b7da95f29318ed310
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:39:29 2015 +0100

      rtl8139: check TCP Data Offset field (CVE-2015-5165)

      The TCP Data Offset field contains the length of the header.  Make sure
      it is valid and does not exceed the IP data length.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4240be45632db7831129f124bcf53c1223825b0f
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:36:15 2015 +0100

      rtl8139: skip offload on short TCP header (CVE-2015-5165)

      TCP Large Segment Offload accesses the TCP header in the packet.  If the
      packet is too short we must not attempt to access header fields:

        tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
        int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c6296ea88df040054ccd781f3945fe103f8c7c17
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:34:40 2015 +0100

      rtl8139: check IP Total Length field (CVE-2015-5165)

      The IP Total Length field includes the IP header and data.  Make sure it
      is valid and does not exceed the Ethernet payload size.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 03247d43c577dfea8181cd40177ad5ba77c8db76
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:32:32 2015 +0100

      rtl8139: check IP Header Length field (CVE-2015-5165)

      The IP Header Length field was only checked in the IP checksum case, but
      is used in other cases too.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e1c120a9c54872f8a538ff9129d928de4e865cbd
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 14:30:37 2015 +0100

      rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)

      Transmit offload features access Ethernet and IP headers the packet.  If
      the packet is too short we must not attempt to access header fields:

        int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
        ...
        eth_payload_data = saved_buffer + ETH_HLEN;
        ...
        ip = (ip_header*)eth_payload_data;
        if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d6812d60e7932de3cd0f602c0ee63dd3d09f1847
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:17:28 2015 +0100

      rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)

      The previous patch stopped using the ip pointer as an indicator that the
      IP header is present.  When we reach the if (ip) {...} statement we know
      ip is always non-NULL.

      Remove the if statement to reduce nesting.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 39b8e7dcaf04cbdb926b478f825b160d852752b5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:13:32 2015 +0100

      rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

      Transmit offload needs to parse packet headers.  If header fields have
      unexpected values the offload processing is skipped.

      The code currently uses nested ifs because there is relatively little
      input validation.  The next patches will add missing input validation
      and a goto label is more appropriate to avoid deep if statement nesting.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bd80b5963f58c601f31d3186b89887bf8e182fb5
  Merge: ff90f84 c99d696
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 11:44:07 2015 +0100

      Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging

      TCG MIPS and S390 fixes for 2.4.

      # gpg: Signature made Mon Aug  3 09:09:59 2015 BST using RSA key ID 1DDD8C9B
      # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
      # gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
      # gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

      * remotes/aurel/tags/pull-tcg-mips-s390-20150803:
        tcg/mips: fix add2
        tcg/s390x: Mask TCGMemOp appropriately for indexing
        tcg/mips: Mask TCGMemOp appropriately for indexing
        tcg/mips: fix TLB loading for BE host with 32-bit guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff90f84e74d7c8641a493585ba9ea8d6e0d19855
  Merge: cb48f67 91ced51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 10:44:23 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: fix ICC mask definition
        macio: re-add TRIM support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c99d69694af4ed15b33e3f7c2e3ef6972c14358d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jul 31 16:38:25 2015 +0200

      tcg/mips: fix add2

      The add2 code in the tcg_out_addsub2 function doesn't take into account
      the case where rl == al == bl. In that case we can't compute the carry
      after the addition. As it corresponds to a multiplication by 2, the
      carry bit is the bit 31.

      While this is a corner case, this prevents x86-64 guests to boot on a
      MIPS host.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 3c8691f568f49bf623dcb2850464d4156d95e61b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 22:13:26 2015 +0200

      tcg/s390x: Mask TCGMemOp appropriately for indexing

      Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
      but two cases were forgotten in the TCG S390 backend.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 4214a8cb7c15ec43d4b2a43ebf248b273a0f4d45
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 22:11:51 2015 +0200

      tcg/mips: Mask TCGMemOp appropriately for indexing

      Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
      but two cases were forgotten in the TCG MIPS backend.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e72c4fb81db52be881c9356f1c60e0a7817d2d32
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 23:39:34 2015 +0200

      tcg/mips: fix TLB loading for BE host with 32-bit guests

      For 32-bit guest, we load a 32-bit address from the TLB, so there is no
      need to compensate for the low or high part. This fixes 32-bit guests on
      big-endian hosts.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91ced514461e1a533bfb9e2eea32bd7df678b1cd
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Jul 21 14:02:01 2015 -0400

      ahci: fix ICC mask definition

      There are likely others that could be updated, but we'll
      go with a light touch for 2.4 for now.

      Without the Unsigned specifier, this shifts bits into the
      signed bit, which makes clang unhappy and could cause
      unwanted behavior.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1437501721-24495-1-git-send-email-jsnow@redhat.com

  commit 0e826a061a3e8e8485488a7da02cc139fc07d620
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jul 29 21:27:48 2015 +0200

      macio: re-add TRIM support

      Commit bd4214fc dropped TRIM support by mistake. Given it is still
      advertised to the host when using a drive with discard=on, this cause
      the IDE bus to hang when the host issues a TRIM command.

      This patch fixes that by re-adding the TRIM code, ported to the new
      new DMA implementation.

      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-id: 1438198068-32428-1-git-send-email-aurelien@aurel32.net
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit cb48f67ad8c7b33c617d4f8144a27706e69fd688
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed Jul 29 11:40:52 2015 -0700

      bsd-user: Fix operand to cpu_x86_exec

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1438195252-21968-1-git-send-email-rth@twiddle.net
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7008d580acad326148a725bd20695882ba10247a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 29 18:50:11 2015 +0100

      Update version for v2.4.0-rc3 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46739a2d7ace71b43cacf73ea71c10429db0d5e8
  Merge: b83d017 ca96ac4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 29 17:08:38 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      These fixes make dataplane work again after the notify_me optimization was
      added.  They also solve QEMUBH memory leaks and fix a bug in dataplane's
      cleanup code.

      # gpg: Signature made Wed Jul 29 14:50:26 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        AioContext: force event loop iteration using BH
        AioContext: avoid leaking BHs on cleanup
        virtio-blk-dataplane: delete bottom half before the AioContext is freed

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca96ac44dcd290566090b2435bc828fded356ad9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jul 28 18:34:09 2015 +0200

      AioContext: force event loop iteration using BH

      The notify_me optimization introduced in commit eabc97797310
      ("AioContext: fix broken ctx->dispatching optimization") skips
      event_notifier_set() calls when the event loop thread is not blocked in
      ppoll(2).

      This optimization causes a deadlock if two aio_context_acquire() calls
      race.  notify_me = 0 during the race so the winning thread can enter
      ppoll(2) unaware that the other thread is waiting its turn to acquire
      the AioContext.

      This patch forces ppoll(2) to return by scheduling a BH instead of
      calling aio_notify().

      The following deadlock with virtio-blk dataplane is fixed:

        qemu ... -object iothread,id=iothread0 \
                 -drive if=none,id=drive0,file=test.img,... \
                 -device virtio-blk-pci,iothread=iothread0,drive=drive0

      This command-line results in a hang early on without this patch.

      Thanks to Paolo Bonzini <pbonzini@redhat.com> for investigating this bug
      with me.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-4-git-send-email-pbonzini@redhat.com
      Message-Id: <1438014819-18125-3-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a076972a4d36381d610a854f0c336507650a1d34
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jul 28 18:34:08 2015 +0200

      AioContext: avoid leaking BHs on cleanup

      BHs are freed during aio_bh_poll().  This leads to memory leaks if there
      is no aio_bh_poll() between qemu_bh_delete() and aio_ctx_finalize().

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-3-git-send-email-pbonzini@redhat.com
      Message-Id: <1438014819-18125-2-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fed105e2756dde98efa5e80baca02ae516dd1e51
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 28 18:34:07 2015 +0200

      virtio-blk-dataplane: delete bottom half before the AioContext is freed

      Other uses of aio_bh_new are safe as long as all scheduled bottom
      halves are run before an iothread is destroyed, which bdrv_drain will
      ensure:

      - archipelago_finish_aiocb: BH deletes itself

      - inject_error: BH deletes itself

      - blkverify_aio_bh: BH deletes itself

      - abort_aio_request: BH deletes itself

      - curl_aio_readv: BH deletes itself

      - gluster_finish_aiocb: BH deletes itself

      - bdrv_aio_rw_vector: BH deletes itself

      - bdrv_co_maybe_schedule_bh: BH deletes itself

      - iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself

      - laio_attach_aio_context: deleted in laio_detach_aio_context,
      called through bdrv_detach_aio_context before deleting the iothread

      - nfs_co_generic_cb: BH deletes itself

      - null_aio_common: BH deletes itself

      - qed_aio_complete: BH deletes itself

      - rbd_finish_aiocb: BH deletes itself

      - dma_blk_cb: BH deletes itself

      - virtio_blk_dma_restart_cb: BH deletes itself

      - qemu_bh_new: main loop AioContext is never destroyed

      - test-aio.c: bh_delete_cb deletes itself, otherwise deleted in
      the same function that calls aio_bh_new

      Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-2-git-send-email-pbonzini@redhat.com
      Message-Id: <1438086628-13000-1-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b83d017d88b2c4710c7a4614ecf9f845e4db80ba
  Merge: 170f209 7bba83b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 19:02:04 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      Pull request

      These two .can_receive() are now reviewed.  The net subsystem queue for 2.4 is now empty.

      # gpg: Signature made Tue Jul 28 13:26:03 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        xen: Drop net_rx_ok
        hw/net: handle flow control in mcf_fec driver receiver

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 170f209d7848dc2f14b3f3dccc34a49558680d4d
  Merge: 8b89b3a c147b51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 17:09:56 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio fixes for 2.4

      Mostly virtio 1 spec compliance fixes.
      We are unlikely to make it perfectly compliant in
      the first release, but it seems worth it to try.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio: minor cleanup
        acpi: fix pvpanic device is not shown in ui
        virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device
        virtio-blk: fail get_features when both scsi and 1.0 were set
        virtio: get_features() can fail
        virtio-pci: fix memory MR cleanup for modern
        virtio: set any_layout in virtio core
        virtio-9p: fix any_layout
        virtio-serial: fix ANY_LAYOUT
        virtio: hide legacy features from modern guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8b89b3a8df0a7d1ddbc9744f66a495986af667ca
  Merge: 5e868d2 52579c6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 15:25:24 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into staging

      MIPS patches 2015-07-28

      Changes:
      * net/dp8393x fixes
      * Vectored Interrupts bug fix
      * fix for a bug in machine.c which was provoking a warning on FreeBSD

      # gpg: Signature made Tue Jul 28 10:47:19 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150728:
        net/dp8393x: do not use memory_region_init_rom_device with NULL
        net/dp8393x: remove check of runt packets
        net/dp8393x: disable user creation
        target-mips: fix offset calculation for Interrupts
        target-mips: fix passing incompatible pointer type in machine.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e868d2e5e4aff76bdef787e44bc2d1eca18901f
  Merge: 9f8c5b6 52c91da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 14:19:16 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * crypto fixes
      * megasas SIGSEGV fix
      * memory refcount change to fix virtio hot-unplug

      # gpg: Signature made Tue Jul 28 08:29:07 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        memory: do not add a reference to the owner of aliased regions
        megasas: Add write function to handle write access to PCI BAR 3
        crypto: extend unit tests to cover decryption too
        crypto: fix built-in AES decrypt function

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f8c5b69c2b9ca8b9c3e569b0f41bd60a0b9e9fe
  Merge: 776f878 325e390
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 13:22:57 2015 +0100

      Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

      # gpg: Signature made Tue Jul 28 05:22:29 2015 BST using RSA key ID C0DE3057
      # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
      # gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
      # gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

      * remotes/cody/tags/jtc-for-upstream-pull-request:
        block/ssh: Avoid segfault if inet_connect doesn't set errno.
        sheepdog: serialize requests to overwrapping area

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7bba83bf80eae9c9e323319ff40d0ca477b0a77a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jul 28 17:52:56 2015 +0800

      xen: Drop net_rx_ok

      Let net_rx_packet() (which checks the same conditions) drops the packet
      if the device is not ready. Drop net_xen_info.can_receive and update the
      return value for the buffer full case.

      We rely on the qemu_flush_queued_packets() in net_event() to wake up
      the peer when the buffer becomes available again.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1438077176-378-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 776f87845137a9b300a4815ba6bf6879310795aa
  Merge: 84a29c7 226d007
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 11:28:44 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into staging

      trivial patches for 2015-07-27

      # gpg: Signature made Mon Jul 27 20:50:14 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-07-27:
        gdbstub: Set current CPU on interruptions
        qapi: add missing @
        Fix Cortex-A9 global timer
        gitignore: Ignore shader generated files
        vmstate: remove unused declaration
        make: Clean build messages
        qemu-common.h: Document cutils.c string functions
        device_tree: Fix a typo
        hw/acpi/ich9: clean up stale comment about KVM not supporting SMM
        hw/acpi/ich9: clear smi_en on reset

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff1d2ac949dc94d8a0e71fd46939fb69c2ef075b
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Tue Jul 28 11:02:54 2015 +1000

      hw/net: handle flow control in mcf_fec driver receiver

      The network mcf_fec driver emulated receive side method is not dealing
      with network queue flow control properly.

      Modify the receive side to check if we have enough space in the
      descriptors to store the current packet. If not we process none of it
      and return 0. When the guest frees up some buffers through its descriptors
      we signal the qemu net layer to send more packets.

      [Fixed coding style: 4-space indent and curly braces on if statement.
      --Stefan]

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Message-id: 1438045374-10358-1-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 52579c681cb12bf64de793e85edc50d990f4d42f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Jul 26 22:32:55 2015 +0200

      net/dp8393x: do not use memory_region_init_rom_device with NULL

      Replace memory_region_init_rom_device() with memory_region_init_ram() and
      memory_region_set_readonly().
      This fixes a guest-triggerable QEMU crash when guest tries to write to PROM.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      [leon.alrae@imgtec.com: shorten subject length]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 30dfa9a46cd845db3f43f5c11b129f4a50941b02
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Fri Jul 24 20:42:23 2015 +0200

      net/dp8393x: remove check of runt packets

      Ethernet requires that messages are at least 64 bytes on the wire. This
      limitation does not exist on emulation (no wire message), so remove the
      check. Netcard is now able to receive small network packets.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f6351288b65130deb8102b17143f5d84f817a02a
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Fri Jul 24 20:42:21 2015 +0200

      net/dp8393x: disable user creation

      Netcard needs an address space to write data to, which can't be specified
      on command line.
      This fixes a crash when user starts QEMU with "-device dp8393x"

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 84a29c7efd02baa97b0d60d1e59e8357f7a5e0f1
  Merge: f8787f8 77c102c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 09:11:48 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc3

      # gpg: Signature made Mon Jul 27 16:19:17 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block: qemu-iotests - add check for multiplication overflow in vpc
        block: vpc - prevent overflow if max_table_entries >= 0x40000000

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da52a4dfcc4864fd2260ec4eab331f75b1f0240b
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Fri Jul 10 12:10:02 2015 +0100

      target-mips: fix offset calculation for Interrupts

      Correct computation of vector offsets for EXCP_EXT_INTERRUPT.
      For instance, if Cause.IV is 0 the vector offset should be 0x180.

      Simplify the finding vector number logic for the Vectored Interrupts.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      [leon.alrae@imgtec.com: cosmetic changes]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8bcbb834a015432bfb4d09a883c21f017eadd978
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Jul 22 14:59:23 2015 +0100

      target-mips: fix passing incompatible pointer type in machine.c

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 325e3904210c779a13fbbc9ee156056d045d7eee
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 22 14:27:47 2015 +0100

      block/ssh: Avoid segfault if inet_connect doesn't set errno.

      On some (but not all) systems:

        $ qemu-img create -f qcow2 overlay -b ssh://xen/
        Segmentation fault

      It turns out this happens when inet_connect returns -1 in the
      following code, but errno == 0.

        s->sock = inet_connect(s->hostport, errp);
        if (s->sock < 0) {
            ret = -errno;
            goto err;
        }

      In the test case above, no host called "xen" exists, so getaddrinfo fails.

      On Fedora 22, getaddrinfo happens to set errno = ENOENT (although it
      is *not* documented to do that), so it doesn't segfault.

      On RHEL 7, errno is not set by the failing getaddrinfo, so ret =
      -errno = 0, so the caller doesn't know there was an error and
      continues with a half-initialized BDRVSSHState struct, and everything
      goes south from there, eventually resulting in a segfault.

      Fix this by setting ret to -EIO (same as block/nbd.c and
      block/sheepdog.c).  The real error is saved in the Error** errp
      struct, so it is printed correctly:

        $ ./qemu-img create -f qcow2 overlay -b ssh://xen/
        qemu-img: overlay: address resolution failed for xen:22: No address associated with hostname

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reported-by: Jun Li
      BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1147343
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 6a55c82cece217ab99ed95a412fa7ddf5d5f257b
  Author: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
  Date:   Sat Jul 18 01:44:24 2015 +0900

      sheepdog: serialize requests to overwrapping area

      Current sheepdog driver only serializes create requests in oid
      unit. This mechanism isn't enough for handling requests to
      overwrapping area spanning multiple oids, so it can result bugs like
      below:
      https://bugs.launchpad.net/sheepdog-project/+bug/1456421

      This patch adds a new serialization mechanism for the problem. The
      difference from the old one is:
      1. serialize entire aiocb if their targetting areas overwrap
      2. serialize all requests (read, write, and discard), not only creates

      This patch also removes the old mechanism because the new one can be
      an alternative.

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
      Cc: Vasiliy Tolstov <v.tolstov@selfip.ru>
      Signed-off-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
      Tested-by: Vasiliy Tolstov <v.tolstov@selfip.ru>
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 52c91dac6bd891656f297dab76da51fc8bc61309
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 27 16:29:56 2015 +0200

      memory: do not add a reference to the owner of aliased regions

      Very often the owner of the aliased region is the same as the owner of the alias
      region itself.  When this happens, the reference count can never go back to 0 and
      the owner is leaked.  This is for example breaking hot-unplug of virtio-pci
      devices (the device cannot be plugged back again with the same id).

      Another common use for alias is to transform the system I/O address space
      into an MMIO regions; in this case the aliased region never dies, so there
      is no problem.  Otherwise the owner is always the same for aliasing
      and aliased region.

      I checked all calls to memory_region_init_alias introduced after commit
      dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the
      reference in order to keep the owner of the aliased region alive.

      Reported-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 55875fc4ca45a35e36134663ade946d86fe7bfcd
  Author: Salva Peiró <speirofr@gmail.com>
  Date:   Mon Jul 27 10:51:52 2015 +0200

      megasas: Add write function to handle write access to PCI BAR 3

      This patch fixes a QEMU SEGFAULT when a write operation is performed on
      the memory region of the PCI BAR 3 (base address space).
      When a writeb(0xe0000000) is performed the .write function is invoked to
      handle the write access, however, since the .write is not initialised,
      the call to 0, causes QEMU to SEGFAULT.

      Signed-off-by: Salva Peiró <speirofr@gmail.com>
      Acked-by: Hannes Reinecke <hare@suse.com>
      Message-Id: <1437987112-24744-1-git-send-email-speirofr@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c147b5153e733a14fc65d2098e7036754c185ad1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 27 18:39:37 2015 +0300

      virtio: minor cleanup

      There's no need for blk to set ANY_LAYOUT, it's
      done by virtio core as necessary.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ef3ea253b5aaaa00f3b9999f3ff19e74cfa26f8
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Sun Jul 26 11:00:51 2015 +0300

      acpi: fix pvpanic device is not shown in ui

      Commit 2332333c added a _STA method that hides the device. The fact
      that the device is not shown in the gui make it harder to install its
      Windows' device.

      https://bugzilla.redhat.com/show_bug.cgi?id=1238141

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 226d007dbd75ec8d0f12d0f9e1ce66caf55d49e4
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Fri Jul 24 18:52:31 2015 +0200

      gdbstub: Set current CPU on interruptions

      gdb expects that the thread ID for c and g-class operations is set to
      the CPU we provide when reporting VM stop conditions. If the stub is
      still tuned to a different CPU, the wrong information is delivered to
      the gdb frontend.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 801db5ecdac7575a1b0250243eea1767da553e50
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Fri Jul 3 11:51:01 2015 +0200

      qapi: add missing @

      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 786f9ce20382704249883d7052f6869011d44281
  Author: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
  Date:   Mon Jun 29 17:45:41 2015 +0200

      Fix Cortex-A9 global timer

      The auto increment bit of the timer control register was wrongly
      defined.

      See Cortex-A9 MPcore Technical Reference Manual, Section 4.4.2.

      Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e71e111e0544ec35af40c3dc29f21697c8f17bf
  Author: Michal Privoznik <mprivozn@redhat.com>
  Date:   Tue Jun 23 14:30:20 2015 +0200

      gitignore: Ignore shader generated files

      As of d98bc0b65 there are two files that are automatically generated:
      ui/shader/texture-blit-frag.h and /ui/shader/texture-blit-vert.h. None
      of them is wanted to be tracked by git. Put them into the ignore file
      then.

      Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7155f2ca9d66f5598fd8d071e71d6758019a6e48
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Jun 23 18:41:27 2015 +0200

      vmstate: remove unused declaration

      Since 38e0735e, register_device_unmigratable() has been removed

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f6288b9c88bae7d76d8bfe17e672976d79079296
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jul 18 16:54:32 2015 +0200

      make: Clean build messages

      We want to have uniform build messages, so fix some messages
      which did not follow the standard pattern.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ab6036630865eff8bb12dd51dfa6921b4607fc81
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 19 21:34:22 2015 +0100

      qemu-common.h: Document cutils.c string functions

      Add documentation comments for various utility string functions
      which we have implemented in util/cutils.c:
       pstrcpy()
       strpadcpy()
       pstrcat()
       strstart()
       stristart()
       qemu_strnlen()
       qemu_strsep()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit cc47a16bcbbc2d1f79511799ca3625c6522f5838
  Author: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
  Date:   Fri Jul 24 13:48:13 2015 +0530

      device_tree: Fix a typo

      Fix spelling of 'allocting' -> 'allocating'.

      Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f3c30aeaa7888aee96a1fa28f259fb8312d47ab2
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jul 24 20:16:01 2015 +0200

      hw/acpi/ich9: clean up stale comment about KVM not supporting SMM

      Commit fba72476c6 ("ich9: add smm_enabled field and arguments") detached
      SMM availability from kvm_enabled(). However, the comment in pm_reset()
      was not updated; let's do it now.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-trivial@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit be66680e8320d612f1c96096a217e642e458f47b
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jul 24 20:16:00 2015 +0200

      hw/acpi/ich9: clear smi_en on reset

      Otherwise on reboot firmware might think (due to APMC_EN remaining set
      from the previous boot) that SMI support is absent.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-trivial@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f8787f8723eaca1be99e3b1873e54de163fffa93
  Merge: edec47c bbeb823
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 19:37:09 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150727' into staging

      Fix buglets for 2.4

      # gpg: Signature made Mon Jul 27 15:26:48 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150727:
        tcg: mark temps as mem_coherent = 0 for mov with a constant
        tcg: correctly mark dead inputs for mov with a constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit edec47cfef96209987cb7922286cb384916aae02
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jul 24 13:42:55 2015 +0200

      main-loop: fix qemu_notify_event for aio_notify optimization

      aio_notify can be optimized away, and in fact almost always will.  However,
      qemu_notify_event is used in places where this is incorrect---most notably,
      when handling SIGTERM.  When aio_notify is optimized away, it is possible that
      QEMU enters a blocking ppoll immediately afterwards and stays there, without
      reaching main_loop_should_exit().

      Fix this by using a bottom half.  The bottom half can be optimized too, but
      scheduling it is enough for the ppoll not to block.  The hang is thus avoided.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1437738175-23624-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 77c102c26ead946fe7589d4bddcdfa5cb431ebfe
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Jul 24 10:26:52 2015 -0400

      block: qemu-iotests - add check for multiplication overflow in vpc

      This checks that VPC is able to successfully fail (without segfault)
      on an image file with a max_table_entries that exceeds 0x40000000.

      This table entry is within the valid range for VPC (although too large
      for this sample image).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b15deac79530d818092cb49a8021bcce83d71b5b
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Jul 24 10:26:51 2015 -0400

      block: vpc - prevent overflow if max_table_entries >= 0x40000000

      When we allocate the pagetable based on max_table_entries, we multiply
      the max table entry value by 4 to accomodate a table of 32-bit integers.
      However, max_table_entries is a uint32_t, and the VPC driver accepts
      ranges for that entry over 0x40000000.  So during this allocation:

      s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);

      The size arg overflows, allocating significantly less memory than
      expected.

      Since qemu_try_blockalign() size argument is size_t, cast the
      multiplication correctly to prevent overflow.

      The value of "max_table_entries * 4" is used elsewhere in the code as
      well, so store the correct value for use in all those cases.

      We also check the Max Tables Entries value, to make sure that it is <
      SIZE_MAX / 4, so we know the pagetable size will fit in size_t.

      Cc: qemu-stable@nongnu.org
      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3737129917c918767cdb8acd8ca6b342c45fa154
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 18:28:08 2015 +0100

      configure: Work around broken static pkg-config info for Ubuntu gnutls

      Unfortunately Ubuntu's pkg-config information for gnutls is broken
      for the static linking case, and outputs --libs options which the
      compiler does not recognize. Work around this problem by testing
      that the --cflags/--libs output will at least allow compilation
      before enabling gnutls support.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Message-id: 1437758888-22486-1-git-send-email-peter.maydell@linaro.org

  commit c9b11f971cfa1fd3eed716f62f4b835553b75490
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:21 2015 +0800

      virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device

      Chapter 6.3 of spec said

      "
      Transitional devices MUST offer, and if offered by the device
      transitional drivers MUST accept the following:

      VIRTIO_F_ANY_LAYOUT (27)
      "

      So this patch only clear VIRTIO_F_LAYOUT for legacy device.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit efb8206ca7f19f5a6ece1f2851a73a29de309b1e
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:20 2015 +0800

      virtio-blk: fail get_features when both scsi and 1.0 were set

      SCSI passthrough was no longer supported in virtio 1.0, so this patch
      fail the get_features() when both 1.0 and scsi is set. And also only
      advertise VIRTIO_BLK_F_SCSI for legacy virtio-blk device.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d5b731dd2d64deb3bc798ef4e3c08603d54ae02
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:19 2015 +0800

      virtio: get_features() can fail

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 27462695cde2a2208b1ff8074c2e917b8203590b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 27 11:06:17 2015 +0300

      virtio-pci: fix memory MR cleanup for modern

      Each memory_region_add_subregion must be paired with
      memory_region_del_subregion.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bbeb82395eaca0e3c38b433b2d2a5bad4a5fbd81
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jul 27 12:55:58 2015 +0200

      tcg: mark temps as mem_coherent = 0 for mov with a constant

      When a constant has to be loaded in a mov op, we fail to set
      mem_coherent = 0. This patch fixes that.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1437994568-7825-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7df69deadf2f25c19b3ac121404ee31f71dce845
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jul 27 12:55:57 2015 +0200

      tcg: correctly mark dead inputs for mov with a constant

      When tcg_reg_alloc_mov propagate a constant, we failed to correctly mark
      a temp as dead if the liveness analysis hints so. This fixes the
      following assert when configure with --enable-debug-tcg:

        qemu-x86_64: tcg/tcg.c:1827: tcg_reg_alloc_bb_end: Assertion `ts->val_type == TEMP_VAL_DEAD' failed.

      Cc: Richard Henderson <rth@twiddle.net>
      Reported-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1437994568-7825-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 122e7dab8ac549c8c5a9e1e13aa2464190e888de
  Merge: e40db4c f9f7492
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 14:53:42 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      Pull request

      Here are NIC fixes from Fam Zheng that prevent rx hangs (caused by NIC models
      where .can_receive() stops rx but qemu_flush_queued_packets() isn't called).

      # gpg: Signature made Mon Jul 27 14:51:48 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        axienet: Flush queued packets when rx is done
        dp8393x: Flush packets when link comes up
        stellaris_enet: Flush queued packets when read done
        mipsnet: Flush queued packets when receiving is enabled
        milkymist-minimac2: Flush queued packets when link comes up
        mcf_fec: Drop mcf_fec_can_receive
        etsec: Flush queue when rx buffer is consumed
        etsec: Move etsec_can_receive into etsec_receive
        usbnet: Drop usbnet_can_receive
        eepro100: Drop nic_can_receive
        pcnet: Drop pcnet_can_receive
        xgmac: Drop packets with eth_can_rx is false.
        hw/net: fix mcf_fec driver receiver
        hw/net: add simple phy support to mcf_fec driver
        hw/net: add ANLPAR bit definitions to generic mii
        hw/net: create common collection of MII definitions

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9f7492ea4a9dda538fedeec31399fb940533a16
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:13 2015 +0800

      axienet: Flush queued packets when rx is done

      eth_can_rx checks s->rxsize and returns false if it is non-zero. Because
      of the .can_receive semantics change, this will make the incoming queue
      disabled by peer, until it is explicitly flushed. So we should flush it
      when s->rxsize is becoming zero.

      Squash eth_can_rx semantics into etx_rx and drop .can_receive()
      callback, also add flush when rx buffer becomes available again after a
      packet gets queued.

      The other conditions, "!axienet_rx_resetting(s) &&
      axienet_rx_enabled(s)" are OK because enet_write already calls
      qemu_flush_queued_packets when the register bits are changed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-13-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4594f93a732f1f5936c3a5225481586e24bffa9e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:12 2015 +0800

      dp8393x: Flush packets when link comes up

      .can_receive callback changes semantics that once return 0, backend will
      try sending again until explicitly flushed, change the device to meet
      that.

      dp8393x_can_receive checks SONIC_CR_RXEN bit in SONIC_CR register and
      SONIC_ISR_RBE bit in SONIC_ISR register, try flushing the queue when
      either bit is being updated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-12-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ef4a6069f8b4c09c3383cd4b8e27b6ff25b2d41
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:11 2015 +0800

      stellaris_enet: Flush queued packets when read done

      If s->np reaches 31, the queue will be disabled by peer when it sees
      stellaris_enet_can_receive() returns false, until we explicitly flushes
      it which notifies the peer. Do this when guest is done reading all
      existing data.

      Move the semantics to stellaris_enet_receive, by returning 0 when the
      buffer is full, so that new packets will be queued.  In
      stellaris_enet_read, flush and restart the queue when guest has done
      reading.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-11-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1dd58ae0583c3d3fb15fa1d563d6b497558d3ad0
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:10 2015 +0800

      mipsnet: Flush queued packets when receiving is enabled

      Drop .can_receive and move the semantics to mipsnet_receive, by
      returning 0.

      After 0 is returned, we must flush the queue explicitly to restart it:
      Call qemu_flush_queued_packets when s->busy or s->rx_count is being
      updated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-10-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3b7031e9609baf710823aa7880fd9802b39c4563
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:09 2015 +0800

      milkymist-minimac2: Flush queued packets when link comes up

      Drop .can_receive and move the semantics into minimac2_rx, by returning
      0.

      That is once minimac2_rx returns 0, incoming packets will be queued
      until the queue is explicitly flushed. We do this when s->regs[R_STATE0]
      or s->regs[R_STATE1] is changed in minimac2_write.

      Also drop the unused trace point.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-9-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e813f0d8813944061fa9bde861cf6899379843e6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:08 2015 +0800

      mcf_fec: Drop mcf_fec_can_receive

      The semantics of .can_receive requires us to flush the queue explicitly
      when s->rx_enabled becomes true after it returns 0, but the packet being
      queued is not meaningful since the guest hasn't activated the card.
      Let's just drop the packet in this case.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-8-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 575bafd1f387c5f06b59cf2515f6bb1eff9d119d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:07 2015 +0800

      etsec: Flush queue when rx buffer is consumed

      The BH will be scheduled when etsec->rx_buffer_len is becoming 0, which
      is the condition of queuing.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-7-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b6cb6610c27c5b0773a340499f19c3477bf45aeb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:06 2015 +0800

      etsec: Move etsec_can_receive into etsec_receive

      When etsec_reset returns 0, peer would queue the packet as if
      .can_receive returns false. Drop etsec_can_receive and let etsec_receive
      carry the semantics.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 913440249ea2e697177e9d43167ac325a8dfe907
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:05 2015 +0800

      usbnet: Drop usbnet_can_receive

      usbnet_receive already drops packet if rndis_state is not
      RNDIS_DATA_INITIALIZED, and queues packet if in buffer is not available.
      The only difference is s->dev.config but that is similar to rndis_state.

      Drop usbnet_can_receive and move these checks to usbnet_receive, so that
      we don't need to explicitly flush the queue when s->dev.config changes
      value.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 363db4b249244f31d3c47fbd5a8b128c95ba8fe7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:04 2015 +0800

      eepro100: Drop nic_can_receive

      nic_receive already checks the conditions and drop packets if false.
      Due to the new semantics since 6e99c63 ("net/socket: Drop
      net_socket_can_send"), having .can_receive returning 0 requires us to
      explicitly flush the queued packets when the conditions are becoming
      true, but queuing the packets when guest driver is not ready doesn't
      make much sense.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0ba0b9b6b402d738f11f27eea6c94d97bf84cbf
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:03 2015 +0800

      pcnet: Drop pcnet_can_receive

      pcnet_receive already checks the conditions and drop packets if false.
      Due to the new semantics since 6e99c63 ("net/socket: Drop
      net_socket_can_send"), having .can_receive returning 0 requires us to
      explicitly flush the queued packets when the conditions are becoming
      true, but queuing the packets when guest driver is not ready doesn't
      make much sense.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8c8c460c5f38f878675631a66286a6e87bb4d111
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:02 2015 +0800

      xgmac: Drop packets with eth_can_rx is false.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 491a1f494ed4c0d1a8593dd04b645f8e63c4cfae
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:16 2015 +1000

      hw/net: fix mcf_fec driver receiver

      The network mcf_fec driver emulated receive side method is returning a
      result of 0 causing the network layer to disable receive for this emulated
      device. This results in the guest only ever receiving one packet.

      Fix the recieve side processing to return the number of bytes that we
      passed back through to the guest.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-5-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 299f7bec5a109db7563e1286cedf1f4d84e69e6d
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:15 2015 +1000

      hw/net: add simple phy support to mcf_fec driver

      The Linux fec driver needs at least basic phy support to probe and work.
      The current qemu mcf_fec emulation has no support for the reading or
      writing of the MDIO lines to access an attached phy.

      This code adds a very simple set of register results for a fixed phy
      setup - very similar to that used on an m5208evb board. This is enough
      to probe and identify an emulated attached phy.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-4-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3634869b27b6b2ff538bcc5bf8dfd1235ede7034
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:14 2015 +1000

      hw/net: add ANLPAR bit definitions to generic mii

      Add a base set of bit definitions for the standard MII phy "Auto-Negotiation
      Link Partner Ability Register" (ANLPAR).

      The original definitions moved into mii.h from the allwinner_emac driver
      did not define these.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-3-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3e230569bf16aa36562967cd76b742c6824481b1
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:13 2015 +1000

      hw/net: create common collection of MII definitions

      Create a common set of definitions of address and register values for
      ethernet MII phys. A few of the current ethernet drivers have at least
      a partial set of these definitions. Others just use hard coded raw
      constant numbers.

      This initial set is copied directly from the allwinner_emac code.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-2-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e40db4c6d391419c0039fe274c74df32a6ca1a28
  Merge: f793d97 cb72cba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 13:10:00 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/cve-2015-5154-pull-request' into staging

      # gpg: Signature made Mon Jul 27 13:01:10 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/cve-2015-5154-pull-request:
        ide: Clear DRQ after handling all expected accesses
        ide/atapi: Fix START STOP UNIT command completion
        ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 019c2ab8623daee210df8b1085a33b1e83c9ee11
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Jul 21 09:55:02 2015 +0100

      crypto: extend unit tests to cover decryption too

      The current unit test only verifies the encryption API,
      resulting in us missing a recently introduced bug in the
      decryption API from commit d3462e3. It was fortunately
      later discovered & fixed by commit bd09594, thanks to the
      QEMU I/O tests for qcow2 encryption, but we should really
      detect this directly in the crypto unit tests. Also remove
      an accidental debug message and simplify some asserts.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1437468902-23230-1-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6775e2c4298618828de9bb3c5584d4de20120e46
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Fri Jul 24 13:23:54 2015 +0100

      crypto: fix built-in AES decrypt function

      The qcrypto_cipher_decrypt_aes method was using the wrong
      key material, and passing the wrong mode. This caused it
      to incorrectly decrypt ciphertext.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1437740634-6261-1-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 09999a5f7fc8e3636feda4358a79a25a09467594
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 22 12:32:25 2015 +0300

      virtio: set any_layout in virtio core

      Exceptions:
          - virtio-blk
          - compat machine types

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cd4bfbb20d957a480032e2626ef1188b62c74d00
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 23 20:57:53 2015 +0300

      virtio-9p: fix any_layout

      virtio pci allows any device to have a modern interface,
      this in turn requires ANY_LAYOUT support.
      Fix up ANY_LAYOUT for virtio-9p.

      Reported-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 7882080388be5088e72c425b02223c02e6cb4295
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 23 17:52:02 2015 +0300

      virtio-serial: fix ANY_LAYOUT

      Don't assume a specific layout for control messages.
      Required by virtio 1.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 5f456073aa9ba54e421aa82dd38e4d40d0a0af85
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 22 13:09:25 2015 +0300

      virtio: hide legacy features from modern guests

      NOTIFY_ON_EMPTY, ANY_LAYOUT and BAD are only valid on the legacy
      interface.

      Hide them from modern guests.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cb72cba83021fa42719e73a5249c12096a4d1cfc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide: Clear DRQ after handling all expected accesses

      This is additional hardening against an end_transfer_func that fails to
      clear the DRQ status bit. The bit must be unset as soon as the PIO
      transfer has completed, so it's better to do this in a central place
      instead of duplicating the code in all commands (and forgetting it in
      some).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit 03441c3a4a42beb25460dd11592539030337d0f8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide/atapi: Fix START STOP UNIT command completion

      The command must be completed on all code paths. START STOP UNIT with
      pwrcnd set should succeed without doing anything.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit d2ff85854512574e7209f295e87b0835d5b032c6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

      If the end_transfer_func of a command is called because enough data has
      been read or written for the current PIO transfer, and it fails to
      correctly call the command completion functions, the DRQ bit in the
      status register and s->end_transfer_func may remain set. This allows the
      guest to access further bytes in s->io_buffer beyond s->data_end, and
      eventually overflowing the io_buffer.

      One case where this currently happens is emulation of the ATAPI command
      START STOP UNIT.

      This patch fixes the problem by adding explicit array bounds checks
      before accessing the buffer instead of relying on end_transfer_func to
      function correctly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit f793d97e454a56d17e404004867985622ca1a63b
  Merge: 30fdfae 178846b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 13:07:10 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * qemu-char fixes
      * SCSI fixes (including CVE-2015-5158)
      * RCU fixes
      * Framebuffer logic to set DIRTY_MEMORY_VGA
      * Fix compiler warning for --disable-vnc
      * qemu-doc fixes
      * x86 TCG pasto fix

      # gpg: Signature made Fri Jul 24 12:57:52 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        target-i386/FPU: a misprint in helper_fistll_ST0
        qemu-doc: fix typos
        framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer
        memory: count number of active VGA logging clients
        vl: Fix compiler warning for builds without VNC
        scsi: Handle no media case for scsi_get_configuration
        rcu: actually register threads that have RCU read-side critical sections
        scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)
        vnc: fix memory leak
        qemu-char: Fix missed data on unix socket
        qemu-char: handle EINTR for TCP character devices
        exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 178846bdd93994c1acafe4423f99ead8bb24cf38
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Wed Jul 8 12:48:40 2015 +0300

      target-i386/FPU: a misprint in helper_fistll_ST0

      There is a cut-and-paste mistake in the patch
      https://lists.gnu.org/archive/html/qemu-devel/2014-11/msg01657.html .
      It cause errors in guest work.  Here is the bugfix.

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Reported-by: Kirill Batuzov <batuzovk@ispras.ru>
      Message-Id: <2692911436348920@web2m.yandex.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d274e07c6df4cc8207b01892ff6f81118ea6083c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 3 17:50:57 2015 +0800

      qemu-doc: fix typos

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1435917057-9396-1-git-send-email-arei.gonglei@huawei.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c1076c3e13a86140cc2ba29866512df8460cc7c2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 13 12:00:29 2015 +0200

      framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer

      The MemoryRegionSection contains enough information to access the
      RAM region underlying the framebuffer, and can be cached inside the
      display device.

      By doing this, the new framebuffer_update_memory_section function can
      enable dirty memory logging on the relevant RAM region.  The function
      must be called whenever the stride or base of the framebuffer changes;
      a simple way to cover these cases is to call it on every full frame
      invalidation, which is a rare case.

      framebuffer_update_display now works entirely on a MemoryRegionSection,
      without going through cpu_physical_memory_map/unmap.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit deb809edb85334c8e90530e1071b98f4da25ebaa
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 13:56:53 2015 +0200

      memory: count number of active VGA logging clients

      For a board that has multiple framebuffer devices, both of them
      might want to use DIRTY_MEMORY_VGA on the same memory region.
      The lack of reference counting in memory_region_set_log makes
      this very awkward to implement.

      Suggested-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb4309695905de889d318caec8eb13d3b2c118d5
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Jul 22 19:53:30 2015 +0200

      vl: Fix compiler warning for builds without VNC

      This regression was caused by commit 70b94331.

        CC    vl.o
      vl.c: In function ‘select_display’:
      vl.c:2064:12: error: unused variable ‘err’ [-Werror=unused-variable]
           Error *err = NULL;
                  ^

      Reported-by: Claudio Fontana <claudio.fontana@huawei.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1437587610-26433-1-git-send-email-sw@weilnetz.de>
      Reviewed-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7d99f4c1b5d12de7644a5bd8c3d46bff05c9ca7c
  Author: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
  Date:   Wed Jul 15 14:52:32 2015 -0400

      scsi: Handle no media case for scsi_get_configuration

      Currently, scsi_get_configuration always returns a current
      profile (DVD or CD), even when there is actually no media present.
      By comparison, ide/atapi uses a default profile of 0 (MMC_PROFILE_NONE)
      for this case and checks for tray_open, so let's do the same for scsi.

      This fixes a problem I'm seeing with Fedora 22 guests where systemd
      cdrom_id fails to unmount after a QEMU-initiated eject against a
      scsi cdrom device because it believes the media is still present
      (but unreadable).

      Signed-off-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Message-Id: <1436986352-10695-1-git-send-email-mjrosato@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ab28bd23125fb4a0411c3a3f01c4edacbc261486
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 08:55:38 2015 +0200

      rcu: actually register threads that have RCU read-side critical sections

      Otherwise, grace periods are detected too early!

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c170aad8b057223b1139d72e5ce7acceafab4fa9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 08:59:39 2015 +0200

      scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)

      This is a guest-triggerable buffer overflow present in QEMU 2.2.0
      and newer.  scsi_cdb_length returns -1 as an error value, but the
      caller does not check it.

      Luckily, the massive overflow means that QEMU will just SIGSEGV,
      making the impact much smaller.

      Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com>
      Fixes: 1894df02811f6b79ea3ffbf1084599d96f316173
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 60928458e5eea3c77a7eb0a4194927872f463947
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Jul 22 17:08:53 2015 +0800

      vnc: fix memory leak

      If vnc's password is configured, it will leak memory
      which cipher variable pointed on every vnc connection.

      Cc: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1437556133-11268-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 30fdfae49d53cfc678859095e49ac60b79562d6f
  Merge: f75b709 9615212
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 11:11:30 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150723' into staging

      Last minute fixes for 2.4.

      # gpg: Signature made Fri Jul 24 04:42:31 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150723:
        tcg/optimize: fix tcg_opt_gen_movi
        tcg/aarch64: use 32-bit offset for 32-bit softmmu emulation
        tcg/aarch64: use 32-bit offset for 32-bit user-mode emulation
        tcg/aarch64: add ext argument to tcg_out_insn_3310
        tcg/i386: Extend addresses for 32-bit guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f75b709853d2b2b0f2a8e149229aa1c7c1ee1c60
  Merge: 12e21eb 759b484
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 09:17:44 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-fixes-20150723.0' into staging

      VFIO fixes for v2.4.0-rc3
      - Fix Realtek NIC quirk (Alex Williamson)
      - Restore bootindex functionality (Alex Williamson)

      # gpg: Signature made Thu Jul 23 19:51:23 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-fixes-20150723.0:
        vfio/pci: Fix bootindex
        vfio/pci: Fix RTL8168 NIC quirks

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 961521261a3d600b0695b2e6d2b0f490076f7e90
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jul 10 18:03:30 2015 +0200

      tcg/optimize: fix tcg_opt_gen_movi

      Due to a copy&paste, the new op value is tested against mov_i32 instead
      of movi_i32. The test is therefore always false. Fix that.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1436544211-2769-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 80adb8fcad4778376a11d394a9e01516819e2327
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 23 18:04:52 2015 -0400

      tcg/aarch64: use 32-bit offset for 32-bit softmmu emulation

      Similar to the same fix for user-mode, except this instance
      occurs on the softmmu path.  Again, the tlb addend must be
      the base register, while the guest address is the index.

      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ffc6372851d8631a9f9fa56ec613b3244dc635b9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jul 15 17:27:01 2015 +0200

      tcg/aarch64: use 32-bit offset for 32-bit user-mode emulation

      Thanks to the previous patch, it is now easy for tcg_out_qemu_ld and
      tcg_out_qemu_st to use a 32-bit zero extended offset.  However, the
      guest base register x28 must be the base and addr_reg must be the
      index.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1436974021-28978-3-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 6c0f0c0f124718650a8d682ba275044fc02f6fe2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jul 15 17:27:00 2015 +0200

      tcg/aarch64: add ext argument to tcg_out_insn_3310

      The new argument lets you pick uxtw or uxtx mode for the offset
      register.  For now, all callers pass TCG_TYPE_I64 so that uxtx
      is generated.  The bits for uxtx are removed from I3312_TO_I3310.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1436974021-28978-2-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ee8ba9e4d8458b8bba5455a7ae704620c4f2ef4b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 16 22:25:49 2015 +0100

      tcg/i386: Extend addresses for 32-bit guests

      Removing the ??? comment explaining why it (mostly) worked.

      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Message-Id: <1437081950-7206-2-git-send-email-rth@twiddle.net>

  commit 12e21eb088a51161c78ee39ed54ac56ebcff4243
  Merge: b69b305 6b26996
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 23 12:54:53 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-22

      # gpg: Signature made Wed Jul 22 19:11:04 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4bf1cb03fbc43b0055af60d4ff093d6894aa4338
  Author: Nils Carlson <pyssling@ludd.ltu.se>
  Date:   Sun Jul 19 20:39:56 2015 +0000

      qemu-char: Fix missed data on unix socket

      Commit 812c1057 introduced HUP detection on unix and tcp sockets prior
      to a read in tcp_chr_read. This unfortunately broke CloudStack 4.2
      which relied on the old behaviour where data on a socket was readable
      even if a HUP was present.

      A working solution is to properly check the return values from recv,
      handling a closed socket once there is no more data to read.

      Also enable polling for G_IO_NVAL to ensure the callback is called
      for all possible events as these should now be possible to handle
      with the improved error detection.

      Signed-off-by: Nils Carlson <pyssling@ludd.ltu.se>
      Message-Id: <1437338396-22336-1-git-send-email-pyssling@ludd.ltu.se>
      [Do not handle EINTR; use socket_error(). - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9172f428afc1461b1d9b33ebca3a679b9adf7c3a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 09:25:54 2015 +0200

      qemu-char: handle EINTR for TCP character devices

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0b8e2c1002afddc8ef3d52fa6fc29e4768429f98
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 12:27:16 2015 +0100

      exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()

      When accessing the dispatch pointer in an AddressSpace within an RCU
      critical section we should always use atomic_rcu_read(). Fix an
      access within memory_region_section_get_iotlb() which was incorrectly
      doing a direct pointer access.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1437391637-31576-1-git-send-email-peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 759b484c5d7f92bd01f98797c07e8543ee187888
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Jul 22 14:56:01 2015 -0600

      vfio/pci: Fix bootindex

      bootindex was incorrectly changed to a device Property during the
      platform code split, resulting in it no longer working.  Remove it.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Cc: qemu-stable@nongnu.org # v2.3+

  commit 69970fcef937bddd7f745efe39501c7716fdfe56
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Jul 22 14:56:01 2015 -0600

      vfio/pci: Fix RTL8168 NIC quirks

      The RTL8168 quirk correctly describes using bit 31 as a signal to
      mark a latch/completion, but the code mistakenly uses bit 28.  This
      causes the Realtek driver to spin on this register for quite a while,
      20k cycles on Windows 7 v7.092 driver.  Then it gets frustrated and
      tries to set the bit itself and spins for another 20k cycles.  For
      some this still results in a working driver, for others not.  About
      the only thing the code really does in its current form is protect
      the guest from sneaking in writes to the real hardware MSI-X table.
      The fix is obviously to use bit 31 as we document that we should.

      The other problem doesn't seem to affect current drivers as nobody
      seems to use these window registers for writes to the MSI-X table, but
      we need to use the stored data when a write is triggered, not the
      value of the current write, which only provides the offset.

      Note that only the Windows drivers from Realtek seem to use these
      registers, the Microsoft drivers provided with Windows 8.1 do not
      access them, nor do Linux in-kernel drivers.

      Link: https://bugs.launchpad.net/qemu/+bug/1384892
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Cc: qemu-stable@nongnu.org # v2.1+

  commit 6b2699672d5b56f8c2902fb9db9879e8cafb2afe
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jul 16 17:29:12 2015 -0300

      hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init()

      This fixes the following crash, introduced by commit
      49d2e648e8087d154d8bf8b91f27c8e05e79d5a6:

        $ gdb --args qemu-system-x86_64 -machine pc,mem-merge=off -object memory-backend-ram,id=ram-node0,size=1024
        [...]
        Program received signal SIGABRT, Aborted.
        (gdb) bt
        #0  0x00007ffff253b8c7 in raise () at /lib64/libc.so.6
        #1  0x00007ffff253d52a in abort () at /lib64/libc.so.6
        #2  0x00007ffff253446d in __assert_fail_base () at /lib64/libc.so.6
        #3  0x00007ffff2534522 in  () at /lib64/libc.so.6
        #4  0x00005555558bb80a in qemu_opt_get_bool_helper (opts=0x55555621b650, name=name@entry=0x5555558ec922 "mem-merge", defval=defval@entry=true, del=del@entry=false) at qemu/util/qemu-option.c:388
        #5  0x00005555558bbb5a in qemu_opt_get_bool (opts=<optimized out>, name=name@entry=0x5555558ec922 "mem-merge", defval=defval@entry=true) at qemu/util/qemu-option.c:398
        #6  0x0000555555720a24 in host_memory_backend_init (obj=0x5555562ac970) at qemu/backends/hostmem.c:226

      Instead of using qemu_opt_get_bool(), that didn't work with
      qemu_machine_opts for a long time, we can use the corresponding
      MachineState fields.

      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b69b30532e0a80e25449244c01b0cbed000c99a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 18:17:19 2015 +0100

      Update version for v2.4.0-rc2 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3edf6b3f1e68104dba692337fdcecdba39e73c59
  Merge: dc94bd9 a52b2cb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 16:22:49 2015 +0100

      Merge remote-tracking branch 'remotes/elmarco/tags/for-upstream' into staging

      qxl: build fix for 2.4

      # gpg: Signature made Wed Jul 22 15:55:00 2015 BST using DSA key ID F43F0992
      # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>"
      # gpg:                 aka "Marc-Andre Lureau <marcandre.lureau@gmail.com>"
      # gpg:                 aka "Marc-Andre Lureau <marc-andre.lureau@nokia.com>"
      # gpg:                 aka "Marc-André Lureau <marc-andre.lureau@nokia.com>"
      # gpg:                 aka "Marc-André Lureau (elmarco) <marcandre.lureau@gmail.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7346 2483 9404 4E20 ABFF  7D48 D864 9487 F43F 0992

      * remotes/elmarco/tags/for-upstream:
        qxl: Fix new function name for spice-server library

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a52b2cbf218d52f9e357961acb271a98a2bdff71
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Mon Jul 20 09:43:23 2015 +0100

      qxl: Fix new function name for spice-server library

      The new spice-server function to limit the number of monitors (0.12.6)
      changed while development from spice_qxl_set_monitors_config_limit to
      spice_qxl_max_monitors (accepted upstream).
      By mistake I post patch with former name.
      This patch fix the function name.

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Acked-by: Christophe Fergeau <cfergeau@redhat.com>
      Acked-by: Martin Kletzander <mkletzan@redhat.com>
      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

  commit dc94bd9166af5236a56bd5bb06845911915a925c
  Merge: b9c4630 05e514b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 12:52:34 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Wed Jul 22 12:43:35 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        AioContext: optimize clearing the EventNotifier
        AioContext: fix broken placement of event_notifier_test_and_clear
        AioContext: fix broken ctx->dispatching optimization
        aio-win32: reorganize polling loop
        tests: remove irrelevant assertions from test-aio
        qemu-timer: initialize "timers_done_ev" to set
        mirror: Speed up bitmap initial scanning

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 05e514b1d4d5bd4209e2c8bbc76ff05c85a235f3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:53 2015 +0200

      AioContext: optimize clearing the EventNotifier

      It is pretty rare for aio_notify to actually set the EventNotifier.  It
      can happen with worker threads such as thread-pool.c's, but otherwise it
      should never be set thanks to the ctx->notify_me optimization.  The
      previous patch, unfortunately, added an unconditional call to
      event_notifier_test_and_clear; now add a userspace fast path that
      avoids the call.

      Note that it is not possible to do the same with event_notifier_set;
      it would break, as proved (again) by the included formal model.

      This patch survived over 3000 reboots on aarch64 KVM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 21a03d17f2edb1e63f7137d97ba355cc6f19d79f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:52 2015 +0200

      AioContext: fix broken placement of event_notifier_test_and_clear

      event_notifier_test_and_clear must be called before processing events.
      Otherwise, an aio_poll could "eat" the notification before the main
      I/O thread invokes ppoll().  The main I/O thread then never wakes up.
      This is an example of what could happen:

         i/o thread       vcpu thread                     worker thread
         ---------------------------------------------------------------------
         lock_iothread
         notify_me = 1
         ...
         unlock_iothread
                                                           bh->scheduled = 1
                                                           event_notifier_set
                          lock_iothread
                          notify_me = 3
                          ppoll
                          notify_me = 1
                          aio_dispatch
                           aio_bh_poll
                            thread_pool_completion_bh
                                                           bh->scheduled = 1
                                                           event_notifier_set
                           node->io_read(node->opaque)
                            event_notifier_test_and_clear
         ppoll
         *** hang ***

      "Tracing" with qemu_clock_get_ns shows pretty much the same behavior as
      in the previous bug, so there are no new tricks here---just stare more
      at the code until it is apparent.

      One could also use a formal model, of course.  The included one shows
      this with three processes: notifier corresponds to a QEMU thread pool
      worker, temporary_waiter to a VCPU thread that invokes aio_poll(),
      waiter to the main I/O thread.  I would be happy to say that the
      formal model found the bug for me, but actually I wrote it after the
      fact.

      This patch is a bit of a big hammer.  The next one optimizes it,
      with help (this time for real rather than a posteriori :)) from
      another, similar formal model.

      Reported-by: Richard W. M. Jones <rjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit eabc977973103527bbb8fed69c91cfaa6691f8ab
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:51 2015 +0200

      AioContext: fix broken ctx->dispatching optimization

      This patch rewrites the ctx->dispatching optimization, which was the cause
      of some mysterious hangs that could be reproduced on aarch64 KVM only.
      The hangs were indirectly caused by aio_poll() and in particular by
      flash memory updates's call to blk_write(), which invokes aio_poll().
      Fun stuff: they had an extremely short race window, so much that
      adding all kind of tracing to either the kernel or QEMU made it
      go away (a single printf made it half as reproducible).

      On the plus side, the failure mode (a hang until the next keypress)
      made it very easy to examine the state of the process with a debugger.
      And there was a very nice reproducer from Laszlo, which failed pretty
      often (more than half of the time) on any version of QEMU with a non-debug
      kernel; it also failed fast, while still in the firmware.  So, it could
      have been worse.

      For some unknown reason they happened only with virtio-scsi, but
      that's not important.  It's more interesting that they disappeared with
      io=native, making thread-pool.c a likely suspect for where the bug arose.
      thread-pool.c is also one of the few places which use bottom halves
      across threads, by the way.

      I hope that no other similar bugs exist, but just in case :) I am
      going to describe how the successful debugging went...  Since the
      likely culprit was the ctx->dispatching optimization, which mostly
      affects bottom halves, the first observation was that there are two
      qemu_bh_schedule() invocations in the thread pool: the one in the aio
      worker and the one in thread_pool_completion_bh.  The latter always
      causes the optimization to trigger, the former may or may not.  In
      order to restrict the possibilities, I introduced new functions
      qemu_bh_schedule_slow() and qemu_bh_schedule_fast():

           /* qemu_bh_schedule_slow: */
           ctx = bh->ctx;
           bh->idle = 0;
           if (atomic_xchg(&bh->scheduled, 1) == 0) {
               event_notifier_set(&ctx->notifier);
           }

           /* qemu_bh_schedule_fast: */
           ctx = bh->ctx;
           bh->idle = 0;
           assert(ctx->dispatching);
           atomic_xchg(&bh->scheduled, 1);

      Notice how the atomic_xchg is still in qemu_bh_schedule_slow().  This
      was already debated a few months ago, so I assumed it to be correct.
      In retrospect this was a very good idea, as you'll see later.

      Changing thread_pool_completion_bh() to qemu_bh_schedule_fast() didn't
      trigger the assertion (as expected).  Changing the worker's invocation
      to qemu_bh_schedule_slow() didn't hide the bug (another assumption
      which luckily held).  This already limited heavily the amount of
      interaction between the threads, hinting that the problematic events
      must have triggered around thread_pool_completion_bh().

      As mentioned early, invoking a debugger to examine the state of a
      hung process was pretty easy; the iothread was always waiting on a
      poll(..., -1) system call.  Infinite timeouts are much rarer on x86,
      and this could be the reason why the bug was never observed there.
      With the buggy sequence more or less resolved to an interaction between
      thread_pool_completion_bh() and poll(..., -1), my "tracing" strategy was
      to just add a few qemu_clock_get_ns(QEMU_CLOCK_REALTIME) calls, hoping
      that the ordering of aio_ctx_prepare(), aio_ctx_dispatch, poll() and
      qemu_bh_schedule_fast() would provide some hint.  The output was:

          (gdb) p last_prepare
          $3 = 103885451
          (gdb) p last_dispatch
          $4 = 103876492
          (gdb) p last_poll
          $5 = 115909333
          (gdb) p last_schedule
          $6 = 115925212

      Notice how the last call to qemu_poll_ns() came after aio_ctx_dispatch().
      This makes little sense unless there is an aio_poll() call involved,
      and indeed with a slightly different instrumentation you can see that
      there is one:

          (gdb) p last_prepare
          $3 = 107569679
          (gdb) p last_dispatch
          $4 = 107561600
          (gdb) p last_aio_poll
          $5 = 110671400
          (gdb) p last_schedule
          $6 = 110698917

      So the scenario becomes clearer:

         iothread                   VCPU thread
      --------------------------------------------------------------------------
         aio_ctx_prepare
         aio_ctx_check
         qemu_poll_ns(timeout=-1)
                                    aio_poll
                                      aio_dispatch
                                        thread_pool_completion_bh
                                          qemu_bh_schedule()

      At this point bh->scheduled = 1 and the iothread has not been woken up.
      The solution must be close, but this alone should not be a problem,
      because the bottom half is only rescheduled to account for rare situations
      (see commit 3c80ca1, thread-pool: avoid deadlock in nested aio_poll()
      calls, 2014-07-15).

      Introducing a third thread---a thread pool worker thread, which
      also does qemu_bh_schedule()---does bring out the problematic case.
      The third thread must be awakened *after* the callback is complete and
      thread_pool_completion_bh has redone the whole loop, explaining the
      short race window.  And then this is what happens:

                                                            thread pool worker
      --------------------------------------------------------------------------
                                                            <I/O completes>
                                                            qemu_bh_schedule()

      Tada, bh->scheduled is already 1, so qemu_bh_schedule() does nothing
      and the iothread is never woken up.  This is where the bh->scheduled
      optimization comes into play---it is correct, but removing it would
      have masked the bug.

      So, what is the bug?

      Well, the question asked by the ctx->dispatching optimization ("is any
      active aio_poll dispatching?") was wrong.  The right question to ask
      instead is "is any active aio_poll *not* dispatching", i.e. in the prepare
      or poll phases?  In that case, the aio_poll is sleeping or might go to
      sleep anytime soon, and the EventNotifier must be invoked to wake
      it up.

      In any other case (including if there is *no* active aio_poll at all!)
      we can just wait for the next prepare phase to pick up the event (e.g. a
      bottom half); the prepare phase will avoid the blocking and service the
      bottom half.

      Expressing the invariant with a logic formula, the broken one looked like:

         !(exists(thread): in_dispatching(thread)) => !optimize

      or equivalently:

         !(exists(thread):
                in_aio_poll(thread) && in_dispatching(thread)) => !optimize

      In the correct one, the negation is in a slightly different place:

         (exists(thread):
               in_aio_poll(thread) && !in_dispatching(thread)) => !optimize

      or equivalently:

         (exists(thread): in_prepare_or_poll(thread)) => !optimize

      Even if the difference boils down to moving an exclamation mark :)
      the implementation is quite different.  However, I think the new
      one is simpler to understand.

      In the old implementation, the "exists" was implemented with a boolean
      value.  This didn't really support well the case of multiple concurrent
      event loops, but I thought that this was okay: aio_poll holds the
      AioContext lock so there cannot be concurrent aio_poll invocations, and
      I was just considering nested event loops.  However, aio_poll _could_
      indeed be concurrent with the GSource.  This is why I came up with the
      wrong invariant.

      In the new implementation, "exists" is computed simply by counting how many
      threads are in the prepare or poll phases.  There are some interesting
      points to consider, but the gist of the idea remains:

      1) AioContext can be used through GSource as well; as mentioned in the
      patch, bit 0 of the counter is reserved for the GSource.

      2) the counter need not be updated for a non-blocking aio_poll, because
      it won't sleep forever anyway.  This is just a matter of checking
      the "blocking" variable.  This requires some changes to the win32
      implementation, but is otherwise not too complicated.

      3) as mentioned above, the new implementation will not call aio_notify
      when there is *no* active aio_poll at all.  The tests have to be
      adjusted for this change.  The calls to aio_notify in async.c are fine;
      they only want to kick aio_poll out of a blocking wait, but need not
      do anything if aio_poll is not running.

      4) nested aio_poll: these just work with the new implementation; when
      a nested event loop is invoked, the outer event loop is never in the
      prepare or poll phases.  The outer event loop thus has already decremented
      the counter.

      Reported-by: Richard W. M. Jones <rjones@redhat.com>
      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6493c975af75be5b8d9ade954239bdf5492b7911
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:50 2015 +0200

      aio-win32: reorganize polling loop

      Preparatory bugfixes and tweaks to the loop before the next patch:

      - disable dispatch optimization during aio_prepare.  This fixes a bug.

      - do not modify "blocking" until after the first WaitForMultipleObjects
      call.  This is needed in the next patch.

      - change the loop to do...while.  This makes it obvious that the loop
      is always entered at least once.  In the next patch this is important
      because the first iteration undoes the ctx->notify_me increment that
      happened before entering the loop.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 12d69ac03b45156356b240424623719f15d8143e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:49 2015 +0200

      tests: remove irrelevant assertions from test-aio

      In these tests, the purpose of the initial calls to aio_poll and
      g_main_context_iteration is simply to put the AioContext in a
      known state; the return value of the function does not really
      matter.  The next patch will change those return values; change
      the assertions to a while loop which expresses the intention
      better.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4efd8a488d0a68b0af34d8ee245463df7c8bdf4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:48 2015 +0200

      qemu-timer: initialize "timers_done_ev" to set

      The normal value for the event is to be set.  If we do not do
      this, pause_all_vcpus (through qemu_clock_enable) hangs unless
      timerlist_run_timers has been run at least once for the timerlist.
      This can happen with the following patches, that make aio_notify do
      nothing most of the time.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 999006975840f8cdf2038a587d852a6cbfe58e3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jul 9 11:47:58 2015 +0800

      mirror: Speed up bitmap initial scanning

      Limiting to sectors_per_chunk for each bdrv_is_allocated_above is slow,
      because the underlying protocol driver would issue much more queries
      than necessary. We should coalesce the query.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: <1436413678-7114-4-git-send-email-famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b9c46307996856d03ddc1527468ff5401ac03a79
  Merge: 774ee47 5f8343d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 20:56:20 2015 +0100

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-07-21-tag' into staging

      tag for qga-pull-2015-07-21

      Small fix to correct schema versioning annotations for recently-added
      GuestDiskBusType enum values. Not the end of the world, but ideally
      this inconsistency would be corrected prior to 2.4 release.

      # gpg: Signature made Tue Jul 21 20:43:24 2015 BST using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-07-21-tag:
        qga: fixed versions for guest bus types in qapi-schema

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f8343d0670e91adadb7898304c8ed4355af05a2
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Tue Jul 21 15:25:08 2015 +0300

      qga: fixed versions for guest bus types in qapi-schema

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      *added semi-colon to better delineate 2.2 vs. 2.4 versioning
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 774ee4772b6838b78741ea52d4bf26b8922244c5
  Merge: a1bc040 57b7309
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 12:21:08 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150721' into staging

      target-arm queue:
       * don't sync CNTVCT with kernel all the time (fixes VM time weirdnesses)
       * fix a warning compiling disas/arm-a64 with -Wextra

      # gpg: Signature made Tue Jul 21 12:15:33 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150721:
        disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR
        target-arm: kvm: Differentiate registers based on write-back levels

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57b73090e041ece40cc619a3c43a6fafcb3dd647
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Tue Jul 21 11:18:45 2015 +0100

      disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR

      Type fprintf_function which fits here was defined with this attribute.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1437208027-14584-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b7a6bf402bd064605c287eecadc493ccf2d4897
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jul 21 11:18:45 2015 +0100

      target-arm: kvm: Differentiate registers based on write-back levels

      Some registers like the CNTVCT register should only be written to the
      kernel as part of machine initialization or on vmload operations, but
      never during runtime, as this can potentially make time go backwards or
      create inconsistent time observations between VCPUs.

      Introduce a list of registers that should not be written back at runtime
      and check this list on syncing the register state to the KVM state.

      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1437046488-10773-1-git-send-email-christoffer.dall@linaro.org
      [PMM: tweaked a few comments, added the new argument to the stub
       write_list_to_kvmstate() in target-arm/kvm-stub.c]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1bc040dabc12039944e22d9529f20d6132400dd
  Merge: bd03a38 47c7199
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 10:04:32 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Mon Jul 20 19:27:04 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        tests: Fix broken targets check-report-qtest-*
        ahci: Force ICC bits in PxCMD to zero
        qtest/ide: add another short PRDT test flavor

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 47c719964a8240c99d4b7a2b4695ae026c619b83
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      tests: Fix broken targets check-report-qtest-*

      They need QTEST_QEMU_IMG. Without it, the tests raise an assertion:

      $ make -C bin check-report-qtest-i386.xml
      make: Entering directory 'bin'
      GTESTER check-report-qtest-i386.xml
      blkdebug: Suspended request 'A'
      blkdebug: Resuming request 'A'
      ahci-test: tests/libqos/libqos.c:162:
       mkimg: Assertion `qemu_img_path' failed.
      main-loop: WARNING: I/O thread spun for 1000 iterations

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1437231284-17455-1-git-send-email-sw@weilnetz.de
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit bd03a38fdf85fb1d4f0c9f59bbc154b516f66360
  Merge: 13566fe 625de44
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 18:26:53 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon Jul 20 18:25:14 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net: Flush queued packets when guest resumes
        lan9118: Drop lan9118_can_receive
        etraxfs_eth: Drop eth_can_receive
        musicpal: Drop eth_can_receive
        net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets
        net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'
        socket: pass correct size in net_socket_send()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 625de449fc5597f2e1aff9cb586e249e198f03c9
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jul 7 09:21:07 2015 +0800

      net: Flush queued packets when guest resumes

      Since commit 6e99c63 "net/socket: Drop net_socket_can_send" and friends,
      net queues need to be explicitly flushed after qemu_can_send_packet()
      returns false, because the netdev side will disable the polling of fd.

      This fixes the case of "cont" after "stop" (or migration).

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436232067-29144-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b49b8c572f885ea2b16fc744e8837e974df34401
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:47 2015 +0800

      lan9118: Drop lan9118_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da69028261abd12dbf974754e69d017f6e8710b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:46 2015 +0800

      etraxfs_eth: Drop eth_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f63eab8becf92b18c18b6c31950f99f764848902
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:45 2015 +0800

      musicpal: Drop eth_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80da311d81c389860bc387fbe6677c71f7a3c596
  Author: Dana Rubin <dana.rubin@ravellosystems.com>
  Date:   Tue Jul 14 11:55:16 2015 +0300

      net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets

      Convert partially summed packets to be fully checksummed.

      In case csum offloaded packet, vmxnet3 implementation always passes an
      RxCompDesc with the "Checksum calculated and found correct" notification
      to the OS. This emulates the observed ESXi behavior.

      Therefore, if packet has the NEEDS_CSUM bit set, we must calculate and
      place a fully computed checksum into the tcp/udp header. Otherwise, the
      OS driver will receive a checksum-correct indication but with the actual
      tcp/udp checksum field having just the pseudo header csum value.

      If host OS performs forwarding, it will forward an incorrectly
      checksummed packet.

      Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Message-id: 1436864116-19154-3-git-send-email-shmulik.ladkani@ravellosystems.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fcf0cdc362dd96cb8d2935b892d3dd9ab73ad393
  Author: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
  Date:   Tue Jul 14 11:55:15 2015 +0300

      net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'

      Separate RX packet protocol parsing out of 'vmxnet_rx_pkt_attach_data'.

      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Message-id: 1436864116-19154-2-git-send-email-shmulik.ladkani@ravellosystems.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 091f1f52963d7093ea578e4a05e67bc015b21192
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Tue Jul 7 17:00:56 2015 +0800

      socket: pass correct size in net_socket_send()

      We should pass the size of packet instead of the remaining to
      qemu_send_packet_async().

      Fixes: 6e99c631f116221d169ea53953d91b8aa74d297a
             ("net/socket: Drop net_socket_can_send")

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436259656-24263-1-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 09b61db7c140c5a71bfde36614c5a1f4f0d382a6
  Author: Stefan Fritsch <sf@sfritsch.de>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      ahci: Force ICC bits in PxCMD to zero

      The AHCI spec requires that the HBA sets the ICC bits to zero after the
      ICC change is done. Since we don't do any ICC change, force the bits to
      zero all the time.

      This fixes delays with some OSs (e.g. OpenBSD) waiting for the ICC bits
      to change to 0.

      Signed-off-by: Stefan Fritsch <sf@sfritsch.de>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: E1ZFpg7-00027N-HW@eru.sfritsch.de
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 58732810230719765a6618004be8f0070c9f3d31
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      qtest/ide: add another short PRDT test flavor

      The existing short PRDT test case does not transfer any data because the
      first PRD is less than 1 sector.

      This patch adds another short PRDT test case where the first sector can
      be read but the PRDT is still smaller than the requested number of
      sectors.  This exercises a different code path in ide_dma_cb().

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1435770571-9906-1-git-send-email-stefanha@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 13566fe3e584e7b14a6f45246976b91677dc2a77
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 8 15:10:09 2015 +0100

      timer: rename NSEC_PER_SEC due to Mac OS X header clash

      Commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9 ("timer: Use a single
      definition of NSEC_PER_SEC for the whole codebase") renamed
      NANOSECONDS_PER_SECOND to NSEC_PER_SEC.

      On Mac OS X there is a <dispatch/time.h> system header which also
      defines NSEC_PER_SEC.  This causes compiler warnings.

      Let's use the old name instead.  It's longer but it doesn't clash.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436364609-7929-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dcc8a3ab632d0f11a1bf3b08381cf0f93e616b9f
  Merge: f73ca73 bd09594
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 16:01:31 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc2

      # gpg: Signature made Mon Jul 20 15:48:56 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        crypto: Fix aes_decrypt_wrapper()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f73ca7363440240b7ee5ee7f7ddb1c64751efb54
  Merge: 7135847 f9d6dbf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 13:25:28 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, vhost, pc fixes for 2.4

      The only notable thing here is vhost-user multiqueue
      revert. We'll work on making it stable in 2.5,
      reverting now means we won't have to maintain
      bug for bug compability forever.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 20 12:24:00 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio-net: remove virtio queues if the guest doesn't support multiqueue
        virtio-net: Flush incoming queues when DRIVER_OK is being set
        pci_add_capability: remove duplicate comments
        virtio-net: unbreak any layout
        Revert "vhost-user: add multi queue support"
        ich9: fix skipped vmstate_memhp_state subsection

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bd09594603f1498e7623f0030988b62e2052f7da
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jul 17 19:44:10 2015 +0200

      crypto: Fix aes_decrypt_wrapper()

      Commit d3462e3 broke qcow2's encryption functionality by using encrypt
      instead of decrypt in the wrapper function it introduces. This was found
      by qemu-iotests case 134.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>

  commit f9d6dbf0bf6e91b8ed896369ab1b7e91e5a1a4df
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Jul 15 17:20:59 2015 +0800

      virtio-net: remove virtio queues if the guest doesn't support multiqueue

      commit da51a335 adds all queues in .realize(). But if the
      guest doesn't support multiqueue, we forget to remove them. And
      we cannot handle the ctrl vq corretly. The guest will hang.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Jason Wang <jasowang@redhat.com>

  commit 38705bb57bf1cd9e3f837cf11bcdee3876786c07
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 11:02:27 2015 +0800

      virtio-net: Flush incoming queues when DRIVER_OK is being set

      This patch fixes network hang after "stop" then "cont", while network
      packets keep arriving.

      Tested both manually (tap, host pinging guest) and with Jason's qtest
      series (plus his "[PATCH 2.4] socket: pass correct size in
      net_socket_send()" fix).

      As virtio_net_set_status is called when guest driver is setting status
      byte and when vm state is changing, it is a good opportunity to flush
      queued packets.

      This is necessary because during vm stop the backend (e.g. tap) would
      stop rx processing after .can_receive returns false, until the queue is
      explicitly flushed or purged.

      The other interesting condition in .can_receive, virtio_queue_ready(),
      is handled by virtio_net_handle_rx() when guest kicks; the 3rd condition
      is invalid queue index which doesn't need flushing.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9a2a66238e3bf2b681d6321c4667a2d589c8ebed
  Author: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
  Date:   Tue Jul 14 16:16:11 2015 +0800

      pci_add_capability: remove duplicate comments

      Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit feb93f361739071778ca2d23df3876db399548f7
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Jul 17 15:19:18 2015 +0800

      virtio-net: unbreak any layout

      Commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
      ("virtio-net: byteswap virtio-net header") breaks any layout by
      requiring out_sg[0].iov_len >= n->guest_hdr_len. Fixing this by
      copying header to temporary buffer if swap is needed, and then use
      this buffer as part of out_sg.

      Fixes 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
      ("virtio-net: byteswap virtio-net header")
      Cc: qemu-stable@nongnu.org
      Cc: clg@fr.ibm.com
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d345ed2da3279b015605823397235b8c5ca5251f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 15 13:47:31 2015 +0300

      Revert "vhost-user: add multi queue support"

      This reverts commit 830d70db692e374b55555f4407f96a1ceefdcc97.

      The interface isn't fully backwards-compatible, which is bad.
      Let's redo this properly after 2.4.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 75d663611e81c748522d9cdcb5230bd02db86d05
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Mon Jul 13 17:45:42 2015 -0300

      ich9: fix skipped vmstate_memhp_state subsection

      By declaring another .subsections array for vmstate_tco_io_state made
      vmstate_memhp_state not registered anymore. There must be only one
      .subsections array for all subsections.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reported-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>

  commit 71358470eec668f5dc53def25e585ce250cea9bf
  Merge: 5b5e8cd 621a20e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 15:22:45 2015 +0100

      Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/vrng-2.4' into staging

      Fire timer only when required.  Brings down wakeups by a big number.

      # gpg: Signature made Fri Jul 17 14:41:40 2015 BST using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-virtio-rng/tags/vrng-2.4:
        virtio-rng: trigger timer only when guest requests for entropy

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 621a20e08155179b1902c428361e80f41429f50d
  Author: Pankaj Gupta <pagupta@redhat.com>
  Date:   Wed Jul 15 17:46:47 2015 +0530

      virtio-rng: trigger timer only when guest requests for entropy

      This patch triggers timer only when guest requests for
      entropy. As soon as first request from guest for entropy
      comes we set the timer. Timer bumps up the quota value
      when it gets triggered.

      Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Message-Id: <1436962608-9961-2-git-send-email-pagupta@redhat.com>

      [Re-worded patch subject, removed extra whitespace -- Amit]

      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 5b5e8cdd7da7a2214dd062afff5b866234aab228
  Merge: fd1a9ef 92fdfa4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 12:39:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150717-1' into staging

      usb: fixes for 2.4 (ccid, xhci and usb-host)

      # gpg: Signature made Fri Jul 17 12:21:42 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150717-1:
        Revert "xhci: set timer to retry xfers"
        usb-ccid: add missing wakeup calls
        usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb
        Re-attach usb device to kernel while usb_host_open fails

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 92fdfa4bef9c92addcc009dd3e0131172b4fdc78
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jul 17 10:12:55 2015 +0200

      Revert "xhci: set timer to retry xfers"

      This reverts commit 4e8cfbe1143d8384387595b500212d7a7f11aeae.

      We should not poll via timer, and with ccid being fixed
      to properly notify us about pending transfers we don't have to.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 86d7e214c224f939c897cfa3b6d597f7af4b5bba
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jul 16 16:33:07 2015 +0200

      usb-ccid: add missing wakeup calls

      Properly notify the host adapter that we have
      data pending, so it doesn't has to poll us.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cfda2cef3d0320d7a133600ffdb6e33547aaba8f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jul 17 11:34:11 2015 +0200

      usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb

      QOMification dropped the parent device lookup, fix it.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fd1a9ef9c2493b5bc98e8e041333a57b635c5d71
  Merge: b4329bf 562f937
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 10:52:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150717-1' into staging

      input: fixes for 2.4

      # gpg: Signature made Fri Jul 17 07:45:17 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150717-1:
        hid: clarify hid_keyboard_process_keycode
        virtio-input: move sys/ioctl.h include
        virtio-input: fix segfault in virtio_input_hid_properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 562f93754b95fd6dc65ad9a2aa15a90b2da7e8a4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 11:18:06 2015 +0200

      hid: clarify hid_keyboard_process_keycode

      Coverity thinks the fallthroughs are smelly.  They are correct, but
      everything else in this function is like "wut?".

      Refer explicitly to bits 8 and 9 of hs->kbd.modifiers instead of
      shifting right first and using (1 << 7).  Document what the scancode
      is when hid_code is 0xe0.  And add plenty of comments.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b4329bf41c86bac8b56cadb097081960cc4839a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 20:32:20 2015 +0100

      Update version for v2.4.0-rc1 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b92304ee814f0fe8109c8946dfb4dd4b63e89871
  Merge: 67ff64e d3462e3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 19:18:15 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * MIPS-KVM fixes.
      * Coverity fixes.
      * Nettle function prototype fixes.
      * Memory API refcount fix.

      # gpg: Signature made Thu Jul 16 19:01:27 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        crypto: avoid undefined behavior in nettle calls
        crypto: fix build with nettle >= 3.0.0
        memory: fix refcount leak in memory_region_present
        RDMA: Fix error exits
        arm/xlnx-zynqmp: fix memory leak
        ppc/spapr_drc: fix memory leak
        mips/kvm: Sign extend registers written to KVM
        mips/kvm: Fix Big endian 32-bit register access

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d3462e378f40ba6838b6c42584c30769ca633e6f
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Jul 10 19:18:01 2015 +0200

      crypto: avoid undefined behavior in nettle calls

      Calling a function pointer that was cast from an incompatible function
      results in undefined behavior.  'void *' isn't compatible with 'struct
      XXX *', so we can't cast to nettle_cipher_func, but have to provide a
      wrapper.  (Conversion from 'void *' to 'struct XXX *' might require
      computation, which won't be done if we drop argument's true type, and
      pointers can have different sizes so passing arguments on stack would
      bug.)

      Having two different prototypes based on nettle version doesn't make
      this solution any nicer.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Message-Id: <1437062641-12684-3-git-send-email-rkrcmar@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit becaeb726ae7da4212a788773ebdfe87b4833f5c
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Jul 10 19:18:00 2015 +0200

      crypto: fix build with nettle >= 3.0.0

      In nettle 3, cbc_encrypt() accepts 'nettle_cipher_func' instead of
      'nettle_crypt_func' and these two differ in 'const' qualifier of the
      first argument.  The build fails with:

        In file included from crypto/cipher.c:71:0:
        ./crypto/cipher-nettle.c: In function ‘qcrypto_cipher_encrypt’:
        ./crypto/cipher-nettle.c:154:38: error: passing argument 2 of
        ‘nettle_cbc_encrypt’ from incompatible pointer type
                 cbc_encrypt(ctx->ctx_encrypt, ctx->alg_encrypt,
                                                     ^
        In file included from ./crypto/cipher-nettle.c:24:0,
                         from crypto/cipher.c:71:
        /usr/include/nettle/cbc.h:48:1: note: expected
        ‘void (*)(const void *, size_t, uint8_t *, const uint8_t *)
        but argument is of type
        ‘void (*)(      void *, size_t, uint8_t *, const uint8_t *)

      To allow both versions, we switch to the new definition and #if typedef
      it for old versions.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Message-Id: <1436548682-9315-2-git-send-email-rkrcmar@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c6742b14fe7352059cd4954a356a8105757af31b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 13:45:34 2015 +0200

      memory: fix refcount leak in memory_region_present

      memory_region_present() leaks a reference to a MemoryRegion in the
      case "mr == container".  While fixing it, avoid reference counting
      altogether for memory_region_present(), by using RCU only.

      The return value could in principle be already invalid immediately
      after memory_region_present returns, but presumably the caller knows
      that and it's using memory_region_present to probe for devices that
      are unpluggable, or something like that.  The RCU critical section
      is needed anyway, because it protects as->current_map.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 24b41d66c8ad8f77839fca777b92e365dad0cf5c
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Jul 10 20:08:52 2015 +0100

      RDMA: Fix error exits

      The error checks I added used 'break' after the error, but I'm
      in a switch inside the while loop, so they need to be 'goto out'.

      Spotted by coverity; entries 1311368 and 1311369

      Fixes: afcddefd

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Message-Id: <1436555332-19076-1-git-send-email-dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5348c62cab309b68ecd13a33c9f21e8d6071af72
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 10 08:51:29 2015 +0800

      arm/xlnx-zynqmp: fix memory leak

      fix CID 1311372.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1436489490-236-4-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 586d2142a9f1aa5a1dceb0941e7b3f0953974a8b
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 10 08:51:28 2015 +0800

      ppc/spapr_drc: fix memory leak

      fix CID 1311373.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1436489490-236-3-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 02dae26ac4ceb1e82c432cfca4d9b65ae82343c6
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Fri Apr 24 11:26:53 2015 +0100

      mips/kvm: Sign extend registers written to KVM

      In case we're running on a 64-bit host, be sure to sign extend the
      general purpose registers and hi/lo/pc before writing them to KVM, so as
      to take advantage of MIPS32/MIPS64 compatibility.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Cc: qemu-stable@nongnu.org
      Message-Id: <1429871214-23514-3-git-send-email-james.hogan@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8b3e48b2d269551cd40f94770dc20da2f402325
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Fri Apr 24 11:26:52 2015 +0100

      mips/kvm: Fix Big endian 32-bit register access

      Fix access to 32-bit registers on big endian targets. The pointer passed
      to the kernel must be for the actual 32-bit value, not a temporary
      64-bit value, otherwise on big endian systems the kernel will only
      interpret the upper half.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Cc: qemu-stable@nongnu.org
      Message-Id: <1429871214-23514-2-git-send-email-james.hogan@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 67ff64e08245a5b8de98d9b2acefb840a1fae340
  Merge: 2d5ee9e 567161f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 16:55:00 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150716-1' into staging

      qxl: allow to specify head limit to qxl driver

      # gpg: Signature made Thu Jul 16 16:31:40 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150716-1:
        qxl: allow to specify head limit to qxl driver

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6110ce59af199194ef63cb31ec722487df3f42fe
  Author: Lin Ma <lma@suse.com>
  Date:   Wed Jun 24 13:40:11 2015 +0800

      Re-attach usb device to kernel while usb_host_open fails

      Signed-off-by: Lin Ma <lma@suse.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e2f6bac3010419426b636d2b307f66deecd60813
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 14 13:44:12 2015 +0200

      virtio-input: move sys/ioctl.h include

      Drop from include/standard-headers/linux/input.h
      Add to hw/input/virtio-input-host.c instead.

      That allows to build virtio-input (except pass-through) on windows.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2a19b229f6c2f7288bb8c2498bffb01d67810dee
  Author: Lin Ma <lma@suse.com>
  Date:   Tue Jul 14 19:27:30 2015 +0800

      virtio-input: fix segfault in virtio_input_hid_properties

      commit 5cce173 introduced virtio-input segfault, This patch fixes it.

      Signed-off-by: Lin Ma <lma@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 567161fdd47aeb6987e700702f6bbfef04ae0236
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Mon Jul 6 07:56:38 2015 +0100

      qxl: allow to specify head limit to qxl driver

      This patch allow to limit number of heads using qxl driver. By default
      qxl driver is not limited on any kind on head use so can decide to use
      as much heads.

      libvirt has this as a video card parameter (actually set to 1 but not
      used). This parameter will allow to limit setting a use can do (which
      could be confusing).

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2d5ee9e7a7dd495d233cf9613a865f63f88e3375
  Merge: 3749c11 908680c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 10:40:22 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150716' into staging

      MIPS patches 2015-07-16

      Changes:
      * bug fixes

      # gpg: Signature made Thu Jul 16 09:04:56 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150716:
        target-mips: fix page fault address for LWL/LWR/LDL/LDR
        linux-user: Fix MIPS N64 trap and break instruction bug
        target-mips: fix resource leak reported by Coverity
        target-mips: fix logically dead code reported by Coverity
        target-mips: correct DERET instruction
        target-mips: fix ASID synchronisation for MIPS MT
        disas/mips: fix disassembling R6 instructions
        target-mips: fix to clear MSACSR.Cause
        target-mips: fix MIPS64R6-generic configuration

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3749c11a720689694101dcf2ebc43217a02f960f
  Merge: be0df8c 3046bb5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 22:05:13 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-07-15

      Two bug fixes:
      * Memory leak due to extra g_strdup() when registering X86CPU alias properties
      * Fix CPUID levels so that W10 insider can run as guest OS

      # gpg: Signature made Wed Jul 15 21:26:59 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: emulate CPUID level of real hardware
        target-i386: Don't strdup() alias property name

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be0df8cd1eb8e182a9b61a2b4d1c57824cffadc4
  Merge: 7692401 672558d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 21:06:54 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-15

      # gpg: Signature made Wed Jul 15 21:01:37 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        numa: Fix memory leak in numa_set_mem_node_id()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3046bb5debc8153a542acb1df93b2a1a85527a15
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Thu Jul 9 21:07:39 2015 +0200

      target-i386: emulate CPUID level of real hardware

      W10 insider has a bug where it ignores CPUID level and interprets
      CPUID.(EAX=07H, ECX=0H) incorrectly, because CPUID in fact returned
      CPUID.(EAX=04H, ECX=0H);  this resulted in execution of unsupported
      instructions.

      While it's a Windows bug, there is no reason to emulate incorrect level.

      I used http://instlatx64.atw.hu/ as a source of CPUID and checked that
      it matches Penryn Xeon X5472, Westmere Xeon W3520, SandyBridge i5-2540M,
      and Haswell i5-4670T.

      kvm64 and qemu64 were bumped to 0xD to allow all available features for
      them (and to avoid the same Windows bug).

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d461a44ca4b164549fe19b14d2cdf0524f778ce1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jul 9 12:24:43 2015 -0300

      target-i386: Don't strdup() alias property name

      Now object_property_add_alias() calls g_strdup() on the target property
      name, so we don't need to call g_strdup() ourselves.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 672558d2ea8dd782d1d2adc6e16af3bc34029a36
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 9 20:57:36 2015 +0530

      numa: Fix memory leak in numa_set_mem_node_id()

      Fix a memory leak in numa_set_mem_node_id().

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7692401a0826803522cfde533bdcc149932ddc6a
  Merge: 711dc6f 76e2aef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 17:28:59 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150715' into staging

      target arm queue:
       * handle broken AArch64 kernels which assume DTB won't cross a 2MB boundary
       * correct broken SCTLR_EL3 reset value

      # gpg: Signature made Wed Jul 15 17:24:24 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150715:
        hw/arm/boot: Increase fdt alignment
        target-arm: Fix broken SCTLR_EL3 reset

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 76e2aef392629f2b2a468f5158d5c397cc5beed2
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Jul 15 17:16:26 2015 +0100

      hw/arm/boot: Increase fdt alignment

      The Linux kernel on aarch64 creates a page table entry at early bootup
      that spans the 2MB range on memory spanning the fdt start address:

        [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ]

      This means that when our current 4k alignment happens to fall at the end
      of the aligned region, Linux tries to access memory that is not mapped.

      The easy fix is to instead increase the alignment to 2MB, making Linux's
      logic always succeed.

      We leave the existing 4k alignment for 32bit kernels to not cause any
      regressions due to space constraints.

      Reported-by: Andreas Schwab <schwab@suse.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e46e1a74ef482f1ef773e750df9654ef4442ca29
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 17:16:26 2015 +0100

      target-arm: Fix broken SCTLR_EL3 reset

      The SCTLR_EL3 cpreg definition was implicitly resetting the
      register state to 0, which is both wrong and clashes with
      the reset done via the SCTLR definition (since sctlr[3]
      is unioned with sctlr_s). This went unnoticed until recently,
      when an unrelated change (commit a903c449b41f105aa) happened to
      perturb the order of enumeration through the cpregs hashtable for
      reset such that the erroneous reset happened after the correct one
      rather than before it. Fix this by marking SCTLR_EL3 as an alias,
      so its reset is left up to the AArch32 view.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 711dc6f36b74fe65a6e5a1847f1152717d887f8a
  Merge: f5dec79 796a060
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 14:23:58 2015 +0100

      Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

      # gpg: Signature made Wed Jul 15 03:25:16 2015 BST using RSA key ID C0DE3057
      # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
      # gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
      # gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

      * remotes/cody/tags/jtc-for-upstream-pull-request:
        block/curl: Don't lose original error when a connection fails.
        mirror: correct buf_size
        block: keep bitmap if incremental backup job is cancelled
        blockdev: no need to drain in qmp_block_commit
        block/mirror: Sleep periodically during bitmap scanning

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 908680c6441ac468f4871d513f42be396ea0d264
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jul 14 17:45:16 2015 +0200

      target-mips: fix page fault address for LWL/LWR/LDL/LDR

      When a LWL, LWR, LDL or LDR instruction triggers a page fault, QEMU
      currently reports the aligned address in CP0 BadVAddr, while the Windows
      NT kernel expects the unaligned address.

      This patch adds a byte access with the unaligned address at the
      beginning of the LWL/LWR/LDL/LDR instructions to possibly trigger a page
      fault and fill the QEMU TLB.

      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reported-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f01a361bfcce4bd0c439b0e051ef2a1e56727a44
  Author: Andrew Bennett <andrew.bennett@imgtec.com>
  Date:   Mon Jun 29 10:20:07 2015 +0000

      linux-user: Fix MIPS N64 trap and break instruction bug

      For the MIPS N64 ABI when QEMU reads the break/trap instruction so that
      it can inspect the break/trap code it reads 8 rather than 4 bytes
      which means it finds the code field from the instruction after the
      break/trap instruction.  This then causes the break/trap handling
      code to fail because it does not understand the code number.

      The fix forces QEMU to always read 4 bytes of instruction data rather
      than deciding how much to read based on the ABI.

      Signed-off-by: Andrew Bennett <andrew.bennett@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 26e7e982b267e71d40cd20e9e234fedef6770a90
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:15 2015 +0100

      target-mips: fix resource leak reported by Coverity

      UHI assert and link operations call lock_user_string() twice to obtain two
      strings pointed by gpr[4] and gpr[5]. If the second lock_user_string()
      fails, then the first one won't get freed. Fix this by introducing another
      macro responsible for obtaining two strings and handling allocation
      failure.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 47ada0ad3431b39863918dc80386634693d317b5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:14 2015 +0100

      target-mips: fix logically dead code reported by Coverity

      Make use of CMPOP in floating-point compare instructions.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit fe87c2b36ae9c1c9a5279f3891f3bce1b573baa0
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:13 2015 +0100

      target-mips: correct DERET instruction

      Fix Debug Mode flag clearing, and when DERET is placed between LL and SC
      do not make SC fail.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 6a973e6b6584221bed89a01e755b88e58b496652
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jul 1 15:59:13 2015 +0200

      target-mips: fix ASID synchronisation for MIPS MT

      When syncing the task ASID with EntryHi, correctly or the value instead
      of assigning it.

      Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6b9c26fb5eed2345398daca4eef601da2f3d7867
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Tue Jun 30 16:33:15 2015 +0100

      disas/mips: fix disassembling R6 instructions

      In the Release 6 of the MIPS Architecture, LL, SC, LLD, SCD, PREF
      and CACHE instructions have 9 bits offsets.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d4f4f0d5d9e74c19614479592c8bc865d92773d0
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Tue Jun 30 15:44:28 2015 +0100

      target-mips: fix to clear MSACSR.Cause

      MSACSR.Cause bits are needed to be cleared before a vector floating-point
      instructions.
      FEXDO.df, FEXUPL.df and FEXUPR.df were missed out.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4dc89b782095d7a0b919fafd7b1322b3cb1279f1
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 29 10:11:23 2015 +0100

      target-mips: fix MIPS64R6-generic configuration

      Fix core configuration for MIPS64R6-generic to make it as close as
      I6400.
      I6400 core has 48-bit of Virtual Address available (SEGBITS).
      MIPS SIMD Architecture is available.
      Rearrange order of bits to match the specification.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f5dec79ee88034b2da52463145a2056500db9ff2
  Merge: 661725d 560d027
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 12:22:31 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150715-1' into staging

      migration/next for 20150715

      # gpg: Signature made Wed Jul 15 11:23:33 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150715-1:
        migration: We also want to store the global state for savevm
        migration: reduce the count of strlen call
        migration: Register global state section before loadvm
        migration: Write documetation for events capabilites
        migration: Trace event and migration event are different things
        migration: Only change state after migration has finished

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 560d027b54067ffa4e79c6f7c0a499abb0d749a3
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 15 09:53:46 2015 +0200

      migration: We also want to store the global state for savevm

      Commit df4b1024526cae3479da3492d6371fd4a7324a03 introduced global_state
      section.  But it only filled the state while doing migration.  While
      doing a savevm, we stored an empty string as state.  So when we did a
      loadvm, it complained that state was invalid.

      Fedora 21, 4.1.1, qemu 2.4.0-rc0
      > ../../configure --target-list="x86_64-softmmu"

      068 2s ... - output mismatch (see 068.out.bad)
      --- /home/bos/jhuston/src/qemu/tests/qemu-iotests/068.out	2015-07-08
      17:56:18.588164979 -0400
      +++ 068.out.bad	2015-07-09 17:39:58.636651317 -0400
      @@ -6,6 +6,8 @@
       QEMU X.Y.Z monitor - type 'help' for more information
       (qemu) savevm 0
       (qemu) quit
      +qemu-system-x86_64: Unknown savevm section or instance 'globalstate' 0
      +qemu-system-x86_64: Error -22 while loading VM state
       QEMU X.Y.Z monitor - type 'help' for more information
       (qemu) quit
       *** done
      Failures: 068
      Failed 1 of 1 tests

      Actually, there were two problems here:
      - we registered global_state too late for load_vm (fixed on another
        patch on the list)
      - we didn't store a valid state for savevm (fixed by this patch).

      Reported-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Tested-by:  Christian Borntraeger <borntraeger@de.ibm.com>

  commit 9f5f380b54d6ad80cf35d93c8cd71c8d7a1b52b7
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Jul 13 17:34:10 2015 +0800

      migration: reduce the count of strlen call

      'strlen' is called three times in 'save_page_header', it's
      inefficient.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 48212d87d6655b029231d830a77983c21552fe49
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri Jul 10 14:51:58 2015 +0200

      migration: Register global state section before loadvm

      Otherwise, it is not found

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 72e72e1a71e5e67a11204606a5c09f6cc3089a53
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 14:13:10 2015 +0200

      migration: Write documetation for events capabilites

      Reported-by: Jiri Denemark <jdenemar@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4ba4bc5e9bfab457a96ac56dc470730a330aded8
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 13:58:27 2015 +0200

      migration: Trace event and migration event are different things

      We can want the trace event even without migration events enabled.

      Reported-by:  Wen Congyang <ghostwcy@gmail.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 172c4356f38fbf91675256447a3bedd08220214f
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 13:56:26 2015 +0200

      migration: Only change state after migration has finished

      On previous change, we changed state at post load time if it was not
      running, special casing the "running" change.  Now, we change any states
      at the end of the migration.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 796a060bc0fab40953997976a2e30d9d6235bc7b
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 8 14:37:48 2015 +0100

      block/curl: Don't lose original error when a connection fails.

      Currently if qemu is connected to a curl source (eg. web server), and
      the web server fails / times out / dies, you always see a bogus EIO
      "Input/output error".

      For example, choose a large file located on any local webserver which
      you control:

        $ qemu-img convert -p http://example.com/large.iso /tmp/test

      Once it starts copying the file, stop the webserver and you will see
      qemu-img fail with:

        qemu-img: error while reading sector 61440: Input/output error

      This patch does two things: Firstly print the actual error from curl
      so it doesn't get lost.  Secondly, change EIO to EPROTO.  EPROTO is a
      POSIX.1 compatible errno which more accurately reflects that there was
      a protocol error, rather than some kind of hardware failure.

      After this patch is applied, the error changes to:

        $ qemu-img convert -p http://example.com/large.iso /tmp/test
        qemu-img: curl: transfer closed with 469989 bytes remaining to read
        qemu-img: error while reading sector 16384: Protocol error

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 48ac0a4df84662f23da25262443e1810b70c2228
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Fri May 15 15:51:36 2015 +0800

      mirror: correct buf_size

      If bus_size is less than 0, the command fails.
      If buf_size is 0, use DEFAULT_MIRROR_BUF_SIZE.
      If buf_size % granularity is not 0, mirror_free_init() will
      do dangerous things.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 5555A588.3080907@cn.fujitsu.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 17d9716d7b5381c4b6566bb1a06267d2bfcd1821
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jun 15 16:02:14 2015 +0100

      block: keep bitmap if incremental backup job is cancelled

      Reclaim the dirty bitmap if an incremental backup block job is
      cancelled.  The ret variable may be 0 when the job is cancelled so it's
      not enough to check ret < 0.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1434380534-7680-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 299bf097375f9d148cda579ad85477304e38856b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 28 16:21:43 2015 +0200

      blockdev: no need to drain in qmp_block_commit

      Draining is not necessary, I/O can happen as soon as the
      commit coroutine yields.  Draining can be necessary before
      reopening the file for read/write, or while modifying the
      backing file chain, but that is done separately in
      bdrv_reopen_multiple or bdrv_close; this particular
      bdrv_drain_all does nothing for that.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432822903-25821-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 4c0cbd6fec7db182a6deb52d5a8a8e7b0c5cbe64
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 11:11:13 2015 +0800

      block/mirror: Sleep periodically during bitmap scanning

      Before, we only yield after initializing dirty bitmap, where the QMP
      command would return. That may take very long, and guest IO will be
      blocked.

      Add sleep points like the later mirror iterations.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1431486673-19280-1-git-send-email-famz@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 661725da09f47eb92d356fac10a4cf3b7ad1f61d
  Merge: f394798 2af9170
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 18:50:16 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150714' into staging

      s390x fixes for 2.4:
      - virtio migration regression
      - missing diag288 watchdog resets

      # gpg: Signature made Tue Jul 14 18:17:54 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150714:
        s390/virtio-ccw: Fix migration
        watchdog/diag288: correctly register for system reset requests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2af9170c8c269c4fba73e5271453ca15a57f5844
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Jul 7 13:47:23 2015 +0200

      s390/virtio-ccw: Fix migration

      commit 213941d73b ("virtio-ccw: migrate ->revision") broke
      migration:
      2015-07-07T11:22:55.570968Z qemu-system-s390x: VQ 39 address 0x0 inconsistent with Host index 0x100
      2015-07-07T11:22:55.571008Z qemu-system-s390x: error while loading state for instance 0x0 of

      If thinint support is active, the config_load function returns early.
      Make sure to load the revision all the time.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Fixes: 213941d73b ("virtio-ccw: migrate ->revision")
      Message-Id: <1436269643-66303-1-git-send-email-borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 0c7322cfd3fd382c0096c2a9f00775818a878e13
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Mon Jun 29 08:21:10 2015 +0200

      watchdog/diag288: correctly register for system reset requests

      The diag288 watchdog is no sysbus device, therefore it doesn't get
      triggered on resets automatically using dc->reset.

      Let's register the reset handler manually, so we get correctly notified
      again when a system reset was requested. Also reset the watchdog on
      subsystem resets that don't trigger a full system reset.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit f3947986d9bbbae1087c4c33880d3f8dbf1f1384
  Merge: 0030ff4 e34d8f2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 16:51:44 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc1

      # gpg: Signature made Tue Jul 14 16:15:35 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        rbd: fix ceph settings precedence
        rbd: make qemu's cache setting override any ceph setting
        MAINTAINERS: update email address
        rbd: remove unused constants and fields
        block: Fix backing file child when modifying graph
        block: Reorder cleanups in bdrv_close()
        block: Introduce bdrv_unref_child()
        block: Introduce bdrv_open_child()
        block: Move bdrv_attach_child() calls up the call chain
        nvme: properly report volatile write caches
        nvme: implement the Flush command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e34d8f297d51b7ffa5dce72df1e45fa94cff989c
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:46 2015 -0700

      rbd: fix ceph settings precedence

      Apply the ceph settings from a config file before any ceph settings
      from the command line. Since the ceph config file location may be
      specified on the command line, parse it once to read the config file,
      and do a second pass to apply the rest of the command line ceph
      options.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 99a3c89d5d538dc6c360e35dffb797cfe06e9cda
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:45 2015 -0700

      rbd: make qemu's cache setting override any ceph setting

      To be safe, when cache=none is used ceph settings should not be able
      to override it to turn on caching. This was previously possible with
      rbd_cache=true in the rbd device configuration or a ceph configuration
      file. Similarly, rbd settings could have turned off caching when qemu
      requested it, although this would just be a performance problem.

      Fix this by changing rbd's cache setting to match qemu after all other
      ceph settings have been applied.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5a8ac6d9d70e1a078d04ad75a5c055b00a041d70
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:44 2015 -0700

      MAINTAINERS: update email address

      The old one still works for now, but will not work indefinitely.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3dbf00e058e450173c6f892bb572df871eb4ea58
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:43 2015 -0700

      rbd: remove unused constants and fields

      RBDAIOCB.status was only used for cancel, which was removed in
      7691e24dbebb46658e89b3f950fda6ec78bbb823.

      RBDAIOCB.sector_num was never used.

      RADOSCB.done and rcbid were never used.

      RBD_FD* are obsolete since the pipe was removed in
      e04fb07fd1676e9facd7f3f878c1bbe03bccd26b.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 80a1e130917e0745625129553c943743eb663727
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 17 15:52:09 2015 +0200

      block: Fix backing file child when modifying graph

      This patch moves bdrv_attach_child() from the individual places that add
      a backing file to a BDS to bdrv_set_backing_hd(), which is called by all
      of them. It also adds bdrv_detach_child() there.

      For normal operation (starting with one backing file chain and not
      changing it until the topmost image is closed) and live snapshots, this
      constitutes no change in behaviour.

      For all other cases, this is a fix for the bug that the old backing file
      was still referenced as a child, and the new one wasn't referenced.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 9a7dedbc43c7c400663d2876a8ccb6d942a1429a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 16 10:58:20 2015 +0200

      block: Reorder cleanups in bdrv_close()

      Block drivers may still want to access their child nodes in their
      .bdrv_close handler. If they unref and/or detach a child by themselves,
      this should not result in a double free.

      There is additional code for backing files, which are just a special
      case of child nodes. The same applies for them.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 33a604075c51e5528eed970eeaeefe609ea2337d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 13:51:04 2015 +0200

      block: Introduce bdrv_unref_child()

      This is the counterpart for bdrv_open_child(). It decreases the
      reference count of the child BDS and removes it from the list of
      children of the given parent BDS.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit b4b059f628173dd1d722ee8a9c592a80aec1fc2f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 13:24:19 2015 +0200

      block: Introduce bdrv_open_child()

      It is the same as bdrv_open_image(), except that it doesn't only return
      success or failure, but the newly created BdrvChild object for the new
      child node.

      As the BdrvChild object already contains a BlockDriverState pointer (and
      this is supposed to become the only pointer so that bdrv_append() and
      friends can just change a single pointer in BdrvChild), the pbs
      parameter is removed for bdrv_open_child().

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit df5817926790f6e84d1936eab523556f96fa577a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 11:53:47 2015 +0200

      block: Move bdrv_attach_child() calls up the call chain

      Let the callers of bdrv_open_inherit() call bdrv_attach_child(). It
      needs to be called in all cases where bdrv_open_inherit() succeeds (i.e.
      returns 0) and a child_role is given.

      bdrv_attach_child() is moved upwards to avoid a forward declaration.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 30349fd038ffb26528fad21abe1e264031364449
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Jun 11 12:01:39 2015 +0200

      nvme: properly report volatile write caches

      Implement support in Identify and Get/Set Features to properly report
      and allow to change the Volatile Write Cache status reported by the
      virtual NVMe device.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8b9d74e0eebb2106b767d66355d38086be72ad2b
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Jun 11 12:01:38 2015 +0200

      nvme: implement the Flush command

      Implement a real flush instead of faking it.  This is especially important
      as Qemu assume Write back cashing by default and thus requires a working
      cache flush operation for data integrity.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0030ff40472b9ebf0e0595afbc8d7e428218c5d7
  Merge: f3a1b50 a169513
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 14:52:45 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150714-1' into staging

      vnc: fix vnc client authentication

      # gpg: Signature made Tue Jul 14 14:38:48 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150714-1:
        vnc: fix vnc client authentication

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a16951375f7669b7faf27f72ca753e25325c5179
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Tue Jul 14 14:51:40 2015 +0200

      vnc: fix vnc client authentication

      Commit 800567a61 updated the code to the generic crypto API
      and mixed up encrypt and decrypt functions in
      procotol_client_auth_vnc.
      (Used to be: deskey(key, EN0) which encrypts, and was
      changed to qcrypto_cipher_decrypt in 800567a61.)
      Changed it to qcrypto_cipher_encrypt now.

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f3a1b5068cea303a55e2a21a97e66d057eaae638
  Merge: 6e3c0c6 4421c6a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 13 13:35:51 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc,virtio: fixes for 2.4

      pc and virtio changes, bugfixes only.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 13 13:03:38 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3
        Revert "virtio-net: enable virtio 1.0"
        virtio-pci: don't crash on illegal length
        qdev: fix 64 bit properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4421c6a38a37d558b8e6f82d2d54aee30350f57f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Jun 23 14:00:51 2015 -0300

      pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3

      commit fddd179ab962f6f78a8493742e1068d6a620e059,
          "pc: Convert *_MACHINE_OPTIONS macros into functions"
      broke the chaining of *_machine_options() functions on
      pc-i440fx-2.3, at:

        -#define PC_I440FX_2_3_MACHINE_OPTIONS \
        -    PC_I440FX_2_4_MACHINE_OPTIONS, \
        -    .alias = NULL, \
        -    .is_default = 0
        +static void pc_i440fx_2_3_machine_options(QEMUMachine *m)
        +{
        +    pc_i440fx_machine_options(m);
        +    m->alias = NULL;
        +    m->is_default = 0;
        +}

      I have replaced PC_I440FX_2_4_MACHINE_OPTIONS with a
      pc_i440fx_machine_options() call, instead of calling
      pc_i440fx_2_4_machine_options(). This broke the setting of default_machine_opts
      and default_display on pc-i440fx-{2.0,2,1,2.2,2.3}.

      Fix this by making pc_i440fx_2_3_machine_options() reuse
      pc_i440fx_2_4_machine_options().

      Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>

  commit 06c4670ff6d4acdc5a24e3d25748ee4a489d5869
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 13 13:46:50 2015 +0800

      Revert "virtio-net: enable virtio 1.0"

      This reverts commit df91055db5c9cee93d70ca8c08d72119a240b987.

      This is because:
      - vhost support virtio 1.0 now
      - transport code (e.g virtio-pci) set this feature when modern is
        enabled, setting this unconditionally will break disable-modern=on.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2a6391232fa58f32469fb61d55343eff32a91083
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 13 10:32:50 2015 +0300

      virtio-pci: don't crash on illegal length

      Some guests seem to access cfg with an illegal length value.
      It's worth fixing them but debugging is easier if
      qemu does not crash.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8aedc369c6ae4fb4c4c6920f703b000015df3d8d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jul 9 13:01:14 2015 +0200

      qdev: fix 64 bit properties

      64 bit props used 32 bit callbacks in two places, leading to broken
      feature bits on virtio (example: got 0x31000000000006d4 which is
      obviously bogus). Fix this.

      Fixes: fdba6d96 ("qdev: add 64bit properties")
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6e3c0c6edbdddb8dd676bec1ac51b5faffc19a77
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Jul 10 21:22:39 2015 +0200

      tci: Fix regression with INDEX_op_qemu_st_i32, INDEX_op_qemu_st_i64

      Commit 59227d5d45bb3c31dc2118011691c35b3c00879c did not update the
      code in tcg/tci/tcg-target.c for those two cases.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1436556159-3002-1-git-send-email-sw@weilnetz.de
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6169b60285fe1ff730d840a49527e721bfb30899
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 17:56:56 2015 +0100

      Update version for v2.4.0-rc0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 16c1321bd78ad79a7252b714184ee2a0b5944c56
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 17:46:24 2015 +0100

      tci: Fix compile failure by including qemu-common.h

      Compilation of TCI was accidentally broken by the recent disassembler
      changes:

        CC    x86_64-softmmu/arch_init.o
      In file included from target-i386/cpu-qom.h:23:0,
                       from target-i386/cpu.h:986,
                       from include/qemu-common.h:122,
                       from include/disas/bfd.h:12,
                       from disas/tci.c:20:
      include/qom/cpu.h:178:43: error: unknown type name ‘disassemble_info’
           void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
                                                 ^
      include/qom/cpu.h:179:1: error:
      no semicolon at end of struct or union [-Werror]
       } CPUClass;
       ^
      cc1: all warnings being treated as errors

      The underlying cause of this is an include loop:
       bfd.h -> qemu-common.h -> target-arm/cpu.h ->  target-arm/cpu-qom.h
        -> qom/cpu.h -> bfd.h

      which means that if bfd.h is included first then qom/cpu.h doesn't
      get the definition of the disassemble_info type that it wanted.
      The easiest fix for this is to include qemu-common.h from tci.c
      before including disas/bfd.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9dc4cf94c182f03c0061483891f53d1d21e5e68
  Merge: 0326248 4f4f697
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 16:22:37 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Fixes for two bad bugs.  For 2.4-rc0.

      # gpg: Signature made Thu Jul  9 15:54:19 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        crypto: fix builtin qcrypto_cipher_free
        migration: fix RCU deadlock

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4f4f6976d80614e2d81cea4385885876f24bb257
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 16:52:48 2015 +0200

      crypto: fix builtin qcrypto_cipher_free

      This was dereferencing a pointer before checking if it was NULL.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reported-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 032624868df264d395ee9900331f08bad1431022
  Merge: 5a2db89 6b625fd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 15:00:37 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * Further QOM'ification of CPU initialization
      * Propagation of CPUState arguments and elimination of ENV_GET_CPU() usage
      * cpu_set_pc() abstraction
      * CPUClass::disas_set_info() hook

      # gpg: Signature made Thu Jul  9 14:23:12 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter: (22 commits)
        disas: cris: QOMify target specific disas setup
        disas: cris: Fix 0 buffer length case
        disas: microblaze: QOMify target specific disas setup
        disas: arm: QOMify target specific disas setup
        disas: arm-a64: Make printfer and stream variable
        disas: QOMify target specific setup
        disas: Add print_insn to disassemble info
        microblaze: boot: Use cpu_set_pc()
        hw/arm/boot: Use cpu_set_pc()
        gdbstub: Use cpu_set_pc() helper
        cpu: Add wrapper for the set_pc() hook
        cpu-exec: Purge all uses of ENV_GET_CPU()
        cpu: Change cpu_exec_init() arg to cpu, not env
        cpu: Change tcg_cpu_exec() arg to cpu, not env
        gdbstub: Change gdbserver_fork() to accept cpu instead of env
        translate-all: Change tb_flush() env argument to cpu
        target-ppc: Move cpu_exec_init() call to realize function
        cpu: Convert cpu_index into a bitmap
        cpu: Add Error argument to cpu_exec_init()
        cpu: Reorder cpu->as, cpu->thread_id, cpu->memory_dispatch init
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6b625fde5eb8d1c969969392f1c92b58beed2183
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:38 2015 -0700

      disas: cris: QOMify target specific disas setup

      Move the target_disas() cris specifics to the QOM disas_set_info() hook
      and delete the cris specific code in disas.c.

      This also now adds support for monitor_disas() to cris.

      E.g.
      (qemu) xp 0x40004000
      0000000040004000: 0x1e6f25f0

      And before this patch:
      (qemu) xp/i 0x40004000
      0x40004000: Asm output not supported on this arch

      After:
      (qemu) xp/i 0x40004000
      0x40004000:  di
      (qemu) xp/i 0x40004002
      0x40004002:  move.d 0xb003c004,$r1

      Note: second example is 6-byte misaligned instruction!

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 51d373cf5f5a39fa315342d12ec910fe59d87090
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:37 2015 -0700

      disas: cris: Fix 0 buffer length case

      Cris has the complication of variable length instructions and has
      a check in place to clamp memory reads in case the disas request
      doesn't have enough bytes for the instruction being disas'd. This
      breaks down in the case where disassembling for the monitor where
      the buffer length is defaulted to 0.

      The buffer length should never be zero for a regular target_disas,
      so we can safely assume the 0 case is for the monitor in which case
      consider the buffer length to be the max for cris instructions.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit efc6674be845e40d443b62e80eb9ea9a9adfee3c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:36 2015 -0700

      disas: microblaze: QOMify target specific disas setup

      Move the target_disas() MB specifics to the QOM disas_set_info hook
      and delete the MB specific code in disas.c.

      This also now adds support for monitor_disas() to Microblaze.

      E.g.
      (qemu) xp 0x90000000
      0000000090000000: 0x94208001

      And before this patch:
      (qemu) xp/i 0x90000000
      0x90000000: Asm output not supported on this arch

      After:
      (qemu) xp/i 0x90000000
      0x90000000:  mfs    r1, rmsr

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 484406200e51eac023b346fdf987f86af1f6fe75
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:35 2015 -0700

      disas: arm: QOMify target specific disas setup

      Move the target_disas() ARM specifics to the QOM disas_set_info hook
      and delete the ARM specific code in disas.c.

      This has the extra advantage of the more fully featured target_disas()
      implementation now applying to monitor_disas().

      Currently, target_disas() has multi-endian, thumb and AArch64
      support whereas the existing monitor_disas() support only has vanilla
      AA32 support.

      E.G. Running an AA64 linux kernel the following -d in_asm disas happens
      (taget_disas()):

      IN:
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)
      0x0000000040000004:  aa1f03e1      mov x1, xzr

      However before this patch, disasing the same from the monitor:

      (qemu) xp/i 0x40000000
      0x0000000040000000:  580000c0      stmdapl  r0, {r6, r7}

      After this patch:
      (qemu) xp/i 0x40000000
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit fb200d5f003118f63205f34bbe553efcf3a66a81
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:34 2015 -0700

      disas: arm-a64: Make printfer and stream variable

      In a normal disassembly flow, the printf() and stream being used varies
      from disas job to job. In particular it varies if mixing monitor_disas
      and target_disas.

      Make both the printf() function and target stream settable in the
      QEMUDisassmbler class.

      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 37b9de463bff4fc786bb5f0778829e68d2c97bd0
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:33 2015 -0700

      disas: QOMify target specific setup

      Add a QOM function hook for target-specific disassembly setup. This
      allows removal of the #ifdeffery currently implementing target specific
      disas setup from disas.c.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2de295c544dda8680a82fe465c92d236d49c4d4f
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:32 2015 -0700

      disas: Add print_insn to disassemble info

      Add the print_insn pointer to the disassemble info structure. This is
      to prepare for QOMification support, where a QOM CPU hook function will
      be responsible for setting the print_insn() function. Add this function
      to the existing struct to consolidate such that only the one struct
      needs to be passed to the new QOM API.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 691b9572e337f2d74b4b527c3dc76f542c6a5734
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:23 2015 -0700

      microblaze: boot: Use cpu_set_pc()

      Use cpu_set_pc() for setting program counters when bootloading. This
      removes an instance of system level code having to reach into the CPU
      env.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Avoid duplicated CPU() casts through local variable]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4df81c6ed1eddcbbb920a977e76f599e05b39b77
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:22 2015 -0700

      hw/arm/boot: Use cpu_set_pc()

      Use cpu_set_pc() across the board for setting program counters. This
      removes instances of system level code having to reach into the CPU
      env.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Avoid repeated casts with local variables]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4a2b24edb73f98fa58fd8965db5b312617de7a02
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:21 2015 -0700

      gdbstub: Use cpu_set_pc() helper

      Use the cpu_set_pc() helper which will take care of CPUClass retrieval
      for us.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2991b8904730d663f12ad42e35798ecc22fe151c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:20 2015 -0700

      cpu: Add wrapper for the set_pc() hook

      Add a wrapper around the CPUClass::set_pc() hook.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit ea3e9847408131abc840240bd61e892d28459452
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu Jun 18 10:24:55 2015 -0700

      cpu-exec: Purge all uses of ENV_GET_CPU()

      Remove un-needed usages of ENV_GET_CPU() by converting the APIs to use
      CPUState pointers and retrieving the env_ptr as minimally needed.

      Scripted conversion for target-* change:

      for I in target-*/cpu.h; do
          sed -i \
          's/\(^int cpu_[^_]*_exec(\)[^ ][^ ]* \*s);$/\1CPUState *cpu);/' \
          $I;
      done

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4bad9e392e788a218967167a38ce2ae7a32a6231
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:18 2015 -0700

      cpu: Change cpu_exec_init() arg to cpu, not env

      The callers (most of them in target-foo/cpu.c) to this function all
      have the cpu pointer handy. Just pass it to avoid an ENV_GET_CPU() from
      core code (in exec.c).

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 3d57f7893c90d911d786cb2c622b0926fc808b57
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:17 2015 -0700

      cpu: Change tcg_cpu_exec() arg to cpu, not env

      The sole caller of this function navigates the cpu->env_ptr only for
      this function to take it back the cpu pointer straight away. Pass in
      cpu pointer instead and grab the env pointer locally in the function.
      Removes a core code usage of ENV_GET_CPU().

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f7ec7f7b269813603b1d64bb9833f9e711f0115c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:16 2015 -0700

      gdbstub: Change gdbserver_fork() to accept cpu instead of env

      All callsites to this function navigate the cpu->env_ptr only for the
      function to take the env ptr back to the original cpu ptr. Change the
      function to just pass in the CPU pointer instead. Removes a core code
      usage of ENV_GET_CPU() (in gdbstub.c).

      Cc: Riku Voipio <riku.voipio@iki.fi>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit bbd77c180d7ff1b04a7661bb878939b2e1d23798
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:15 2015 -0700

      translate-all: Change tb_flush() env argument to cpu

      All of the core-code usages of this API have the cpu pointer handy so
      pass it in. There are only 3 architecture specific usages (2 of which
      are commented out) which can just use ENV_GET_CPU() locally to get the
      cpu pointer. The reduces core code usage of the CPU env, which brings
      us closer to common-obj'ing these core files.

      Cc: Riku Voipio <riku.voipio@iki.fi>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6dd0f8342ddfbd8db3e3de1a17686cedbc14e9f1
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:14 2015 -0700

      target-ppc: Move cpu_exec_init() call to realize function

      Move cpu_exec_init() call from instance_init to realize. This allows
      any failures from cpu_exec_init() to be handled appropriately.
      Also add corresponding cpu_exec_exit() call from unrealize.

      cpu_dt_id assignment from instance_init is no longer needed since
      correct assignment for cpu_dt_id is already present in realizefn.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Keep calling cpu_exec_init() for CONFIG_USER_ONLY]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b7bca7333411bd19c449147e8202ae6b0e4a8e09
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:13 2015 -0700

      cpu: Convert cpu_index into a bitmap

      Currently CPUState::cpu_index is monotonically increasing and a newly
      created CPU always gets the next higher index. The next available
      index is calculated by counting the existing number of CPUs. This is
      fine as long as we only add CPUs, but there are architectures which
      are starting to support CPU removal, too. For an architecture like PowerPC
      which derives its CPU identifier (device tree ID) from cpu_index, the
      existing logic of generating cpu_index values causes problems.

      With the currently proposed method of handling vCPU removal by parking
      the vCPU fd in QEMU
      (Ref: http://lists.gnu.org/archive/html/qemu-devel/2015-02/msg02604.html),
      generating cpu_index this way will not work for PowerPC.

      This patch changes the way cpu_index is handed out by maintaining
      a bit map of the CPUs that tracks both addition and removal of CPUs.

      The CPU bitmap allocation logic is part of cpu_exec_init(), which is
      called by instance_init routines of various CPU targets. Newly added
      cpu_exec_exit() API handles the deallocation part and this routine is
      called from generic CPU instance_finalize.

      Note: This new CPU enumeration is for !CONFIG_USER_ONLY only.
      CONFIG_USER_ONLY continues to have the old enumeration logic.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: max_cpus -> MAX_CPUMASK_BITS]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a790cc4b942e651fec7edc597c19b637fad5a76
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:12 2015 -0700

      cpu: Add Error argument to cpu_exec_init()

      Add an Error argument to cpu_exec_init() to let users collect the
      error. This is in preparation to change the CPU enumeration logic
      in cpu_exec_init(). With the new enumeration logic, cpu_exec_init()
      can fail if cpu_index values corresponding to max_cpus have already
      been handed out.

      Since all current callers of cpu_exec_init() are from instance_init,
      use error_abort Error argument to abort in case of an error.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 291135b5da228e58900c120e12354cc0a23608e3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:33 2015 -0300

      cpu: Reorder cpu->as, cpu->thread_id, cpu->memory_dispatch init

      Instead of initializing cpu->as, cpu->thread_id, and reloading memory
      map while holding cpu_list_lock(), do it earlier, before locking the CPU
      list and initializing cpu_index.

      This allows the code handling cpu_index and global CPU list to be
      isolated from the rest.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7c39163e389e6e6e16965606fb5a26abcdb6ad73
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:32 2015 -0300

      cpu: Initialize breakpoint/watchpoint lists in cpu_common_initfn()

      One small step in the simplification of cpu_exec_init().

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 199fc85acd0571902eeefef6ea861b8ba4c8201f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:31 2015 -0300

      cpu: No need to zero-initialize CPUState::numa_node

      QOM objects are already zero-filled when instantiated, there's no need
      to explicitly set numa_node to 0.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a2db89615c8efabbeca74fe5e0f14f312d3bbe3
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Thu Jul 9 10:17:15 2015 +0100

      mips/kvm: Sync with newer MIPS KVM headers

      The KVM_REG_MIPS_COUNT_* definitions are now included in
      linux-headers/asm-mips/kvm.h since commit b061808d39fa ("linux-headers:
      update linux headers to kvm/next"), therefore the duplicate definitions
      in target-mips/kvm.c can now be dropped (the definitions were tweaked
      slightly in commit 7a52ce8a1607 ("linux-headers: update") which
      triggered the following build warnings turned errors):

      target-mips/kvm.c:232:0: error: "KVM_REG_MIPS_COUNT_CTL" redefined [-Werror]
      linux-headers/asm/kvm.h:129:0: note: this is the location of the previous definition
      target-mips/kvm.c:236:0: error: "KVM_REG_MIPS_COUNT_RESUME" redefined [-Werror]
      linux-headers/asm/kvm.h:141:0: note: this is the location of the previous definition
      target-mips/kvm.c:239:0: error: "KVM_REG_MIPS_COUNT_HZ" redefined [-Werror]
      linux-headers/asm/kvm.h:147:0: note: this is the location of the previous definition

      Also update the MIPS_C0_{32,64} macros to utilise definitions more
      recently added to the asm-mips/kvm.h header.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1436433435-24898-3-git-send-email-james.hogan@imgtec.com
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8f13961fdcff3a5969b9884368e875aa068f1c9
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Thu Jul 9 10:17:14 2015 +0100

      tcg/mips: Fix build error from merged memop+mmu_idx parameter

      Commit 3972ef6f830d ("tcg: Push merged memop+mmu_idx parameter to
      softmmu routines") caused the following build errors when building TCG
      for MIPS:

      In file included from tcg/tcg.c:258:0:
      tcg/mips/tcg-target.c In function ‘tcg_out_qemu_ld_slow_path’:
      tcg/mips/tcg-target.c:1015:22: error: ‘lb’ undeclared (first use in this function)
      tcg/mips/tcg-target.c In function ‘tcg_out_qemu_st_slow_path’:
      tcg/mips/tcg-target.c:1058:22: error: ‘lb’ undeclared (first use in this function)

      It looks like lb was meant to refer to the TCGLabelQemuLdst *l
      parameter, so fix both references to lb to refer to just l.

      Fixes: 3972ef6f830d ("tcg: Push merged memop+mmu_idx parameter to softmmu routines")
      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1436433435-24898-2-git-send-email-james.hogan@imgtec.com
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d09a6fde1590ca3a45b608b6873a680f208dfeb5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 08:47:58 2015 +0200

      migration: fix RCU deadlock

      migration_end calls synchronize_rcu() within a critical section.
      That causes a deadlock; move the call after rcu_read_unlock().

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit acf7b7fdf31fa76b53803790917c8acf23a2badb
  Merge: c8e8428 2828a30
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 20:46:35 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Bugfixes and Daniel Berrange's crypto library.

      # gpg: Signature made Wed Jul  8 12:12:29 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        ossaudio: fix memory leak
        ui: convert VNC to use generic cipher API
        block: convert qcow/qcow2 to use generic cipher API
        ui: convert VNC websockets to use crypto APIs
        block: convert quorum blockdrv to use crypto APIs
        crypto: add a nettle cipher implementation
        crypto: add a gcrypt cipher implementation
        crypto: introduce generic cipher API & built-in implementation
        crypto: move built-in D3DES implementation into crypto/
        crypto: move built-in AES implementation into crypto/
        crypto: introduce new module for computing hash digests
        vl: move rom_load_all after machine init done

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8e84287da7dd6a46c0bb0e53190e79ba4eedf24
  Merge: d09952e 702c8c8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 19:44:28 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Wed Jul  8 19:08:28 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: Fix CD-ROM signature
        libqos/ahci: fix ahci_write_fis for ncq on ppc64

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 702c8c8be2f3317c81fff83f82d8a5f1d50d41b8
  Author: Hannes Reinecke <hare@suse.de>
  Date:   Mon Jul 6 17:49:51 2015 -0400

      ahci: Fix CD-ROM signature

      The CD-ROM signature is 0xeb140101, not 0xeb140000.
      Without this change OVMF/Duet runs into a timeout trying
      to detect a SATA cdrom.

      Signed-off-by: Hannes Reinecke <hare@suse.de>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1436219392-31915-2-git-send-email-jsnow@redhat.com

  commit 9ab9993f71b7eac6788deae2fbb7ec659ceb4a1e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jul 6 15:17:09 2015 -0400

      libqos/ahci: fix ahci_write_fis for ncq on ppc64

      Don't try to correct the endianness of NCQ commands, which do not
      use any fields wider than a single byte.

      This corrects the /x86_64/ahci/io/ncq/simple test (and others)
      for ppc64 BE hosts.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Tested-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1436210229-4118-2-git-send-email-jsnow@redhat.com

  commit d09952ee8caeea928695d5a3dc3ec50d8afb98c6
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jul 7 14:32:38 2015 +0100

      Fix the compatibility typedef of ioservid_t to match the Xen headers

      There is a mismatch between the definition of ioservid_t in
      xen_common.h and the definition in the Xen public headers. This patch
      corrects the definition in xen_common.h.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Tested-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1436275958-25174-1-git-send-email-paul.durrant@citrix.com
      Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8232b39bb18a91cde39b8e0b60e731a4ce782b1
  Merge: 62a3864 c4fc82b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 13:36:19 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc,virtio,pci: fixes and updates

      Most notably, this includes the TCO support for ICH: the last feature for 2.4
      as we are entering the hard freeze.

      Bugfixes only from now on.

      virtio pci also gained cfg access capability - arguably a bugfix
      since virtio spec makes it mandatory, but it's a big patch.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Jul  8 10:40:07 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        tco-test: fix up config accesses and re-enable
        virtio fix cfg endian-ness for BE targets
        virtio-pci: implement cfg capability
        virtio: define virtio_pci_cfg_cap in header.
        pcie: Set the "link active" in the link status register
        pci_regs.h: import from linux
        virtio_net: reuse constants from linux
        hw/i386/pc: don't carry FDC from pc_basic_device_init() to pc_cmos_init()
        hw/i386/pc: reflect any FDC @ ioport 0x3f0 in the CMOS
        hw/i386/pc: factor out pc_cmos_init_floppy()
        ich9: implement strap SPKR pin logic
        tests: add testcase for TCO watchdog emulation
        ich9: add TCO interface emulation
        acpi: split out ICH ACPI support
        Revert "dataplane: allow virtio-1 devices"
        dataplane: fix cross-endian issues

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 62a3864eb09414d3cee94a2a592ecd414200912f
  Merge: 59dc0a1 c54e1eb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 12:35:14 2015 +0100

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-07-06-v3-tag' into staging

      tag for qga-pull-2015-07-06-v3

      v3:
        - fix missing <windows.h> in configure test program.

      v2:
        - added configure check for guest-get-fs-info to avoid breakage on older
          MinGWs
        - removed extraneous include of ws2ipdef.h in w32
          guest-network-get-interfaces. ws2tcpip.h already provides those
          definitions, and older MinGWs don't have it.
        - rebased on latest master

      # gpg: Signature made Wed Jul  8 03:01:18 2015 BST using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-07-06-v3-tag:
        qga: added GuestPCIAddress information
        qga: added bus type and disk location path
        configure: add configure check for ntdddisk.h
        qga: added mountpoint and filesystem type for single volume
        qga: added empty qmp_quest_get_fsinfo functionality.
        qga: fail early for invalid time
        qga: win32 qmp_guest_network_get_interfaces implementation
        qga: add win32 library iphlpapi
        Revert "guest agent: remove g_strcmp0 usage"
        qga/qmp_guest_fstrim: Return per path fstrim result
        qga/commands-posix: Fix bug in guest-fstrim

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2828a307232ffceeddec9feb6a87ac660b68b693
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:01:10 2015 +0800

      ossaudio: fix memory leak

      Variable "conf" going out of scope leaks the storage
      it points to in line 856.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1435021270-7768-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 800567a613510c77a55decac4d25fea154d1ee22
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:38 2015 +0100

      ui: convert VNC to use generic cipher API

      Switch the VNC server over to use the generic cipher API, this
      allows it to use the pluggable DES implementations, instead of
      being hardcoded to use QEMU's built-in impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-11-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f6fa64f6d22b0ed53fb3be5883cd9719d17cb4f0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:37 2015 +0100

      block: convert qcow/qcow2 to use generic cipher API

      Switch the qcow/qcow2 block driver over to use the generic cipher
      API, this allows it to use the pluggable AES implementations,
      instead of being hardcoded to use QEMU's built-in impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-10-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8e9b0d24fb986d4241ae3b77752eca5dab4cb486
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:36 2015 +0100

      ui: convert VNC websockets to use crypto APIs

      Remove the direct use of gnutls for hash processing in the
      websockets code, in favour of using the crypto APIs. This
      allows the websockets code to be built unconditionally
      removing countless conditional checks from the VNC code.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-9-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 488981a4af396551a3178d032cc2b41d9553ada2
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:35 2015 +0100

      block: convert quorum blockdrv to use crypto APIs

      Get rid of direct use of gnutls APIs in quorum blockdrv in
      favour of using the crypto APIs. This avoids the need to
      do conditional compilation of the quorum driver. It can
      simply report an error at file open file instead if the
      required hash algorithm isn't supported by QEMU.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-8-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ed754746fea55df726f4de3dadb5bea0b6aa7409
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:34 2015 +0100

      crypto: add a nettle cipher implementation

      If we are linking to gnutls already and gnutls is built against
      nettle, then we should use nettle as a cipher backend in
      preference to our built-in backend.

      This will be used when linking against some GNUTLS 2.x versions
      and all GNUTLS 3.x versions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-7-git-send-email-berrange@redhat.com>
      [Change "#elif" to "#elif defined". - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62893b67cd82bbd48b013c1cec25f0d863612c80
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:33 2015 +0100

      crypto: add a gcrypt cipher implementation

      If we are linking to gnutls already and gnutls is built against
      gcrypt, then we should use gcrypt as a cipher backend in
      preference to our built-in backend.

      This will be used when linking against GNUTLS 1.x and many
      GNUTLS 2.x versions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-6-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ca38a4cc9e36647437b837b346a41981fb8880cd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:32 2015 +0100

      crypto: introduce generic cipher API & built-in implementation

      Introduce a generic cipher API and an implementation of it that
      supports only the built-in AES and DES-RFB algorithms.

      The test suite checks the supported algorithms + modes to
      validate that every backend implementation is actually correctly
      complying with the specs.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-5-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c4fc82bf1ad088a84ccedf779f6aa928e4fadb5f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 8 10:06:15 2015 +0300

      tco-test: fix up config accesses and re-enable

      The mistake that made the test fail was that it tried to
      use a BAR address as an offset for config accesses to LPC.

      Config accesses don't need a BAR, and LPC does not have one. Don't
      attempt to map it.

      With this change applied, TCO test passes, so re-enable it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1e40356ce5f6ccfa0bb57104a533c62952c560ce
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Jul 5 15:08:09 2015 +0200

      virtio fix cfg endian-ness for BE targets

      address_space_rw assumes data is in target format
      and byte-swaps it if target is BE and device is LE.
      Use fixed-endian LE APIs instead.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ada434cd0b44ce984318621e4bb79e067360d737
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 2 14:59:49 2015 +0200

      virtio-pci: implement cfg capability

      spec says we must, so let's do it!

      Note: the implementation is incorrect for BE targets.
      Will fix with a patch on top, not a big deal now as
      the only user is seabios, used on x86 only.

      Tested-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c36f24a2045d7a002b767ce023acfd9be63df692
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 2 12:52:44 2015 +0200

      virtio: define virtio_pci_cfg_cap in header.

      Update virtio pci header from linux-next virtio maintainer tree.
      We already have VIRTIO_PCI_CAP_PCI_CFG, let's define the structure
      that goes with it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b2101eae63ea57b571cee4a9075a4287d24ba4a4
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Sun Jul 5 09:26:03 2015 +1000

      pcie: Set the "link active" in the link status register

      Some firmwares can test that and assume the device hasn't come
      up if that bit isn't set

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 412a82457ef54821362ba27804e24a92fce09761
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 1 11:42:18 2015 +0200

      pci_regs.h: import from linux

      It seems to make sense to import pci_regs.h from linux:
      why maintain our own?
      As a first step, move the header to standard-headers,
      and add it to the update script.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f56fc2d319b18d5e510988374929188867a5f930
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 1 11:36:57 2015 +0200

      virtio_net: reuse constants from linux

      VIRTIO_NET_F_CTRL_GUEST_OFFLOADS now appears in the
      linux header, let's reuse it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 220a8846429ac954932e16010efb07af0aba4529
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:07 2015 +0200

      hw/i386/pc: don't carry FDC from pc_basic_device_init() to pc_cmos_init()

      Thanks to the last patch, pc_cmos_init() doesn't need the (optional)
      board-default FDC any longer as an input parameter. Update
      pc_basic_device_init() not to hand it back to pc_init1() / pc_q35_init(),
      and update the latter not to carry the FDC to pc_cmos_init(). This
      simplifies the code.

      pc_init1() | pc_q35_init()
        pc_basic_device_init()
        pc_cmos_init()

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b86f46132cd86b03f9e4a1cf6295f8b416e16afa
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:06 2015 +0200

      hw/i386/pc: reflect any FDC @ ioport 0x3f0 in the CMOS

      With the pc-q35-2.4 machine type, if the user creates an ISA FDC manually:

        -device isa-fdc,driveA=drive-fdc0-0-0 \
        -drive file=...,if=none,id=drive-fdc0-0-0,format=raw

      then the board-default FDC will be skipped, and only the explicitly
      requested FDC will exist. qtree-wise, this is correct; however such an FDC
      is currently not registered in the CMOS, because that code is only reached
      for the board-default FDC.

      The pc_cmos_init_late() one-shot reset handler -- one-shot because the
      CMOS is not reprogrammed during warm reset -- should search for any ISA
      FDC devices, created implicitly (by board code) or explicitly, and set the
      CMOS accordingly to the ISA FDC(s) with iobase=0x3f0:

      - if there is no such FDC, report both drives absent,
      - if there is exactly one such FDC, report its drives in the CMOS,
      - if there are more than one such FDCs, then pick one (it is not specified
        which one), and print a warning about the ambiguity.

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Reported-by: Jan Tomko <jtomko@redhat.com>
      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7444ca4ee2382170774ae201c473270d65620d75
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:05 2015 +0200

      hw/i386/pc: factor out pc_cmos_init_floppy()

      Extract the pc_cmos_init_floppy() function from pc_cmos_init(). The
      function sets two RTC registers: floppy drive types (0x10), overwriting
      the earlier value in there), and REG_EQUIPMENT_BYTE (0x14), setting bits
      in the prior value.

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5add35bec1e249bb5345a47008c8f298d4760be4
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:58 2015 -0300

      ich9: implement strap SPKR pin logic

      If the signal is sampled high, this indicates that the system is
      strapped to the "No Reboot" mode (ICH9 will disable the TCO Timer system
      reboot feature). The status of this strap is readable via the NO_REBOOT
      bit (CC: offset 0x3410:bit 5).

      The NO_REBOOT bit is set when SPKR pin on ICH9 is sampled high. This bit
      may be set or cleared by software if the strap is sampled low but may
      not override the strap when it indicates "No Reboot".

      This patch implements the logic where hardware has ability to set SPKR
      pin through a property named "noreboot" and it's sampled high by
      default.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 45dcdb9da632b5a5e7639707e12b1b17029c5a1e
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:57 2015 -0300

      tests: add testcase for TCO watchdog emulation

      This patch adds a testcase that covers the following:
        1) TCO default values
        2) first and second TCO timeout
        3) watch and validate ticks counter through TCO_RLD register
        4) maximum supported TCO timeout (0x3ff)
        5) watchdog actions (pause/reset/shutdown/none) upon second TCO
           timeout
        6) set and get of TCO control and status bits

      MST: The test does not pass yet, so it's disabled by default.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c54e1eb4928d4e6762c7100d1d1ef5f08ddf922b
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Jul 7 19:12:18 2015 -0500

      qga: added GuestPCIAddress information

      PCIAddress inforfation is obtained via SetupApi, which provides the
      information about address, bus, etc. We look throught entire device tree
      in the system and try to find device object for given volume. For this PDO
      SetupDiGetDeviceRegistryProperty is called, which reads PCI configuration
      for a given devicei if it is possible.

      This is the most convinient way for a userspace service. The lookup is
      performed for every volume available. However, this information is
      not mandatory for vss-provider.

      In order to use SetupApi we need to notify linker about it. We do not need
      to install additional libs, so we do not make separate configuration
      option to use libsetupapi.su

      SetupApi gives as the same information as kernel driver
      with IRP_MN_QUERY_INTERFACE.
      https://support.microsoft.com/en-us/kb/253232

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      * stub out get_pci_info if !CONFIG_QGA_NTDDSCSI
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a3ef3b2272d8349c932f8c440bcaa31d8518b1c0
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:22 2015 +0300

      qga: added bus type and disk location path

      According to Microsoft disk location path can be obtained via
      IOCTL_SCSI_GET_ADDRESS. Unfortunately this ioctl can not be used for all
      devices. There are certain bus types which could be obtained with this
      API. Please, refer to the following link for more details
      https://technet.microsoft.com/en-us/library/ee851589(v=ws.10).aspx

      Bus type could be obtained using IOCTL_STORAGE_QUERY_PROPERTY. Enum
      STORAGE_BUS_TYPE describes all buses supported by OS.

      Windows defines more bus types than Linux. Thus some values have been added
      to GuestDiskBusType.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      * fixed warning in CreateFile due to use of NULL instead of 0
      * only provide disk info when CONFIG_QGA_NTDDSCSI=y
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 50cbebb9a339f43cda2005785010361497151882
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Jul 7 18:10:09 2015 -0500

      configure: add configure check for ntdddisk.h

      This header file provides w32 ioctl definitions for working with disk
      devices. Older versions of mingw do not expose this in a useable way,
      so add a configure check and report it via CONFIG_QGA_NTDDSCSI.

      Subsequent patches will use this macro to stub out functionality that
      relies on this in cases where it's not available.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d2b3f390d4e4b5d9dd74ae703d365a7b75a234ea
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:21 2015 +0300

      qga: added mountpoint and filesystem type for single volume

      We should use GetVolumeXXX api to work with volumes. This will help us to
      resolve the situation with volumes without drive letter, i.e. when the
      volume is mounted as a folder. Such volume is called mounted folder.
      This volume is a regular mounted volume from all other points of view.
      The information about non mounted volume is reported as System Reserved.
      This volume is not mounted and thus it is not writable.

      GuestDiskAddressList API is not used because operations are performed with
      volumes but no with disks. This means that spanned disk will
      be counted and handled as a single volume. It is worth mentioning
      that the information about every disk in the volume can be queried
      via IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit ef0a03f23061b9994fe5b2c3a208bc9fcba0099d
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:20 2015 +0300

      qga: added empty qmp_quest_get_fsinfo functionality.

      We need qmp_quest_get_fsinfo togather with vss-provider, which works with
      volumes. The call to this function is implemented via
      FindFirst/NextVolumes. Moreover, volumes in Windows OS are filesystem unit,
      so it will be more effective to work with them rather with devices.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 00d2f3707a63881a0cec8d00cbd467f9b2d8af41
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Sun Jul 5 16:28:58 2015 +0200

      qga: fail early for invalid time

      It's possible to set system time with dates after 2070, however, it's
      not possible to set the RTC. It has limitation to up to year
      2070 (1970+100). In order to keep both clock in sync and before the
      kernel complains on invalid values, bail out early.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d6c5528b0ce91667714b8c7dabaf4fbf8a898a9c
  Author: Kirk Allan <kallan@suse.com>
  Date:   Tue Jun 2 11:41:07 2015 -0600

      qga: win32 qmp_guest_network_get_interfaces implementation

      By default, IPv4 prefixes will be derived by matching the address
      to those returned by GetAdaptersInfo.  IPv6 prefixes can not be
      matched this way due to the unpredictable order of entries.

      In Windows Vista/2008 guests and newer, both IPv4 and IPv6 prefixes
      can be retrieved from OnLinkPrefixLength.  Setting --extra-cflags
      in the build configuration to "-D_WIN32_WINNT=0x600"
      or greater makes OnLinkPrefixLength available.  Setting --extra-cflags
      is not required and if not set, the default approach to get the prefix
      will be taken.

      Signed-off-by: Kirk Allan <kallan@suse.com>
      * drop ws2ipdef.h, it's missing on old mingw, and ws2tcpip.h already
        includes it automatically on new builds
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 601e5a0618ef3238e18fc38ece55ea4260910d5f
  Author: Kirk Allan <kallan@suse.com>
  Date:   Tue Jun 2 11:41:06 2015 -0600

      qga: add win32 library iphlpapi

      Add the iphlpapi library to use APIs such as GetAdaptersInfo and
      GetAdaptersAddresses.

      Signed-off-by: Kirk Allan <kallan@suse.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f300414cfe9bb9e7b86411a670b68c1aa8edbd35
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 27 19:53:49 2015 +0200

      Revert "guest agent: remove g_strcmp0 usage"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_strcmp0() anymore.

      This reverts commit 8f4774789947bc4bc4c8d026a289fe980d3d2ee1.

      Conflicts:
      	qemu-ga.c

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit e82855d9aa4580620773b1b145ecab6ca1f2578c
  Author: Justin Ossevoort <justin@quarantainenet.nl>
  Date:   Mon May 11 08:58:45 2015 +0200

      qga/qmp_guest_fstrim: Return per path fstrim result

      The current guest-fstrim support only returns an error if some
      mountpoint was unable to be trimmed, skipping any possible additional
      mountpoints. The result of the TRIM operation itself is also discarded.

      This change returns a per mountpoint result of the TRIM operation. If an
      error occurs on some mountpoints that error is returned and the
      guest-fstrim continue with any additional mountpoints.

      The returned values for errors, minimum and trimmed are dependant on the
      filesystem, storage stacks and kernel version.

      Signed-off-by: Justin Ossevoort <justin@quarantainenet.nl>
      * s/type/struct/ in schema type definitions
      * moved version annotation for new guest-fstrim return field to
        the field itself rather than applying to the entire command
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 73a652a1b08445e8d91e50cdbb2da50e571c61b3
  Author: Justin Ossevoort <justin@quarantainenet.nl>
  Date:   Mon May 11 08:58:44 2015 +0200

      qga/commands-posix: Fix bug in guest-fstrim

      The FITRIM ioctl updates the fstrim_range structure it receives. This
      way the caller can determine how many bytes were trimmed. The
      guest-fstrim logic reuses the same fstrim_range for each filesystem,
      effectively limiting each filesystem to trim at most as much as the
      previous was able to trim.

      If a previous filesystem would have trimmed 0 bytes, than the next
      filesystem would report an error 'Invalid argument' because a FITRIM
      request with length 0 is not valid.

      This change resets the fstrim_range structure for each filesystem.

      Signed-off-by: Justin Ossevoort <justin@quarantainenet.nl>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 59dc0a1e9b4ccd9d8d7366fdc31acd5c1fbb240a
  Merge: 7ce0f7d cd3b29b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 23:16:42 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-07-07

      A few last minute fixes for 2.4. All of them are s390 TCG bug fixes.

      # gpg: Signature made Tue Jul  7 16:52:22 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream:
        tcg/s390: fix branch target change during code retranslation
        target-s390x: fix CONVERT TO BINARY (CVD, CVDY)
        target-s390x: fix EXECUTE instruction executing TRT
        target-s390x: fix MOVE LONG instruction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ce0f7dc87e50ebf58ac756ff6be17ec97d3ba4e
  Merge: 1a63203 6319b1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 21:16:06 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-07-07

      A few last minute PPC changes for 2.4:

        - spapr: Update SLOF
        - spapr: Fix a few bugs
        - spapr: Preparation for hotplug
        - spapr: Minor code cleanups
        - linux-user: Add mftb handling
        - kvm: Enable hugepage support with memory-backend-file
        - mac99: Remove nonexistent interrupt pin (Mac OS 9 fix)

      # gpg: Signature made Tue Jul  7 16:48:41 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (30 commits)
        sPAPR: Clear stale MSIx table during EEH reset
        sPAPR: Reenable EEH functionality on reboot
        sPAPR: Don't enable EEH on emulated PCI devices
        spapr-vty: Use TYPE_ definition instead of hardcoding
        spapr_vty: lookup should only return valid VTY objects
        spapr_pci: drop redundant args in spapr_[populate, create]_pci_child_dt
        spapr_pci: populate ibm,loc-code
        spapr_pci: enumerate and add PCI device tree
        xics_kvm: Don't enable KVM_CAP_IRQ_XICS if already enabled
        ppc: Update cpu_model in MachineState
        spapr: Consolidate cpu init code into a routine
        spapr: Reorganize CPU dt generation code
        cpus: Add a macro to walk CPUs in reverse
        spapr: Support ibm, lrdr-capacity device tree property
        spapr: Consider max_cpus during xics initialization
        Revert "hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*)"
        spapr_iommu: translate sPAPRTCEAccess to IOMMUAccessFlags
        spapr_iommu: drop erroneous check in h_put_tce_indirect()
        spapr_pci: set device node unit address as hex
        spapr_pci: encode class code including Prog IF register
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a632032d1ea09a09dc424ac2b10a4a11cd52ab9
  Merge: 30c6672 06ef227
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 20:12:55 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-07-07

      Patch "target-i386: emulate CPUID level of real hardware" was removed after the
      2015-07-03 pull request.

      # gpg: Signature made Tue Jul  7 15:46:23 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: avoid overflow in the tsc-frequency property
        i386: Introduce ARAT CPU feature

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 30c6672aa4b4bc9bdba3a7e46c49bba191660143
  Merge: 9861b71 9703116
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 19:12:45 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      v2:
       * Drop block/nfs patch since it exposes an unfinished QAPI interface [kwolf]

      # gpg: Signature made Tue Jul  7 14:29:47 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        blockjob: add block_job_release function
        block/raw-posix: Don't think /dev/fd/<NN> is a floppy drive.
        block: Use bdrv_drain to replace uncessary bdrv_drain_all
        block: Initialize local_err in bdrv_append_temp_snapshot
        block: update bdrv_drain_all()/bdrv_drain() comments
        qcow2: remove unnecessary check

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9861b71fd63f04175fddd1e93a417bae4a7808d7
  Merge: f2562fb dd63169
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 17:19:59 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150707' into staging

      migration/next for 20150707

      # gpg: Signature made Tue Jul  7 13:56:30 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150707: (28 commits)
        migration: extend migration_bitmap
        migration: protect migration_bitmap
        check_section_footers: Check the correct section_id
        migration: Add migration events on target side
        migration: Make events a capability
        migration: create migration event
        migration: No need to call trace_migrate_set_state()
        migration: Use always helper to set state
        migration: ensure we start in NONE state
        migration: Use cmpxchg correctly
        migration: Add configuration section
        vmstate: Create optional sections
        global_state: Make section optional
        migration: create new section to store global state
        runstate: migration allows more transitions now
        runstate: Add runstate store
        Fix older machine type compatibility on power with section footers
        Fail more cleanly in mismatched RAM cases
        Sanity check RDMA remote data
        Sort destination RAMBlocks to be the same as the source
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cd3b29b745b0ff393b2d37317837bc726b8dacc8
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jun 16 07:11:41 2015 +0200

      tcg/s390: fix branch target change during code retranslation

      Make sure to not modify the branch target. This ensure that the
      branch target is not corrupted during partial retranslation.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Tested-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 92f2b4e71e988ad2751c71717e9fe3387753442a
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 25 21:16:58 2015 +0200

      target-s390x: fix CONVERT TO BINARY (CVD, CVDY)

      current_number being shift left by more than 32 bits, we can't use a
      simple int. Similarly use an int64_t type for the input binary value,
      to not get the -2^31 case wrong. Finally don't initialize shift to 4,
      it's already done in the for loop.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c9c19b493286db7358f9ee26401b927bbbd21604
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Jun 21 18:51:08 2015 +0200

      target-s390x: fix EXECUTE instruction executing TRT

      A break is missing in the EXECUTE instruction, when executing the
      TRANSLATE AND TEST instruction.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-By: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b5edcddda31b464e73cc0a79e88457e603c3b247
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jun 16 22:57:47 2015 +0200

      target-s390x: fix MOVE LONG instruction

      The MOVE LONG instruction should pad the destination operand with the
      byte from bit positions 32-39 of the source length (r2 + 1), not with
      the same byte in the source address.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6319b1dad04e66f450fb3ac6c31d2bf3940068b8
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:28 2015 +1000

      sPAPR: Clear stale MSIx table during EEH reset

      The PCI device MSIx table is cleaned out in hardware after EEH PE
      reset. However, we still hold the stale MSIx entries in QEMU, which
      should be cleared accordingly. Otherwise, we will run into another
      (recursive) EEH error and the PCI devices contained in the PE have
      to be offlined exceptionally.

      The patch introduces function spapr_phb_vfio_eeh_pre_reset(), which
      is called by sPAPR when asserting hot or fundamental reset, to clear
      stale MSIx table for VFIO PCI devices before EEH PE reset so that
      MSIx table could be restored properly after EEH PE reset.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aef87d1b879416909a4ac73e6fe2cea4a5630f40
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:27 2015 +1000

      sPAPR: Reenable EEH functionality on reboot

      When rebooting the guest, some PEs might be in frozen state. The
      contained PCI devices won't work properly if their frozen states
      aren't cleared in time. One case running into this situation would
      be maximal EEH error times encountered in the guest.

      The patch reenables the EEH functinality on PEs on PHB's reset
      callback, which will clear their frozen states if needed.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7cb180079e245024cf92ca218ca58858b679a7d6
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:26 2015 +1000

      sPAPR: Don't enable EEH on emulated PCI devices

      There might have emulated PCI devices, together with VFIO PCI
      devices under one PHB. The EEH capability shouldn't enabled
      on emulated PCI devices.

      The patch returns error when enabling EEH capability on emulated
      PCI devices by RTAS call "ibm,set-eeh-option".

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e275934d2dd44e38e0c6d53f9c22383d2ba57c17
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:25 2015 +1000

      spapr-vty: Use TYPE_ definition instead of hardcoding

      There's a call to object_dynamic_cast() in spapr_vty which uses the type
      name "spapr-vty" directly, instead of the usual idiom of using the #defined
      TYPE_VIO_SPAPR_VTY_DEVICE.  Fix it.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0f888bfaddfc5f55b0d82cde2e1164658a672375
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:24 2015 +1000

      spapr_vty: lookup should only return valid VTY objects

      If a guest passes the reg property of a valid VIO object that is not a VTY
      to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
      assertion and aborts.

      PAPR+ says "Hypervisor checks the termno parameter for validity against the
      Vterm IOA unit addresses assigned to the partition, else return H_Parameter."

      This patch adds a type check to ensure vty_lookup() either returns a pointer
      to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
      now return H_PARAMETER to the guest instead of crashing.

      The patch has no effect on the reg == 0 hack used to implement the RTAS call
      display-character.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e634b89c6ed2309814de7a89bd7c5ced96f59291
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:23 2015 +1000

      spapr_pci: drop redundant args in spapr_[populate, create]_pci_child_dt

      * phb_index is not being used and if required can be obtained from sphb
      * use helper to get drc_index in spapr_populate_pci_child_dt()
      * Check if drc_index is zero

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 16b0ea1d852873cf17630133d86df6a68e23f38c
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:22 2015 +1000

      spapr_pci: populate ibm,loc-code

      Each hardware instance has a platform unique location code.  The OF
      device tree that describes a part of a hardware entity must include
      the “ibm,loc-code” property with a value that represents the location
      code for that hardware entity.

      Populate ibm,loc-code.

      1) PCI passthru devices need to identify with its own ibm,loc-code
         available on the host. In failure cases use:
         vfio_<name>:<phb-index>:<bus>:<slot>.<fn>

      2) Emulated devices encode as following:
         qemu_<name>:<phb-index>:<bus>:<slot>.<fn>

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1d2d974244c6f1629ca83f1de293eaa557634627
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:21 2015 +1000

      spapr_pci: enumerate and add PCI device tree

      All the PCI enumeration and device node creation was off-loaded to
      SLOF. With PCI hotplug support, code needed to be added to add device
      node. This creates multiple copy of the code one in SLOF and other in
      hotplug code. To unify this, the patch adds the pci device node
      creation in Qemu. For backward compatibility, a flag
      "qemu,phb-enumerated" is added to the phb, suggesting to SLOF to not
      do device node creation.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      [ Squashed Michael's drc_index changes ]
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a45863bda90daa8ec39e5a312b9734fd4665b016
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:20 2015 +1000

      xics_kvm: Don't enable KVM_CAP_IRQ_XICS if already enabled

      When supporting CPU hot removal by parking the vCPU fd and reusing
      it during hotplug again, there can be cases where we try to reenable
      KVM_CAP_IRQ_XICS CAP for the vCPU for which it was already enabled.
      Introduce a boolean member in ICPState to track this and don't
      reenable the CAP if it was already enabled earlier.

      Re-enabling this CAP should ideally work, but currently it results in
      kernel trying to create and associate ICP with this vCPU and that
      fails since there is already an ICP associated with it. Hence this
      patch is needed to work around this problem in the kernel.

      This change allows CPU hot removal to work for sPAPR.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 19fb2c36e2475a2c68e7287e0e089d858dd7cc50
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:19 2015 +1000

      ppc: Update cpu_model in MachineState

      Keep cpu_model field in MachineState uptodate so that it can be used
      from the CPU hotplug path.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bab99ea09897fb65255cc4e147d87c077fafcfe6
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:18 2015 +1000

      spapr: Consolidate cpu init code into a routine

      Factor out bits of sPAPR specific CPU initialization code into
      a separate routine so that it can be called from CPU hotplug
      path too.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0da6f3fef9ae52127c14dfad1fdf1781e33ec5ec
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:17 2015 +1000

      spapr: Reorganize CPU dt generation code

      Reorganize CPU device tree generation code so that it be reused from
      hotplug path. CPU dt entries are now generated from spapr_finalize_fdt()
      instead of spapr_create_fdt_skel().

      Note: This is how the split-up looks like now:

      Boot path
      ---------
      spapr_finalize_fdt
       spapr_populate_cpus_dt_node
        spapr_populate_cpu_dt
         spapr_fixup_cpu_numa_dt
         spapr_fixup_cpu_smt_dt

      ibm,cas path
      ------------
      spapr_h_cas_compose_response
       spapr_fixup_cpu_dt
        spapr_fixup_cpu_numa_dt
        spapr_fixup_cpu_smt_dt

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8487d1231830917099c801e4f2f0e698e8535063
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:16 2015 +1000

      cpus: Add a macro to walk CPUs in reverse

      Add CPU_FOREACH_REVERSE that walks CPUs in reverse.

      Needed for PowerPC CPU device tree reorganization.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit db4ef288f4a6d285b39dc8ac477092d76971a300
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:15 2015 +1000

      spapr: Support ibm, lrdr-capacity device tree property

      Add support for ibm,lrdr-capacity since this is needed by the guest
      kernel to know about the possible hot-pluggable CPUs and Memory. With
      this, pseries kernels will start reporting correct maxcpus in
      /sys/devices/system/cpu/possible.

      Also define the minimum hotpluggable memory size as 256MB.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      [agraf: Fix compile error on 32bit hosts]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9e734e3deefd460188ea9bd107b65a528ccb7255
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:14 2015 +1000

      spapr: Consider max_cpus during xics initialization

      Use max_cpus instead of smp_cpus when intializating xics system. Also
      report max_cpus in ibm,interrupt-server-ranges device tree property of
      interrupt controller node.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 708414f03c3bebbd7ba8e4e98fb92602d2af8d0c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jul 2 16:23:13 2015 +1000

      Revert "hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*)"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_hash_table_iter_init() & friends anymore.

      This reverts commit f8833a37c0c6b22ddd57b45e48cfb0f97dbd5af4.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5709af3b9520c6912fc909128ae284512b127600
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:12 2015 +1000

      spapr_iommu: translate sPAPRTCEAccess to IOMMUAccessFlags

      The fact that these enums have matching values is pure coincidence. We
      actually need to translate from the PAPR definition to the QEMU one.

      This patch doesn't fix any bug, it is only code cleanup.

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4d9ab7d4ed46c63d047862d11946996005742a09
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:11 2015 +1000

      spapr_iommu: drop erroneous check in h_put_tce_indirect()

      The tce_list variable is not a TCE but the address to a TCE: we shouldn't
      clear permission bits as we do now. And this is dead code anyway since we
      check tce_list is 4K aligned a few lines above.

      This patch doesn't fix any bug, it is only code cleanup.

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9b7d9284c3b114112a7759ce0a885df0767fe8d9
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:10 2015 +1000

      spapr_pci: set device node unit address as hex

      Device node names should encode the unit address as hex, while the
      code was encodind it as integers.

      Also, use FDT_NAME_MAX macro for allocating and composing the name.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4a7c34741584e91aa838a9e45b8ec5cdc65a343b
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:09 2015 +1000

      spapr_pci: encode class code including Prog IF register

      Current code missed the Prog IF register. All Class Code, Subclass,
      and Prog IF registers are needed to identify the accurate device type.

      For example: USB controllers use the PROG IF for denoting: USB
      FullSpeed, HighSpeed or SuperSpeed.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 72187935b475454792512d44782a33f112b120e6
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:08 2015 +1000

      spapr_pci: encode missing 64-bit memory address space

      The properties reg/assigned-resources need to encode 64-bit memory
      address space as part of phys.hi dword.

        00 if configuration space
        01 if IO region,
        10 if 32-bit MEM region
        11 if 64-bit MEM region

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 183930c0d753e53d22c27d573b1803b04f8d68ac
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:07 2015 +1000

      spapr: Add sPAPRMachineClass

      Currently although we have an sPAPRMachineState descended from MachineState
      we don't have an sPAPRMAchineClass descended from MachineClass.  So far it
      hasn't been needed, but several upcoming features are going to want it,
      so this patch creates a stub implementation.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1b71890729953825c57d52ace48a7671c295e899
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:06 2015 +1000

      spapr: Remove obsolete entry_point field from sPAPRMachineState

      The sPAPRMachineState structure includes an entry_point field containing
      the initial PC value for starting the machine, even though this always has
      the value 0x100.

      I think this is a hangover from very early versions which bypassed the
      firmware when using -kernel.  In any case it has no function now, so remove
      it.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fb16499418aa7d71d2a4f2e3d79de444c4d054c0
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:05 2015 +1000

      spapr: Remove obsolete ram_limit field from sPAPRMachineState

      The ram_limit field was imported from sPAPREnvironment where it predates
      the machine's ram size being available generically from machine->ram_size.

      Worse, the existing code was inconsistent about where it got the ram size
      from.  Sometimes it used spapr->ram_limit, sometimes the global 'ram_size'
      and sometimes a local 'ram_size' masking the global.

      This cleans up the code to consistently use machine->ram_size, eliminating
      spapr->ram_limit in the process.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28e0204254c3f03e77106056a3a5730c4b8a2ac6
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:04 2015 +1000

      spapr: Merge sPAPREnvironment into sPAPRMachineState

      The code for -machine pseries maintains a global sPAPREnvironment structure
      which keeps track of general state information about the guest platform.
      This predates the existence of the MachineState structure, but performs
      basically the same function.

      Now that we have the generic MachineState, fold sPAPREnvironment into
      sPAPRMachineState, the pseries specific subclass of MachineState.

      This is mostly a matter of search and replace, although a few places which
      relied on the global spapr variable are changed to find the structure via
      qdev_get_machine().

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 780184aae65d72378737e9cdb8fb61b0121e1e21
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu Jul 2 16:23:03 2015 +1000

      pseries: Update SLOF firmware image to qemu-slof-20150429

      The changelog is:
        > version: update to 20150429
        > pci: Use QEMU created PCI device nodes
        > usb: support 64-bit pci bars
        > pci: Support 64-bit address translation
        > pci: program correct bridge limit registers during probe
        > scsi: handle report-luns failure
        > Fix "key?" Forth word when using USB keyboards
        > Remove bulk.fs package
        > Include make.rules in the library Makefiles

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f303f117fec32c0705f88860e3eadf94135211c9
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:02 2015 +1000

      spapr: ensure we have at least one XICS server

      XICS needs to know the upper value for cpu_index as it is used to compute
      the number of servers:

          smp_cpus * kvmppc_smt_threads() / smp_threads

      When passing -smp cpus=1,threads=9 on a POWER8 host, we end up with:

          1 * 8 / 9 = 0

      ... which leads to an assertion in both emulated:

      Number of servers needs to be greater 0
      Aborted (core dumped)

      ... and in-kernel XICS:

      xics_kvm_realize: Assertion `icp->nr_servers' failed.
      Aborted (core dumped)

      With this patch, we are sure that nr_servers > 0. Passing the same bogus
      -smp option then leads to:

      qemu-system-ppc64: Cannot support more than 8 threads on PPC with KVM

      ... which is a lot more explicit than the XICS errors.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2d103aae876518a91636ad6f4a4d866269c0d953
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu Jul 2 15:46:14 2015 -0500

      target-ppc: fix hugepage support when using memory-backend-file

      Current PPC code relies on -mem-path being used in order for
      hugepage support to be detected. With the introduction of
      MemoryBackendFile we can now handle this via:
        -object memory-file-backend,mem-path=...,id=hugemem0 \
        -numa node,id=mem0,memdev=hugemem0

      Management tools like libvirt treat the 2 approaches as
      interchangeable in some cases, which can lead to user-visible
      regressions even for previously supported guest configurations.

      Fix these by also iterating through any configured memory
      backends that may be backed by hugepages.

      Since the old code assumed hugepages always backed the entirety
      of guest memory, play it safe an pick the minimum across the
      max pages sizes for all backends, even ones that aren't backed
      by hugepages.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5c464f66f5696724c892339de242fac41f4d57a6
  Author: Cormac O'Brien <i.am.cormac.obrien@gmail.com>
  Date:   Wed Jun 17 17:04:11 2015 -0500

      macio: remove nonexistent interrupt on pin 1

      The current macio implementation declares an interrupt that doesn't appear to
      exist in the hardware or any other emulator implementation. OpenBIOS detects
      this interrupt and generates an 'interrupts' property in the macio device tree
      entry. Mac OS 9 halts boot when it detects this interrupt, so it has been
      removed to permit further progress in the boot process.

      Signed-off-by: Cormac O'Brien <i.am.cormac.obrien@gmail.com>
      Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7d6b1daedd00b35e50ce87ea835f662b36a23160
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Tue Jun 30 11:49:54 2015 +0200

      linux-user, ppc: mftbl can be used by user application

      In qemu-linux-user, when calling gethostbyname2(),
      it was hanging in .__res_nmkquery.

      (gdb) bt
      0 in .__res_nmkquery () from /lib64/libresolv.so.2
      1 in .__libc_res_nquery () from /lib64/libresolv.so.2
      2 in .__libc_res_nsearch () from /lib64/libresolv.so.2
      3 in ._nss_dns_gethostbyname3_r () from /lib64/libnss_dns.so.2
      4 in ._nss_dns_gethostbyname2_r () from /lib64/libnss_dns.so.2
      5 in .gethostbyname2_r () from /lib64/libc.so.6
      6 in .gethostbyname2 () from /lib64/libc.so.6

      .__res_nmkquery() is:

      ...
      do { RANDOM_BITS (randombits); } while ((randombits & 0xffff) == 0);
      ...

      <.__res_nmkquery+112>:	mftbl   r11
      <.__res_nmkquery+116>:	clrlwi  r10,r11,16
      <.__res_nmkquery+120>:	cmpwi   cr7,r10,0
      <.__res_nmkquery+124>:	beq     cr7,<.__res_nmkquery+112>

      but as mftbl (Move From Time Base Lower) is not implemented,
      r11 is always 0, so we have an infinite loop.

      This patch fills the Time Base register with cpu_get_real_ticks().

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f2562fbb7ac54d597cfe05f613d30296d1850d1b
  Merge: aeb7218 849729b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 15:48:49 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Tue Jul  7 13:38:13 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        rocker: tests: don't need to specify master/self when setting vlans
        rocker: mark copy-to-cpu pkts as forwarding offloaded
        rocker: return -1 when dropping packet on ingress
        rocker: fix missing break statements
        rocker: fix misplaced break statement
        rocker: don't queue receive pkts when port is disabled
        vmxnet3: Fix incorrect small packet padding
        e1000: flush packets when link comes up
        rocker: fix memory leak

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06ef227e5158cca6710e6c268d6a7f65a5e2811b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 24 14:11:27 2015 +0200

      target-i386: avoid overflow in the tsc-frequency property

      The TSC frequency fits comfortably in an int when expressed in kHz,
      but it may overflow when converted to Hz.  In this case,
      tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
      does a 32-bit multiplication before assigning to int64_t.

      For simplicity just make tsc_khz a 64-bit value.

      Spotted by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 28b8e4d0bf93ba176b4b7be819d537383c5a9060
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Jun 7 11:15:08 2015 +0200

      i386: Introduce ARAT CPU feature

      ARAT signals that the APIC timer does not stop in power saving states.
      As our APICs are emulated, it's fine to expose this feature to guests,
      at least when asking for KVM host features or with CPU types that
      include the flag. The exact model number that introduced the feature is
      not known, but reports can be found that it's at least available since
      Sandy Bridge.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit aeb72188e073d515e1f5a80f6b603692a396477b
  Merge: 1452673 501eea4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 14:44:19 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150707-1' into staging

      virtio-gpu property fixes, add testcase

      # gpg: Signature made Tue Jul  7 10:24:16 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150707-1:
        virtio-gpu: add to display-vga test
        virtio-gpu: use virtio_instance_init_common, fixup properties
        virtio-gpu: update console device property.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 970311646a701eecb103eb28093e8924d2fa6861
  Author: Ting Wang <kathy.wangting@huawei.com>
  Date:   Fri Jun 26 17:37:35 2015 +0800

      blockjob: add block_job_release function

      There is job resource leak in function mirror_start_job,
      although bdrv_create_dirty_bitmap is unlikely failed.
      Add block_job_release for each release when needed.

      Signed-off-by: Ting Wang <kathy.wangting@huawei.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1435311455-56048-1-git-send-email-kathy.wangting@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 25d9747b6427de8253221d544b45e50888d4cef7
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 1 15:40:14 2015 +0100

      block/raw-posix: Don't think /dev/fd/<NN> is a floppy drive.

      In libguestfs we use /dev/fd/<NN> to pass pre-opened file descriptors
      to qemu-img.  Lately I've discovered that although this works, qemu
      believes that these are floppy disk images.  That in itself isn't much
      of a problem, but now qemu prints a warning about host floppy
      pass-thru being deprecated.

      Extend the existing test so that it ignores /dev/fd/ as well as
      /dev/fdset/

      A simple test of this, if you are using the bash shell, is:

        qemu-img info <( cat /dev/null )

      without this patch:

        $ qemu-img info <( cat /dev/null )
        qemu-img: Host floppy pass-through is deprecated
        Support for it will be removed in a future release.
        qemu-img: Could not open '/dev/fd/63': Could not refresh total sector count: Illegal seek

      with this patch:

        $ qemu-img info <( cat /dev/null )
        qemu-img: Could not open '/dev/fd/63': Could not refresh total sector count: Illegal seek

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1435761614-31358-1-git-send-email-rjones@redhat.com
      Fixes: https://bugs.launchpad.net/qemu/+bug/1470536
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 53ec73e264f481b79b52efcadc9ceb8f8996975c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 29 18:53:14 2015 +0800

      block: Use bdrv_drain to replace uncessary bdrv_drain_all

      There callers work on a single BlockDriverState subtree, where using
      bdrv_drain() is more accurate.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c2e0dbbfd7265eb9a7170ab195d8f9f8a1cbd1af
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jul 6 12:24:44 2015 +0800

      block: Initialize local_err in bdrv_append_temp_snapshot

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436156684-16526-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd63169766abd2b8dc33f4451dac5e778458a47c
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   Thu Jul 2 20:18:06 2015 +0800

      migration: extend migration_bitmap

      Prevously, if we hotplug a device(e.g. device_add e1000) during
      migration is processing in source side, qemu will add a new ram
      block but migration_bitmap is not extended.
      In this case, migration_bitmap will overflow and lead qemu abort
      unexpectedly.

      Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 2ff64038a59e8de2baa485806be0838f49f70b79
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   Thu Jul 2 20:18:05 2015 +0800

      migration: protect migration_bitmap

      Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 59f39a47411ab6007a592555dc639aa9753f8d23
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jul 2 09:22:03 2015 +0100

      check_section_footers: Check the correct section_id

      The section footers check was incorrectly checking the section_id
      in the SaveStateEntry not the LoadStateEntry.  These can validly be different
      if the two QEMU instances have instantiated their devices in a
      different order.  The test only cares that we're finishing the same
      section we started, and hence it's the LoadStateEntry that we care about.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7cf1fe6d68eb2ad3b77e2a89f097354db5d627e2
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 17:15:42 2015 +0200

      migration: Add migration events on target side

      We reuse the migration events from the source side, sending them on the
      appropiate place.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit b05dc72342b27585909d9e99d95d17fd3dfbb269
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Jul 7 14:44:05 2015 +0200

      migration: Make events a capability

      Make check fails with events.  THis is due to the parser/lexer that it
      uses.  Just in case that they are more broken parsers, just only send
      events when there are capabilities.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 598cd2bda0845096d2f06500e45b4d0d399b384a
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 12:16:15 2015 +0200

      migration: create migration event

      We have one argument that tells us what event has happened.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f2bb932491185a39922dff0514c4b08c092f3c35
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 01:38:25 2015 +0200

      migration: No need to call trace_migrate_set_state()

      We now use the helper everywhere, so no need to call this on this two
      places.  See on previous commit that there were a place where we missed
      to mark the trace.  Now all tracing is done in migrate_set_state().

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 7844337d1efb2c47dc3f306d7621e1cafca8ba67
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 01:36:40 2015 +0200

      migration: Use always helper to set state

      There were three places that were not using the migrate_set_state()
      helper, just fix that.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 656a233440e552230f9d1da016b94a81b86658dc
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 1 09:32:29 2015 +0200

      migration: ensure we start in NONE state

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit a5c17b5f68ff7e37ce6e6e1f5457307fe07629e7
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 02:06:20 2015 +0200

      migration: Use cmpxchg correctly

      cmpxchg returns the old value

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 61964c23e5ddd5a33f15699e45ce126f879e3e33
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 13 18:17:43 2015 +0200

      migration: Add configuration section

      It needs to be the first one and it is not optional, that is the reason
      why it is opencoded.  For new machine types, it is required that machine
      type name is the same in both sides.

      It is just done right now for pc's.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit df8961522a3d6bc7bb60c2830ef59e7c6c67a928
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 15 09:39:14 2014 +0200

      vmstate: Create optional sections

      To make sections optional, we need to do it at the beggining of the code.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 13d16814d2058f10461e6987c8216950389c1310
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 13:58:24 2014 +0200

      global_state: Make section optional

      This section would be sent:

      a- for all new machine types
      b- for old machine types if section state is different form {running,paused}
         that were the only giving us troubles.

      So, in new qemus: it is alwasy there.  In old qemus: they are only
      there if it an error has happened, basically stoping on target.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit df4b1024526cae3479da3492d6371fd4a7324a03
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 10:58:10 2014 +0200

      migration: create new section to store global state

      This includes a new section that for now just stores the current qemu state.

      Right now, there are only one way to control what is the state of the
      target after migration.

      - If you run the target qemu with -S, it would start stopped.
      - If you run the target qemu without -S, it would run just after migration finishes.

      The problem here is what happens if we start the target without -S and
      there happens one error during migration that puts current state as
      -EIO.  Migration would ends (notice that the error happend doing block
      IO, network IO, i.e. nothing related with migration), and when
      migration finish, we would just "continue" running on destination,
      probably hanging the guest/corruption data, whatever.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit ca3fc39ea9045188e37b84c4f92ee79c7ed4b1c3
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 12:47:08 2014 +0200

      runstate: migration allows more transitions now

      Next commit would allow to move from incoming migration to error happening on source.

      Should we add more states to this transition?  Luiz?

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 5e0f1940caf49f56e3bee123aa92e42a3f7fad20
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 11:53:22 2014 +0200

      runstate: Add runstate store

      This allows us to store the current state to send it through migration.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit ff14e817f6c5f110b77e22185b256a17a96aa881
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Jun 12 18:37:52 2015 +0100

      Fix older machine type compatibility on power with section footers

      I forgot to add compatibility for Power when adding section footers.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

      Fixes: 37fb569c0198cba58e3e
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit ef4b722d19cab845eaa0d1f912018b09a9d8288b
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:28 2015 +0100

      Fail more cleanly in mismatched RAM cases

      If the number of RAMBlocks was different on the source from the
      destination, QEMU would hang waiting for a disconnect on the source
      and wouldn't release from that hang until the destination was manually
      killed.

      Mark the stream as being in error, this causes the destination to die
      and the source to carry on.

      (It still gets a whole bunch of warnings on the destination, and I've
      not managed to complete another migration after the 1st one, still
      progress).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit afcddefdbe75d0c20bf6e11b5512ba768ce0700c
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:27 2015 +0100

      Sanity check RDMA remote data

      Perform some basic (but probably not complete) sanity checking on
      requests from the RDMA source.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e4d633207c129dc5b7d145240ac4a1997ef3902f
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:26 2015 +0100

      Sort destination RAMBlocks to be the same as the source

      Use the order of incoming RAMBlocks from the source to record
      an index number; that then allows us to sort the destination
      local RAMBlock list to match the source.

      Now that the RAMBlocks are known to be in the same order, this
      simplifies the RDMA Registration step which previously tried to
      match RAMBlocks based on offset (which isn't guaranteed to match).

      Looking at the existing compress code, I think it was erroneously
      relying on an assumption of matching ordering, which this fixes.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 760ff4bebc86d08b252809e0da7261c986d022ff
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:25 2015 +0100

      Rework ram block hash

      RDMA uses a hash from block offset->RAM Block; this isn't needed
      on the destination, and it becomes harder to maintain after the next
      patch in the series that sorts the block list.

      Split the hash so that it's only generated on the source.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 03fcab38617ac9bcd6ed28cb1b6a0ecd8fb3bc82
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:24 2015 +0100

      Allow rdma_delete_block to work without the hash

      In the next patch we remove the hash on the destination,
      rdma_delete_block does two things with the hash which can be avoided:
        a) The caller passes the offset and rdma_delete_block looks it up
           in the hash; fixed by getting the caller to pass the block
        b) The hash gets recreated after deletion; fixed by making that
           conditional on the hash being initialised.

      While this function is currently only used during cleanup, Michael
      asked that we keep it general for future dynamic block registration
      work.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 632e3a5cd812d6bbd38fd2f3ffc189ff5ea51926
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:23 2015 +0100

      Rework ram_control_load_hook to hook during block load

      We need the names of RAMBlocks as they're loaded for RDMA,
      reuse a slightly modified ram_control_load_hook:
        a) Pass a 'data' parameter to use for the name in the block-reg
           case
        b) Only some hook types now require the presence of a hook function.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b12f7777981953b7d939496283014740bdd6de64
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:22 2015 +0100

      Translate offsets to destination address space

      The 'offset' field in RDMACompress and 'current_addr' field
      in RDMARegister are commented as being offsets within a particular
      RAMBlock, however they appear to actually be offsets within the
      ram_addr_t space.

      The code currently assumes that the offsets on the source/destination
      match, this change removes the need for the assumption for these
      structures by translating the addresses into the ram_addr_t space of
      the destination host.

      Note: An alternative would be to change the fields to actually
      take the data they're commented for; this would potentially be
      simpler but would break stream compatibility for those cases
      that currently work.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4fb5364b9096d6110c46604dbf1e19b7e766e757
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:21 2015 +0100

      Store block name in local blocks structure

      In a later patch the block name will be used to match up two views
      of the block list.  Keep a copy of the block name with the local block
      list.

      (At some point it could be argued that it would be best just to let
      migration see the innards of RAMBlock and avoid the need to use
      foreach).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 24ec68ef84fdacd5dddb83f3b341165c4815e6d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:20 2015 +0100

      rdma typos

      A couple of typo fixes.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1aca9a5f7d5a1ef9ee0233eac0fccc77ea6f0626
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Jun 23 17:34:35 2015 +0100

      Only try and read a VMDescription if it should be there

      The VMDescription section maybe after the EOF mark, the current code
      does a 'qemu_get_byte' and either gets the header byte identifying the
      description or an error (which it ignores).  Doing the 'get' upsets
      RDMA which hangs on old machine types without the VMDescription.

      Just avoid reading the VMDescription if we wouldn't send it.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 728470bea15b11ba7b3e3db54f0d9939908e0e65
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 15:56:38 2015 +0800

      rdma: fix memory leak

      Variable "r" going out of scope leaks the storage
      it points to in line 3268.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 849729bb796e0ecbb3f370f119682f2821dd1441
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:12 2015 -0700

      rocker: tests: don't need to specify master/self when setting vlans

      4.1 Linux kernel doesn't require specifying "master" or "self" when setting
      vlans on a port, so clean these up from the tests that use vlans.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-6-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d0d2555852c5e684a97dce787d3c2a65b9a6d64c
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:11 2015 -0700

      rocker: mark copy-to-cpu pkts as forwarding offloaded

      For pkts copied to the CPU (to be processed by guest driver), mark the Rx
      descriptor with flag "OFFLOAD_FWD" to indicate device has already forwarded
      pkt.  The guest driver will use this indicator to avoid duplicate
      forwarding in the guest OS.

      Examples include bcast/mcast/unknown ucast pkts flooded to bridged ports.
      We want to avoid both the device and the guest bridge driver flooding these
      pkts, which would result in duplicates pkts on the wire.  Packet sampling,
      such as sFlow, can also use this technique to mark pkts for the guest OS to
      record but otherwise drop.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 96497af0afd60e57749316f1bc196b417055c585
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:10 2015 -0700

      rocker: return -1 when dropping packet on ingress

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f211fcd75fec96ec9850885622ed028c6f7ebdf4
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:09 2015 -0700

      rocker: fix missing break statements

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435746792-41278-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1a88c96b7f94c8e12c07518f55fce8873e814d0
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:08 2015 -0700

      rocker: fix misplaced break statement

      Premature break in switch case block.  This particular case (group L2 rewrite)
      will be used for L2 LAG and L3 ECMP support, neither of which are enabled in
      the guest driver at this time, but are under development.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435746792-41278-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 66851f640b73a5a84160ee6ab19ab429f68bbb9f
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Tue Jun 30 19:25:53 2015 -0700

      rocker: don't queue receive pkts when port is disabled

      Commit 6e99c63 ("net/socket: Drop net_socket_can_send") changed the
      semantics around .can_receive for sockets to now require the device to
      flush queued pkts when transitioning to a .can_receive=true state.  Rocker
      device was not flushing the queue on .can_receive=true transition, so the
      receiver was stuck.

      But, turns out we really don't want any queuing at all on the port when the
      port is disabled, otherwise when the port transitions to enabled, we'd
      receive and forward stale pkts that really should have been dropped.  So,
      let's remove .can_receive so avoid queuing and drop the pkt in .receive if
      the port is disabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435717553-36187-1-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b83b5f2ef9753713c2fb64ff4cae7cb1e080624e
  Author: Brian Kress <kressb@moose.net>
  Date:   Tue Jun 23 11:49:25 2015 -0400

      vmxnet3: Fix incorrect small packet padding

      When running ESXi under qemu there is an issue with the ESXi guest
      discarding packets that are too short.  The guest discards any packets
      under the normal minimum length for an ethernet packet (60).  This
      results in odd behaviour where other hosts or VMs on other hosts can
      communicate with the ESXi guest just fine (since there's a physical NIC
      somewhere doing padding), but VMs on the host and the host itself cannot
      because the ARP request packets are too small for the ESXi host to
      accept.

      Someone in the past thought this was worth fixing, and added code to the
      vmxnet3 qemu emulation such that if it is receiving packets smaller than
      60 bytes to pad the packet out to 60. Unfortunately this code is wrong
      (or at least in the wrong place). It does so BEFORE before taking into
      account the vnet_hdr at the front of the packet added by the tap device.
      As a result, it might add padding, but it never adds enough.
      Specifically it adds 10 less (the length of the vnet_hdr) than it needs
      to.

      The following (hopefully "obviously correct") patch simply swaps the
      order of processing the vnet header and the padding.  With this patch an
      ESXi guest is able to communicate with the host or other local VMs.

      Signed-off-by: Brian Kress <kressb@moose.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5df6a1855b62dc653515d919e48c5b6f00c48f32
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Jun 25 10:18:05 2015 +0100

      e1000: flush packets when link comes up

      e1000_can_receive() checks the link up status register bit.  If the bit
      is clear, packets will be queued and the peer may disable receive to
      avoid wasting CPU reading packets that cannot be delivered.  The queue
      must be flushed once the link comes back up again.

      This patch fixes broken e1000 receive with Mac OS X Snow Leopard guests
      and tap networking.  Flushing the queue invokes the async send callback,
      which re-enables tap fd read.

      Reported-by: Jonathan Liu <net147@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435223885-12745-1-git-send-email-stefanha@redhat.com

  commit ec50dd4634ae06091e61f42b7ba975f9ed510ad0
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jun 25 14:24:10 2015 +0800

      rocker: fix memory leak

      Meanwhile, using g_new0 instead of g_malloc0,
      refer to commit 5839e53.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-id: 1435213450-6700-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 920557971b60e53c2f3f22e5d6c620ab1ed411fd
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:56 2015 -0300

      ich9: add TCO interface emulation

      This interface provides some registers within a 32-byte range and can be
      acessed through PCI-to-LPC bridge interface (PMBASE + 0x60).

      It's commonly used as a watchdog timer to detect system lockups through
      SMIs that are generated -- if TCO_EN bit is set -- on every timeout. If
      NO_REBOOT bit is not set in GCS (General Control and Status register),
      the system will be resetted upon second timeout if TCO_RLD register
      wasn't previously written to prevent timeout.

      This patch adds support to TCO watchdog logic and few other features
      like mapping NMIs to SMIs (NMI2SMI_EN bit), system intruder detection,
      etc. are not implemented yet.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71ba2f0af398f616e154137d9fdda25c2da01324
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jul 7 13:00:56 2015 +0300

      acpi: split out ICH ACPI support

      MIPS doesn't need it, and including it creates problem as we are adding
      dependency on ISA LPC bridge.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fd72468dfe40532df7c64d35054994058106c42
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:31 2015 +0100

      crypto: move built-in D3DES implementation into crypto/

      To prepare for a generic internal cipher API, move the
      built-in D3DES implementation into the crypto/ directory.

      This is not in fact a normal D3DES implementation, it is
      D3DES with double & triple length modes removed, and the
      key bytes in reversed bit order. IOW it is crippled
      specifically for the "benefit" of RFB, so call the new
      files desrfb.c instead of d3des.c to make it clear that
      it isn't a generally useful impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-4-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f2945cde60545aae7f31ab9d5ef29531efbc94f
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:30 2015 +0100

      crypto: move built-in AES implementation into crypto/

      To prepare for a generic internal cipher API, move the
      built-in AES implementation into the crypto/ directory

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-3-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ddbb0d09661f5fce21b335ba9aea8202d189b98e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:29 2015 +0100

      crypto: introduce new module for computing hash digests

      Introduce a new crypto/ directory that will (eventually) contain
      all the cryptographic related code. This initially defines a
      wrapper for initializing gnutls and for computing hashes with
      gnutls. The former ensures that gnutls is guaranteed to be
      initialized exactly once in QEMU regardless of CLI args. The
      block quorum code currently fails to initialize gnutls so it
      only works by luck, if VNC server TLS is not requested. The
      hash APIs avoids the need to litter the rest of the code with
      preprocessor checks and simplifies callers by allocating the
      correct amount of memory for the requested hash.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-2-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7a63f3cdc44230109c91cdc0ee912c3cc7837141
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Jul 2 17:24:41 2015 +0100

      block: update bdrv_drain_all()/bdrv_drain() comments

      The doc comments for bdrv_drain_all() and bdrv_drain() are outdated:

       * The bdrv_drain() comment is a poor man's bdrv_lock()/bdrv_unlock()
         which Fam Zheng is currently developing.  Unfortunately this warning
         was never really enough because devices keep submitting I/O and op
         blockers don't prevent that.

       * The bdrv_drain_all() comment is still partially correct but reflects
         the nature of the implementation rather than API documentation.

      Do make it clear that bdrv_drain() is only appropriate within an
      AioContext.  For anything spanning AioContexts you need
      bdrv_drain_all().

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435854281-6078-1-git-send-email-stefanha@redhat.com

  commit 1bd84ee717bf146c19281cce48a36a2f4d71748d
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Jul 2 11:06:11 2015 +0300

      qcow2: remove unnecessary check

      The value of 'i' is guaranteed to be >= 0

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1435824371-2660-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 501eea4f4187b6c62b6cf348ab0b100d57d8c56b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Apr 28 11:10:12 2014 +0200

      virtio-gpu: add to display-vga test

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b3409a31001e86d48221ea967b1c696c6497f318
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 12:22:09 2015 +0200

      virtio-gpu: use virtio_instance_init_common, fixup properties

      Switch over to virtio_instance_init_common.  Drop duplicate properties
      in virtio-gpu-pci and virtio-vga as they are properly aliased now.  Also
      drop the indirection via DEFINE_VIRTIO_GPU_PROPERTIES, we don't need it
      any more as the properties are defined in a single place now.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e18882952e46634ab7f53ef018a5e2e980996d48
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 12:19:42 2015 +0200

      virtio-gpu: update console device property.

      Update the device link of the QemuConsole, so it points to the
      virtio-gpu-pci or virtio-vga device instead of virtio-gpu-device.

      This is needed because we want to find the device by id, for
      example for input routing, and the id specified on the command
      line is attached to the pci proxy, not the virtio device.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6b3f7f639ed8861cd034292f9bb85b00c73658a6
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 16 17:07:54 2015 +0100

      vl: move rom_load_all after machine init done

      On ARM, commit ac9d32e39664e060cd1b538ff190980d57ad69e4 postponed the
      memory preparation for boot until the machine init done notifier. This
      has for consequence to insert ROM at machine init done time.

      However the rom_load_all function stayed called before the ROM are
      inserted. As a consequence the rom_load_all function does not do
      everything it is expected to do, on ARM.

      It currently registers the ROM reset notifier but does not iterate through
      the registered ROM list. the isrom field is not set properly. This latter
      is used to report info in the monitor and also to decide whether the
      rom->data can be freed on ROM reset notifier.

      To fix that regression the patch moves the rom_load_all call after
      machine init done. We also take the opportunity to rename the rom_load_all
      function into rom_check_and_resgister_reset() and integrate the
      rom_load_done in it.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reported-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1434470874-22573-1-git-send-email-eric.auger@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1452673888f6d7f0454276d049846c9bec659233
  Merge: f6e3035 4330296
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 09:22:40 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150706.0' into staging

      VFIO updates for 2.4-rc0
      - "real" host page size API (Peter Crosthwaite)
      - platform device irqfd support (Eric Auger)
      - spapr container disconnect fix (Alexey Kardashevskiy)
      - quirk for broken Chelsio hardware (Gabriel Laupre)
      - coverity fix (Paolo Bonzini)

      # gpg: Signature made Mon Jul  6 19:23:49 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150706.0:
        vfio/pci : Add pba_offset PCI quirk for Chelsio T5 devices
        vfio: Unregister IOMMU notifiers when container is destroyed
        hw/vfio/platform: add irqfd support
        kvm: some fixes to kvm_resamplefds_allowed
        sysbus: add irq_routing_notifier
        intc: arm_gic_kvm: set the qemu_irq/gsi mapping
        kvm-all.c: add qemu_irq/gsi hash table and utility routines
        kvm: rename kvm_irqchip_[add,remove]_irqfd_notifier with gsi suffix
        vfio: cpu: Use "real" page size API
        cpu-all: complete "real" host page size API
        vfio: fix return type of pread

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

      Conflicts:
      	kvm-all.c

  commit f329c74c1e7f08399f0d237f78571eb0ca6a89dd
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Jun 23 15:52:56 2015 +0200

      Revert "dataplane: allow virtio-1 devices"

      This reverts commit f5a5628cf0b65b223fa0c9031714578dfac4cf04.

      This was an old patch that had been already superseded by b0e5d90eb
      ("dataplane: endianness-aware accesses").

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit be1e50a27d5b6845729ae0854f57f3816cf47edb
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Fri Jun 26 09:32:28 2015 +0200

      dataplane: fix cross-endian issues

      Accesses to vring_avail_event and vring_used_event must honor the queue
      endianness.

      This patch allows cross-endian setups to use dataplane (tested with ppc64
      on ppc64le, and vice-versa).

      Suggested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f6e3035f75e5c6a73485335765ae070304c7a110
  Merge: 7edd8e4 355023f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 23:37:53 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream-smm' into staging

      This series implements KVM support for SMM, and lets you enable/disable
      it through the "smm" property of x86 machine types.

      # gpg: Signature made Mon Jul  6 17:41:05 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream-smm:
        pc: add SMM property
        ich9: add smm_enabled field and arguments
        pc_piix: rename kvm_enabled to smm_enabled
        target-i386: register a separate KVM address space including SMRAM regions
        kvm-all: kvm_irqchip_create is not expected to fail
        kvm-all: add support for multiple address spaces
        kvm-all: make KVM's memory listener more generic
        kvm-all: move internal types to kvm_int.h
        kvm-all: remove useless typedef
        kvm-all: put kvm_mem_flags to more work
        target-i386: add support for SMBASE MSR and SMIs
        piix4/ich9: do not raise SMI on ACPI enable/disable commands
        linux-headers: Update to 4.2-rc1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43302969966bc3a95470bfc300289a83068ef5d9
  Author: Gabriel Laupre <glaupre@chelsio.com>
  Date:   Mon Jul 6 12:15:15 2015 -0600

      vfio/pci : Add pba_offset PCI quirk for Chelsio T5 devices

      Fix pba_offset initialization value for Chelsio T5 Virtual Function
      device. The T5 hardware has a bug in it where it reports a Pending Interrupt
      Bit Array Offset of 0x8000 for its SR-IOV Virtual Functions instead
      of the 0x1000 that the hardware actually uses internally. As the hardware
      doesn't return the correct pba_offset value, add a quirk to instead
      return a hardcoded value of 0x1000 when a Chelsio T5 VF device is
      detected.

      This bug has been fixed in the Chelsio's next chip series T6 but there are
      no plans to respin the T5 ASIC for this bug. It is just documented in the
      T5 Errata and left it at that.

      Signed-off-by: Gabriel Laupre <glaupre@chelsio.com>
      Reviewed-by: Bandan Das <bsd@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit f8d8a944009b7e836c718a05590ea6b36146978f
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Jul 6 12:15:15 2015 -0600

      vfio: Unregister IOMMU notifiers when container is destroyed

      On systems with guest visible IOMMU, adding a new memory region onto
      PCI bus calls vfio_listener_region_add() for every DMA window. This
      installs a notifier for IOMMU memory regions. The notifier is supposed
      to be removed vfio_listener_region_del(), however in the case of mixed
      PHB (emulated + VFIO devices) when last VFIO device is unplugged and
      container gets destroyed, all existing DMA windows stay alive altogether
      with the notifiers which are on the linked list which head was in
      the destroyed container.

      This unregisters IOMMU memory region notifier when a container is
      destroyed.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit fb5f816499a5184a1336d72db030b8419b523082
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      hw/vfio/platform: add irqfd support

      This patch aims at optimizing IRQ handling using irqfd framework.

      Instead of handling the eventfds on user-side they are handled on
      kernel side using
      - the KVM irqfd framework,
      - the VFIO driver virqfd framework.

      the virtual IRQ completion is trapped at interrupt controller
      This removes the need for fast/slow path swap.

      Overall this brings significant performance improvements.

      Signed-off-by: Alvise Rigo <a.rigo@virtualopensystems.com>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 879904e8635b316de18393222f02d46d2d1f7f4e
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      kvm: some fixes to kvm_resamplefds_allowed

      Commit f41389ae3c54b introduced kvm_resamplefds_enabled() and
      associated kvm_resamplefds_allowed boolean. This patch adds
      non-KVM version for kvm_resamplefds_enabled and also declares
      kvm_resamplefds_allowed in kvm-stub as it is done for fellow
      kvm_irqfds_allowed.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 715ca691daca081108b33306faa6fa102f0df8d8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      sysbus: add irq_routing_notifier

      Add a new connect_irq_notifier notifier in the SysBusDeviceClass. This
      notifier, if populated, is called after sysbus_connect_irq.

      This mechanism is used to setup VFIO signaling once VFIO platform
      devices get attached to their platform bus, on a machine init done
      notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6a1a9cfa1c4a3e5b521d82e6adb94311fc5b9f8b
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      intc: arm_gic_kvm: set the qemu_irq/gsi mapping

      The arm_gic_kvm now calls kvm_irqchip_set_qemuirq_gsi to build
      the hash table storing qemu_irq/gsi mappings. From that point on
      irqfd can be setup directly from the qemu_irq using
      kvm_irqchip_add_irqfd_notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 197e35249a7360534e1aea0f2268ad0e1aa27121
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      kvm-all.c: add qemu_irq/gsi hash table and utility routines

      VFIO platform device needs to setup irqfd but it does not know the
      gsi corresponding to the device qemu_irq. This patch proposes to
      store a hash table in kvm_state using the qemu_irq as key and the gsi
      as a value.

      kvm_irqchip_set_qemuirq_gsi allows to insert such a pair. The interrupt
      controller is supposed to use it.

      kvm_irqchip_[add, remove]_irqfd_notifier allows to setup/tear down
      irqfd directly from the qemu_irq.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 1c9b71a7311ed99635a2d007fc8a856879537a05
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      kvm: rename kvm_irqchip_[add,remove]_irqfd_notifier with gsi suffix

      Anticipating for the introduction of new add/remove functions taking
      a qemu_irq parameter, let's rename existing ones with a gsi suffix.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit f7ceed190d7dcd907afe4b46b23809aaad09a619
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      vfio: cpu: Use "real" page size API

      This is system level code, and should only depend on the host page
      size, not the target page size.

      Note that HOST_PAGE_SIZE is misleadingly lead and is really aligning
      to both host and target page size. Hence it's replacement with
      REAL_HOST_PAGE_SIZE.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 4e51361d79289aee2985dfed472f8d87bd53a8df
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      cpu-all: complete "real" host page size API

      Currently the "host" page size alignment API is really aligning to both
      host and target page sizes. There is the qemu_real_page_size which can
      be used for the actual host page size but it's missing a mask and ALIGN
      macro as provided for qemu_page_size. Complete the API. This allows
      system level code that cares about the host page size to use a
      consistent alignment interface without having to un-needingly align to
      the target page size. This also reduces system level code dependency
      on the cpu specific TARGET_PAGE_SIZE.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 7d489dcdf5fd71b5052ffd401b869a627e1c751f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      vfio: fix return type of pread

      size_t is an unsigned type, thus the error case is never reached in
      the below call to pread.  If bytes is negative, it will be seen as
      a very high positive value.

      Spotted by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 355023f2010c4df619d88a0dd7012b4b9c74c12c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:52 2015 +0200

      pc: add SMM property

      The property can take values on, off or auto.  The default is "off"
      for KVM and pre-2.4 machines, otherwise "auto" (which makes it
      available on TCG or on new-enough kernels).

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fba72476c6b7be60ac74c5bcdc06c61242d1fe4f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:51 2015 +0200

      ich9: add smm_enabled field and arguments

      Q35's ACPI device is hard-coding SMM availability to KVM.  Place the
      logic where the board is created instead, so that it will be possible
      to override it.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 61e66c6237a0ca3eac35cf3145ccbb3ab5b6354c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:17 2015 +0200

      pc_piix: rename kvm_enabled to smm_enabled

      We will enable SMM even if KVM is in use.  Rename the field and
      arguments.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6410848bec38089424d54a6a8f10d4cf77182b5d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:16 2015 +0200

      target-i386: register a separate KVM address space including SMRAM regions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8db4936bb648e15173d687bc162be14fd0d4260c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:15 2015 +0200

      kvm-all: kvm_irqchip_create is not expected to fail

      KVM_CREATE_IRQCHIP should never fail, and so should its userspace
      wrapper kvm_irqchip_create.  The function does not do anything
      if the irqchip capability is not available, as is the case for PPC.

      With this patch, kvm_arch_init can allocate memory and it will not
      be leaked.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 38bfe69180f99d05611a14bab4bb72c95e755b58
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:14 2015 +0200

      kvm-all: add support for multiple address spaces

      Make kvm_memory_listener_register public, and assign a kernel
      address space id to each KVMMemoryListener.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7bbda04c8d13d0a599b31ed1c10dc76a62f9d4dc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:13 2015 +0200

      kvm-all: make KVM's memory listener more generic

      No semantic change, but s->slots moves into a new struct
      KVMMemoryListener.  KVM's memory listener becomes a member of struct
      KVMState, and becomes of type KVMMemoryListener.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8571ed35cfa50ed6b2aaee484dfa4f58176ebe00
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:45 2015 +0200

      kvm-all: move internal types to kvm_int.h

      i386 code will have to define a different KVMMemoryListener.  Create
      an internal header so that KVMSlot is not exposed outside.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 714f78c587ba628169b8ae6f91866c52fe6a799f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:44 2015 +0200

      kvm-all: remove useless typedef

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d6ff5cbc1231a5aec997abf3a809c7013e60472f
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Thu Jun 18 18:28:43 2015 +0200

      kvm-all: put kvm_mem_flags to more work

      Currently kvm_mem_flags just translates bools to bits, let's
      make it also determine the bools first. This avoids its parameter
      list growing each time we add a flag.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc12d72e10828ca6ff75f2ad432b741f07a10cef
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:42 2015 +0200

      target-i386: add support for SMBASE MSR and SMIs

      Apart from the MSR, the smi field of struct kvm_vcpu_events has to be
      translated into the corresponding CPUX86State fields.  Also,
      memory transaction flags depend on SMM state, so pull it from struct
      kvm_run on every exit from KVM to userspace.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit afd6895b45f20eb43b7ff95f7a76cc5af8d36cd7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:41 2015 +0200

      piix4/ich9: do not raise SMI on ACPI enable/disable commands

      These commands are handled entirely by QEMU.  Do not raise an SMI
      when they happen, because Windows (at least 2008r2) expects these
      commands to work and (depending on the value of APMC_EN at
      startup) the firmware might not have installed an SMI handler.

      When this happens (e.g. the kernel supports SMIs, or you are using
      TCG, but you have used "-machine smm=off") RIP is moved to 0x38000
      where there is no code to execute.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 25b8b39b6d7de95d0dd5ae7b66b3ac4b9b83e060
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Jul 6 12:10:57 2015 +1000

      linux-headers: Update to 4.2-rc1

      This updates linux-headers against master 4.2-rc1 (commit
      d770e558e21961ad6cfdf0ff7df0eb5d7d4f0754). This is the result of
      ./scripts/update-linux-headers.sh work.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7edd8e4660beb301d527257f8e04ebec0f841cb0
  Merge: 3fa18bc b242e0e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 14:03:44 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * more of Peter Crosthwaite's multiarch preparation patches
      * unlocked MMIO support in KVM
      * support for compilation with ICC

      # gpg: Signature made Mon Jul  6 13:59:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
        Stop including qemu-common.h in memory.h
        kvm: Switch to unlocked MMIO
        acpi: mark PMTIMER as unlocked
        kvm: Switch to unlocked PIO
        kvm: First step to push iothread lock out of inner run loop
        memory: let address_space_rw/ld*/st* run outside the BQL
        exec: pull qemu_flush_coalesced_mmio_buffer() into address_space_rw/ld*/st*
        memory: Add global-locking property to memory regions
        main-loop: introduce qemu_mutex_iothread_locked
        main-loop: use qemu_mutex_lock_iothread consistently
        Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
        cpu-defs: Move out TB_JMP defines
        include/exec: Move tb hash functions out
        include/exec: Move standard exceptions to cpu-all.h
        cpu-defs: Move CPU_TEMP_BUF_NLONGS to tcg
        memory_mapping: Rework cpu related includes
        cutils: allow compilation with icc
        qemu-common: add VEC_OR macro

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b242e0e0e2969c044a318e56f7988bbd84de1f63
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Jul 4 00:24:51 2015 +0200

      exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal

      Loading the BIOS in the mac99 machine is interesting, because there is a
      PROM in the middle of the BIOS region (from 16K to 32K).  Before memory
      region accesses were clamped, when QEMU was asked to load a BIOS from
      0xfff00000 to 0xffffffff it would put even those 16K from the BIOS file
      into the region.  This is weird because those 16K were not actually
      visible between 0xfff04000 and 0xfff07fff.  However, it worked.

      After clamping was added, this also worked.  In this case, the
      cpu_physical_memory_write_rom_internal function split the write in
      three parts: the first 16K were copied, the PROM area (second 16K) were
      ignored, then the rest was copied.

      Problems then started with commit 965eb2f (exec: do not clamp accesses
      to MMIO regions, 2015-06-17).  Clamping accesses is not done for MMIO
      regions because they can overlap wildly, and MMIO registers can be
      expected to perform full-width accesses based only on their address
      (with no respect for adjacent registers that could decode to completely
      different MemoryRegions).  However, this lack of clamping also applied
      to the PROM area!  cpu_physical_memory_write_rom_internal thus failed
      to copy the third range above, i.e. only copied the first 16K of the BIOS.

      In effect, address_space_translate is expecting _something else_ to do
      the clamping for MMIO regions if the incoming length is large.  This
      "something else" is memory_access_size in the case of address_space_rw,
      so use the same logic in cpu_physical_memory_write_rom_internal.

      Reported-by: Alexander Graf <agraf@redhat.com>
      Reviewed-by: Laurent Vivier <lvivier@redhat.com>
      Tested-by: Laurent Vivier <lvivier@redhat.com>
      Fixes: 965eb2f
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fba0a593b2809ecdda68650952cf3d3332ac1990
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 3 15:18:24 2015 +0100

      Stop including qemu-common.h in memory.h

      Including qemu-common.h from other header files is generally a bad
      idea, because it means it's very easy to end up with a circular
      dependency. For instance, if we wanted to include memory.h from
      qom/cpu.h we'd end up with this loop:
       memory.h -> qemu-common.h -> cpu.h -> cpu-qom.h -> qom/cpu.h -> memory.h

      Remove the include from memory.h. This requires us to fix up a few
      other files which were inadvertently getting declarations indirectly
      through memory.h.

      The biggest change is splitting the fprintf_function typedef out
      into its own header so other headers can get at it without having
      to include qemu-common.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1435933104-15216-1-git-send-email-peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3fa18bc9a55e067ba3012ab1d394f5d5a7e51419
  Merge: 261ccf4 1479073
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 12:51:51 2015 +0100

      Merge remote-tracking branch 'remotes/xtensa/tags/20150706-xtensa' into staging

      Xtensa fixes:

      - add 64-bit floating point registers;
      - fix gdb register map construction.

      # gpg: Signature made Mon Jul  6 11:27:45 2015 BST using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20150706-xtensa:
        target-xtensa: fix gdb register map construction
        target-xtensa: add 64-bit floating point registers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1479073b7e849fa03e5892eea0e0b5dadde1a98a
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Wed Jul 1 13:00:29 2015 +0300

      target-xtensa: fix gdb register map construction

      Due to different gdb overlay organization between windowed/call0
      configurations core import script doesn't always work correctly.
      Simplify the script: always copy complete gdb register map from overlay,
      count registers at core registerstion time. Update existing cores.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit ddd44279fdbc545a9182cb642645af8a4672c267
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Jun 29 10:50:03 2015 +0300

      target-xtensa: add 64-bit floating point registers

      Xtensa ISA got specification for 64-bit floating point registers and
      opcodes, see ISA, 4.3.11 "Floating point coprocessor option".

      Add 64-bit FP registers.

      Although 64-bit floating point is currently not supported by xtensa
      translator, these registers need to be reported to gdb with proper size,
      otherwise it wouldn't find other registers.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 261ccf426a6df854ba398be92413476919dd67f9
  Merge: f50a164 257621a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 11:04:54 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150706' into staging

      target-arm queue:
       * TLBI ALLEI1IS should operate on all CPUs, not just this one
       * Fix interval interrupt of cadence ttc in decrement mode
       * Implement YIELD insn to yield in ARM and Thumb translators
       * ARM GIC: reset all registers
       * arm_mptimer: fix timer shutdown and mode change
       * arm_mptimer: respect IT bit state

      # gpg: Signature made Mon Jul  6 10:58:27 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150706:
        arm_mptimer: Respect IT bit state
        arm_mptimer: Fix timer shutdown and mode change
        hw/intc/arm_gic_common.c: Reset all registers
        target-arm: Implement YIELD insn to yield in ARM and Thumb translators
        target-arm: Split DISAS_YIELD from DISAS_WFE
        Fix interval interrupt of cadence ttc when timer is in decrement mode
        target-arm: fix write helper for TLBI ALLE1IS

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 257621a9566054472d1d55a819880d0f9da02bda
  Author: Dmitry Osipenko <digetx@gmail.com>
  Date:   Mon Jul 6 04:27:12 2015 +0300

      arm_mptimer: Respect IT bit state

      The timer should fire the interrupt only if the IT (interrupt enable) bit
      state of the control register is enabled.

      Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8a52340cbaf60d4dd0a78bbfe12632639fe3da6d
  Author: Dmitry Osipenko <digetx@gmail.com>
  Date:   Mon Jul 6 01:47:47 2015 +0300

      arm_mptimer: Fix timer shutdown and mode change

      The running timer can't be stopped because timer control code just
      doesn't handle disabling the timer. Fix it by deleting the timer if
      the enable bit is cleared.

      The timer won't start periodic ticking if a ONE-SHOT -> PERIODIC mode
      change happens after a one-shot tick was completed. Fix it by
      re-starting ticking if the timer isn't ticking right now.

      To avoid code churning, these two fixes are squashed in one commit.

      Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12dc273e98e4e111880b25c12bf671dc8951b8e6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 19:25:45 2015 +0100

      hw/intc/arm_gic_common.c: Reset all registers

      The arm_gic_common reset function was missing reset code for
      several of the GIC's state fields:
       * bpr[]
       * abpr[]
       * priority1[]
       * priority2[]
       * sgi_pending[]
       * irq_target[] (SMP configurations only)

      These probably went unnoticed because most guests will either
      never touch them, or will write to them in the process of
      configuring the GIC before enabling interrupts.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1435602345-32210-1-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit c87e5a61c2b3024116f52f7e68273f864ff7ab82
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      target-arm: Implement YIELD insn to yield in ARM and Thumb translators

      Implement the YIELD instruction in the ARM and Thumb translators to
      actually yield control back to the top level loop rather than being
      a simple no-op. (We already do this for A64.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1435672316-3311-3-git-send-email-peter.maydell@linaro.org

  commit 049e24a191c212d9468db84169197887f2c91586
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      target-arm: Split DISAS_YIELD from DISAS_WFE

      Currently we use DISAS_WFE for both WFE and YIELD instructions.
      This is functionally correct because at the moment both of them
      are implemented as "yield this CPU back to the top level loop so
      another CPU has a chance to run". However it's rather confusing
      that YIELD ends up calling HELPER(wfe), and if we ever want to
      implement real behaviour for WFE and SEV it's likely to trip us up.

      Split out the yield codepath to use DISAS_YIELD and a new
      HELPER(yield) function, and have HELPER(wfe) call HELPER(yield).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1435672316-3311-2-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>

  commit a7ffaf5c96e26820edffa94eeac766fe60bfdd31
  Author: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      Fix interval interrupt of cadence ttc when timer is in decrement mode

      The interval interrupt is not set if the timer is in decrement mode.
      This is because x >=0 and x < interval after leaving the while-loop.

      Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
      Message-id: 20150630135821.51f3b4fd@johanness-latitude
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a6332d968297266dbabf9d33f959e3a5efdd0f9
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jul 6 10:05:43 2015 +0100

      target-arm: fix write helper for TLBI ALLE1IS

      TLBI ALLE1IS is an operation that does invalidate TLB entries on all PEs
      in the same Inner Sharable domain, not just on the current CPU. So we
      must use tlbiall_is_write() here.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1435676538-31345-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f50a1640fb82708a5d528dee1ace42a224b95b15
  Merge: 63a9294 7c649ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 5 20:35:47 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Sat Jul  4 07:06:08 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request: (35 commits)
        ahci: fix sdb fis semantics
        qtest/ahci: halted ncq migration test
        ahci: Do not map cmd_fis to generate response
        ahci: ncq migration
        ahci: add get_cmd_header helper
        ahci: add cmd header to ncq transfer state
        qtest/ahci: halted NCQ test
        ahci: correct ncq sector count
        ahci: correct types in NCQTransferState
        ahci: add rwerror=stop support for ncq
        ahci: factor ncq_finish out of ncq_cb
        ahci: refactor process_ncq_command
        ahci: assert is_ncq for process_ncq
        ahci: stash ncq command
        ide: add limit to .prepare_buf()
        qtest/ahci: ncq migration test
        qtest/ahci: simple ncq data test
        libqos/ahci: Force all NCQ commands to be LBA48
        libqos/ahci: set the NCQ tag on command_commit
        libqos/ahci: adjust expected NCQ interrupts
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 63a9294ddc9cf4f2bdcd0179324fedcbb6fae59f
  Merge: 3536064 e75e2a1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 5 19:33:51 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-03

      # gpg: Signature made Fri Jul  3 21:49:58 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        numa: API to lookup NUMA node by address
        numa: Store boot memory address range in node_info
        numa,pc-dimm: Store pc-dimm memory information in numa_info
        pc: Abort if HotplugHandlerClass::plug() fails
        pc,pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate routine
        pc,pc-dimm: Extract hotplug related fields in PCMachineState to a structure

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c649ac5b607e2339fb54fc0fc01311ba5eacadd
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: fix sdb fis semantics

      There are two things to fix here:

      The first one is subtle: the PxSACT register in the AHCI HBA has different
      semantics from the field it is shadowing, the ACT field in the
      Set Device Bits FIS.

      In the HBA register, PxSACT acts as a bitfield indicating outstanding
      NCQ commands where a set bit indicates a pending NCQ operation. The FIS
      field however operates as an RWC register update to PxSACT, where a set
      bit indicates a *successfully* completed command.

      Correct the FIS semantics. At the same time, move the "clear finished"
      action to the SDB FIS generation instead of the register read to mimick
      how the other shadow registers work, which always just report the last
      reported value from a FIS, and not the most current values which may
      not have been reported by a FIS yet.

      Lastly and more simply, SATA 3.2 section 13.6.4.2 (and later sections)
      all specify that the Interrupt bit for the SDB FIS should always be set
      to one for NCQ commands. That's currently the only time we generate this
      FIS, so set it on all the time.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-16-git-send-email-jsnow@redhat.com

  commit 8146d7dc2756138bd4011e8d882ead929f25f2d0
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      qtest/ahci: halted ncq migration test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-15-git-send-email-jsnow@redhat.com

  commit dd6282217d8fee36e3854eab2635bec9cc5d5236
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: Do not map cmd_fis to generate response

      The Register D2H FIS should copy the current values of
      the registers instead of just parroting back the same
      values the guest sent back to it.

      In this case, the SECTOR COUNT variables are actually
      not generally meaningful in terms of standard commands
      (See ATA8-AC3 Section 9.2 Normal Outputs), so it actually
      probably doesn't matter what we put in here.

      Meanwhile, we do need to use the Register update FIS from
      the NCQ pathways (in error cases), so getting rid of
      references to cur_cmd here is a win for AHCI concurrency.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-14-git-send-email-jsnow@redhat.com

  commit 684d50132fdd68f4c2cba9e65b50f9b8ef4c5164
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: ncq migration

      Migrate the NCQ queue. This is solely for the benefit of halted commands,
      since anything else should have completed and had any relevant status
      flushed to the HBA registers already.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-13-git-send-email-jsnow@redhat.com

  commit ee364416c1b5ed1adc779ca7197451a131666236
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: add get_cmd_header helper

      cur_cmd is an internal bookmark that points to the
      current AHCI Command Header being processed by the
      AHCI state machine. With NCQ needing to occasionally
      rely on some of the same AHCI helpers, we cannot use
      cur_cmd and will need to grab explicit pointers instead.

      In an attempt to begin relying on the cur_cmd pointer
      less, add a helper to let us specifically get the pointer
      to the command header of particular interest.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-12-git-send-email-jsnow@redhat.com

  commit c82bd3c893825fc76af3634f5461f5eabd94e9df
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: add cmd header to ncq transfer state

      While the rest of the AHCI device can rely on a single bookmarked
      pointer for the AHCI Command Header currently being processed, NCQ
      is asynchronous and may have many commands in flight simultaneously.

      Add a cmdh pointer to the ncq_tfs object and make the sglist prepare
      function take an AHCICmdHeader pointer so we can be explicit about
      where we'd like to build SGlists from.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-11-git-send-email-jsnow@redhat.com

  commit 7f6cf5ee1236d94fc25830a47438e57aa294d9fe
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      qtest/ahci: halted NCQ test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-10-git-send-email-jsnow@redhat.com

  commit e08a98357b5811e7933ff077f6da4b85175caf8a
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: correct ncq sector count

      uint16_t isn't enough to hold the real sector count, since a value of
      zero implies a full 64K sectors, so we need a uint32_t here.

      We *could* cheat and pretend that this value is 0-based and fit it in
      a uint16_t, but I'd rather waste 2 bytes instead of a future dev's
      10 minutes when they forget to +1/-1 accordingly somewhere.

      See SATA 3.2, section 13.6.4.1 "READ FPDMA QUEUED".

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-9-git-send-email-jsnow@redhat.com

  commit 9364384de0e3b8a5bdea67ba49bee9ea7f1b8f26
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: correct types in NCQTransferState

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-8-git-send-email-jsnow@redhat.com

  commit 7c03a691077e71a08bbca06568cd97f09537458c
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: add rwerror=stop support for ncq

      Handle NCQ failures for cases where we want to halt the VM on IO errors.
      Upon a VM state change, retry the halted NCQ commands.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-7-git-send-email-jsnow@redhat.com

  commit 54f3223730736fca1e6e89bb7f99c4f8432fdabb
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: factor ncq_finish out of ncq_cb

      When we add werror=stop or rerror=stop support to NCQ,
      we'll want to take a codepath where we don't actually
      complete the command, so factor that out into a new routine.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-6-git-send-email-jsnow@redhat.com

  commit 631ddc22cbb401f2777dc8b117196f0988df4eea
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: refactor process_ncq_command

      Split off execute_ncq_command so that we can call
      it separately later if we desire.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-5-git-send-email-jsnow@redhat.com

  commit 922f893e57da24bc80db3e79bea56485d1c111fa
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: assert is_ncq for process_ncq

      We already checked this in the handle_cmd phase, so just
      change this to an assertion and simplify the error logic.

      (Also, fix the switch indent, because checkpatch.pl yelled.)
      ((Sorry for churn.))

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-4-git-send-email-jsnow@redhat.com

  commit 4614619ee4ad96d2715dc41f9430fb43335c15d2
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: stash ncq command

      For migration and werror=stop/rerror=stop resume purposes,
      it will be convenient to have the command handy inside of
      ncq_tfs.

      Eventually, we'd like to avoid reading from the FIS entirely
      after the initial read, so this is a byte (hah!) sized step
      in that direction.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-3-git-send-email-jsnow@redhat.com

  commit a718978ed58abc1ad92567a9c17525136be02a71
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ide: add limit to .prepare_buf()

      prepare_buf should not always grab as many descriptors
      as it can, sometimes it should self-limit.

      For example, an NCQ transfer of 1 sector with a PRDT that
      describes 4GiB of data should not copy 4GiB of data, it
      should just transfer that first 512 bytes.

      PIO is not affected, because the dma_buf_rw dma helpers
      already have a byte limit built-in to them, but DMA/NCQ
      will exhaust the entire list regardless of requested size.

      AHCI 1.3 specifies in section 6.1.6 Command List Underflow that
      NCQ is not required to detect underflow conditions. Non-NCQ
      pathways signal underflow by writing to the PRDBC field, which
      will already occur by writing the actual transferred byte count
      to the PRDBC, signaling the underflow.

      Our NCQ pathways aren't required to detect underflow, but since our DMA
      backend uses the size of the PRDT to determine the size of the transer,
      if our PRDT is bigger than the transaction (the underflow condition) it
      doesn't cost us anything to detect it and truncate the PRDT.

      This is a recoverable error and is not signaled to the guest, in either
      NCQ or normal DMA cases.

      For BMDMA, the existing pathways should see no guest-visible difference,
      but any bytes described in the overage will no longer be transferred
      before indicating to the guest that there was an underflow.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-2-git-send-email-jsnow@redhat.com

  commit 07a1ee7958cc3433706ab0d3a07c42fdd9d98fe6
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      qtest/ahci: ncq migration test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-17-git-send-email-jsnow@redhat.com

  commit 26ad004585835e7c126bb94fd5161db1c60169f3
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      qtest/ahci: simple ncq data test

      Test the NCQ pathways for a simple IO RW test.
      Also, test that libqos doesn't explode when
      running NCQ commands :)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-16-git-send-email-jsnow@redhat.com

  commit e38cc93aca5d40a58e65bb0dfa23eaf3290bbf76
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: Force all NCQ commands to be LBA48

      NCQ commands are LBA48 by definition.

      See SATA 3.2 13.6.4.1 "READ FPDMA QUEUED", or
          SATA 3.2 13.6.5.1 "WRITE FPDMA QUEUED."

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-15-git-send-email-jsnow@redhat.com

  commit a8973ff50a04f96c3ce5c803c8fd3ec16ed8d6c5
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: set the NCQ tag on command_commit

      NCQ commands have the concept of a "TAG" that they need to set,
      but in the AHCI world, it is mandated that the TAG always match
      the command slot that you executed the NCQ from.

      See AHCI 9.3.1.1.5.2 "Native Queued Commands".

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-14-git-send-email-jsnow@redhat.com

  commit 359790c2542a8c4da3d4c8fb626ca2675a417d51
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: adjust expected NCQ interrupts

      NCQ commands will expect the SDBS interrupt,
      and in the normative case, do not expect to see
      a D2H Register FIS unless something went wrong.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-13-git-send-email-jsnow@redhat.com

  commit 4de484698bdda6c5e093dfbe4368cdb364fdf87f
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: edit wait to be ncq aware

      The wait command should check to make sure SACT is clear as well
      as the Command Issue register.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-12-git-send-email-jsnow@redhat.com

  commit cb45304108ab733aaf2e4351e77cb6d07ac88fd5
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: add NCQ frame support

      NCQ frames are generated a little differently than
      their non-NCQ cousins. Add support for them.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-11-git-send-email-jsnow@redhat.com

  commit 40d29928caa6db154182f5314f497020f81e640e
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: fix cmd_sanity for ncq

      NCQ commands should not / do not update the byte count
      in the command header post command, so this field is
      meaningless for NCQ tests.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-10-git-send-email-jsnow@redhat.com

  commit 34475239b8f1fff0b715cb20f8b534b9d07a897e
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci/qtest: Execute IDENTIFY prior to data commands

      If you try to execute an NCQ command before trying to engage with the
      device by issuing an IDENTIFY command, the error bits that are part of
      the signature will fool the test suite into thinking there was a failure.

      Issue IDENTIFY first on "boot", which will clear the signature out of
      the registers for us.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-9-git-send-email-jsnow@redhat.com

  commit 0437d32ae232af37d3b94064a563eb51d4eedd62
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: ncq sector count correction

      This value should not be size-corrected, 0 sectors does not imply
      1 sector(s). This is just debug information, but it's misleading!

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-8-git-send-email-jsnow@redhat.com

  commit 5d5f89212f19e3d7d3da1328137ca9e33eead7bf
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: add ncq debug checks

      Most of the time, these bits can be safely ignored. For the purposes
      of debugging however, it's nice to know that they're not being used.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-7-git-send-email-jsnow@redhat.com

  commit d56f4d6965ebcf8f3c496845c286e3a66496fdff
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: separate prdtl from opts

      There's no real reason to have it bundled together, and this way
      is a little nicer to follow if you have the AHCI spec pulled up.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-6-git-send-email-jsnow@redhat.com

  commit 3bcbe4aa803c1a41e5392ecac7b4fc3c99a42f89
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: check for ncq prdtl overflow

      Don't attempt the NCQ transfer if the PRDT we were given is not big
      enough to perform the entire transfer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-5-git-send-email-jsnow@redhat.com

  commit a55c8231d04e3023bc5c3da9290f01e7d6989a94
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: add ncq_err helper

      Set some appropriate error bits for NCQ for us.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-4-git-send-email-jsnow@redhat.com

  commit b6fe41fa6dbdf7b92b76cd4848ef442de18e03d3
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: use shorter variables

      Trivial cleanup that I didn't want to tack-on to anything else.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-3-git-send-email-jsnow@redhat.com

  commit 7763ed1506a9ffe74a80332182cc4f229251f998
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: Rename NCQFIS structure fields

      Several fields of the NCQFIS structure are ambiguously named. This patch
      clarifies the intended (if unsupported) usage of the NCQ fields to aid
      in creating more meaningful debug messages through the NCQ codepaths.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-2-git-send-email-jsnow@redhat.com

  commit d31a3ebc28bf401cc5cce43f36068697d670c3f9
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      qtest/ahci: add port_reset test

      Test that we can survive a couple of cycles of running a basic identify
      test, some IO, and resetting the HBA. Ensures that we can bring the HBA
      back to compliant spec during the lifecycle of the VM.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-5-git-send-email-jsnow@redhat.com

  commit 95ea663693fdf4f39976f9aadb004fc77c2058ee
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      libqos/ahci: fix memory management bugs

      There's a handful of trivial bugs in the libqos/ahci functions,
      squish them together.

      - Zero cached pointers after freeing them
      - The Command List Buffer is an array of 32x 32 byte structures, not
        32x 8 byte pointers -- it's 1MiB, not 256 bytes. Zero it ALL.
      - Free the correct command in ahci_pick_cmd.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-4-git-send-email-jsnow@redhat.com

  commit 0d3e9d1f598e803a02c9bf43ec0b053e873ca79a
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      qtest/ahci: add test_max

      Test that the FIS delivered after a nondata command has appropriately
      updated registers, just as we'd expect a data command to do.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-3-git-send-email-jsnow@redhat.com

  commit e9ebb2f76778d19227476e34c3d7aa6b8975c1b6
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      ahci: Do not ignore memory access read size

      The only guidance the AHCI specification gives on memory access is:
      "Register accesses shall have a maximum size of 64-bits; 64-bit access
      must not cross an 8-byte alignment boundary."

      I interpret this to mean that aligned or unaligned 1, 2 and 4 byte
      accesses should work, as well as aligned 8 byte accesses.

      In practice, a real Q35/ICH9 responds to 1, 2, 4 and 8 byte reads
      regardless of alignment. Windows 7 can be observed making 1 byte
      reads to the middle of 32 bit registers to fetch error codes.

      Introduce a wrapper to support unaligned accesses to AHCI.
      This wrapper will support aligned 8 byte reads, but will make
      no effort to support unaligned 8 byte reads, which although they
      will work on real hardware, are not guaranteed to work and do
      not appear to be used by either Windows or Linux.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1434470575-21625-2-git-send-email-jsnow@redhat.com

  commit e75e2a14d5c13ad38dcf72b69922dee2dafbb0d0
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:27 2015 +0530

      numa: API to lookup NUMA node by address

      Introduce an API numa_get_node(ram_addr_t addr, Error **errp) that
      returns the NUMA node to which the given address belongs to. This
      API works uniformly for both boot time as well as hotplugged memory.

      This API is needed by sPAPR PowerPC to support
      ibm,dynamic-reconfiguration-memory device tree node which is needed for
      memory hotplug.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit abafabd8c982e875d60a10d37f0b91cff1003c55
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:26 2015 +0530

      numa: Store boot memory address range in node_info

      Store memory address range information of boot memory  in address
      range list of numa_info.

      This helps to have a common NUMA node lookup by address function that
      works for both boot-time memory and hotplugged memory.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit fa9ea81d15d459f6c4a39d77ae680af94cebd65e
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:25 2015 +0530

      numa,pc-dimm: Store pc-dimm memory information in numa_info

      Start storing the (start_addr, end_addr) of the pc-dimm memory
      in corresponding numa_info[node] so that this information can be used
      to lookup node by address.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8e23184b6b2f8426041854b18fb56a3ff197d5a0
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:24 2015 +0530

      pc: Abort if HotplugHandlerClass::plug() fails

      HotplugHandlerClass::plug() shouldn't fail and hence use error_abort
      to abort if it fails.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 43bbb49ef7032a8bfdafbd02d0286512af161089
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:23 2015 +0530

      pc,pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate routine

      pc_dimm_plug() has code that will be needed for memory plug handlers
      in other archs too. Extract code from pc_dimm_plug() into a generic
      routine pc_dimm_memory_plug() that resides in pc-dimm.c. Also
      correspondingly refactor re-usable unplug code into pc_dimm_memory_unplug().

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit a7d69ff10b085ba6f8236600829532984cdea714
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:22 2015 +0530

      pc,pc-dimm: Extract hotplug related fields in PCMachineState to a structure

      Move hotplug_memory_base and hotplug_memory fields of PCMachineState
      into a separate structure so that the same can be made use of from
      other architectures supporing memory hotplug.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 35360642d043c2a5366e8a04a10e5545e7353bd5
  Merge: 5317b0f 496eaca
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 3 12:05:31 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150703-1' into staging

      virtio-input: add input routing support, update multiseat docs.

      # gpg: Signature made Fri Jul  3 11:22:33 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150703-1:
        update pci-bridge-seat section in docs/multiseat.txt
        virtio-input: add input routing support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 496eacaa67653023540e090fb70b7caba429bbc0
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jul 1 10:59:47 2015 +0200

      update pci-bridge-seat section in docs/multiseat.txt

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5cce173323cfe1bb22f7a10f9b73ac7796909cef
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 11:59:16 2015 +0200

      virtio-input: add input routing support

      Add display and head properties for input routing to
      virtio-input devices, update multiseat documentation.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5317b0f6d4bb581c5c8f88f31138ee301ad2b7e5
  Merge: 6686ce3 c4d3c0a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 2 15:20:55 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150702-v3' into staging

      Several s390x patches including:
      - missing virtio-1 related code for virtio-ccw
      - bugfixes in ipl device, gdb, virtio-ccw
      - bugfix in s390-ccw bios + rebuild
      - introduce versioned machines for s390-ccw-virtio

      # gpg: Signature made Thu Jul  2 15:05:34 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150702-v3:
        s390x/migration: Introduce 2.4 machine
        s390x/gdb: synchronize cpu state after modifying acrs
        s390x/ipl: Fix boot if no bootindex was specified
        virtio-ccw: migrate ->revision
        s390x/virtio-ccw: support virtio-1 set_vq format
        s390x/virtio-ccw: add virtio set-revision call
        s390x/css: Add a callback for when subchannel gets disabled
        s390-ccw.img: update
        s390-ccw.img: Consume service interrupts
        css: mss/mcss-e vs. migration
        virtio-ccw: complete handling of guest-initiated resets

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4d3c0a2696c09a884b680d15b03325e46656a6c
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Jul 1 11:16:57 2015 +0200

      s390x/migration: Introduce 2.4 machine

      The section footer changes commit f68945d42bab ("Add a protective
      section footer") and commit 37fb569c0198 ("Disable section footers
      on older machine types") broke migration for any non-versioned
      machines.

      This pinpoints a problem of s390-ccw machines: it needs to
      be versioned to be compatible with future changes in common
      code data structures such as section footers.

      Let's introduce a version scheme for s390-ccw-virtio machines.
      We will use the old s390-ccw-virtio name as alias to the latest
      version as all existing libvirt XML for the ccw type were expanded
      by libvirt to that name.

      The only downside of this patch is, that the old alias s390-ccw
      will no longer be available as machines can have only one alias,
      but it should not really matter.

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com>
      Cc: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1435742217-62246-1-git-send-email-borntraeger@de.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 55b1b753dff022dcc95123bed35946b4977d31fa
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Jun 23 09:10:51 2015 +0200

      s390x/gdb: synchronize cpu state after modifying acrs

      Whenever we touch the access control registers, we have to make sure that
      the values will make it into kvm. Otherwise the change will simply be lost.

      When synchronizing qemu and kvm, a normal KVM_PUT_RUNTIME_STATE does not take
      care of these registers. Let's simply trigger a KVM_PUT_FULL_STATE sync,
      so the values will directly be written to kvm. The performance overhead can
      be ignored and this is much cleaner than manually writing these registers to kvm
      via our two supported ways.

      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6efd2c2a125b4369b8def585b0dac35c849b5eb3
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jun 18 16:37:39 2015 +0200

      s390x/ipl: Fix boot if no bootindex was specified

      commit fa92e218df1d ("s390x/ipl: avoid sign extension") introduced
      a regression:

      qemu-system-s390x -drive file=image.qcow,format=qcow2
      does not boot, the bios states
      "No virtio-blk device found!"

      adding bootindex=1 does boot.

      The reason is that the uint32_t as return value will not do the right
      thing for the return -1 (default without bootindex).
      The bios itself, will interpret a 64bit -1 as autodetect (but it will
      interpret 32bit -1 as ccw device address ff.ff.ffff)

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: qemu-stable@nongnu.org # v2.3.0
      Tested-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 213941d73baf8ba7ec5381c8402fed7925d613d4
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 25 12:20:08 2015 +0200

      virtio-ccw: migrate ->revision

      We need to migrate the revision field as well. No compatibility
      concerns as we already introduced migration of ->config_vector in
      this release.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 0db87e0d1763d3fb4039c2cffb0f3264da88ab30
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:13 2014 +0100

      s390x/virtio-ccw: support virtio-1 set_vq format

      Support the new CCW_CMD_SET_VQ format for virtio-1 devices.

      While we're at it, refactor the code a bit and enforce big endian
      fields (which had always been required, even for legacy).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit c42767f2bbd18d4ec895395c01c64bbec16b5b84
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Dec 11 14:25:12 2014 +0100

      s390x/virtio-ccw: add virtio set-revision call

      Handle the virtio-ccw revision according to what the guest sets.
      When revision 1 is selected, we have a virtio-1 standard device
      with byteswapping for the virtio rings.

      When a channel gets disabled, we have to revert to the legacy behavior
      in case the next user of the device does not negotiate the revision 1
      anymore (e.g. the boot firmware uses revision 1, but the operating
      system only uses the legacy mode).

      Note that revisions > 0 are still disabled.

      [CH: assure memory accesses are always BE]
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6686ce3f1628f045035d58db8890d20705fd5c34
  Merge: d2966f8 764ba3a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 2 10:44:34 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Jul  2 10:10:39 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block: remove redundant check before g_slist_find()
        block/nfs: limit maximum readahead size to 1MB
        block/iscsi: restore compatiblity with libiscsi 1.9.0
        iotests: Use event_wait in wait_ready
        qemu-iotests: Add test case for mirror with unmap
        qemu-iotests: Make block job methods common
        block: Remove bdrv_reset_dirty
        block: Fix dirty bitmap in bdrv_co_discard
        mirror: Do zero write on target if sectors not allocated
        qmp: Add optional bool "unmap" to drive-mirror
        block: Add bdrv_get_block_status_above
        timer: Use a single definition of NSEC_PER_SEC for the whole codebase
        timer: Move NANOSECONDS_PER_SECONDS to timer.h
        blockdev: no need to drain+flush in hmp_drive_del
        qapi: Rename 'dirty-bitmap' mode to 'incremental'
        qcow2: Handle EAGAIN returned from update_refcount
        block/iscsi: add support for request timeouts

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 764ba3ae511adddfa750db290ac8375d660ca5b9
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 29 16:12:13 2015 +0300

      block: remove redundant check before g_slist_find()

      An empty GSList is represented by a NULL pointer, therefore it's a
      perfectly valid argument for g_slist_find() and there's no need to
      make any additional check.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1435583533-5758-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 29c838cdc96c4d117f00c75bbcb941e1be9590fb
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Jun 26 13:14:01 2015 +0200

      block/nfs: limit maximum readahead size to 1MB

      a malicious caller could otherwise specify a very
      large value via the URI and force libnfs to allocate
      a large amount of memory for the readahead buffer.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1435317241-25585-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9049736ec70fdc886ac0df521fdd8b2886b2cb63
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Jun 26 12:18:01 2015 +0200

      block/iscsi: restore compatiblity with libiscsi 1.9.0

      RHEL7 and others are stuck with libiscsi 1.9.0 since there
      unfortunately was an ABI breakage after that release.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435313881-19366-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d7b25297920d18fa2a2cde1ed21fde38a88c935f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:14 2015 +0800

      iotests: Use event_wait in wait_ready

      Only poll the specific type of event we are interested in, to avoid
      stealing events that should be consumed by someone else.

      Suggested-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c615091793f53ff33b8f6c1b1ba711cf7c93e97b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:13 2015 +0800

      qemu-iotests: Add test case for mirror with unmap

      This checks that the discard on mirror source that effectively zeroes
      data is also reflected by the data of target.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 866323f39d5c7bb053f5e5bf753908ad9f5abec7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:12 2015 +0800

      qemu-iotests: Make block job methods common

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e82e4bce127654b2dd42ef393587775be792334
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:11 2015 +0800

      block: Remove bdrv_reset_dirty

      Using this function would always be wrong because a dirty bitmap must
      have a specific owner that consumes the dirty bits and calls
      bdrv_reset_dirty_bitmap().

      Remove the unused function to avoid future misuse.

      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 508249952c0ea7472c62e17bf8132295dab4912d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:10 2015 +0800

      block: Fix dirty bitmap in bdrv_co_discard

      Unsetting dirty globally with discard is not very correct. The discard may zero
      out sectors (depending on can_write_zeroes_with_unmap), we should replicate
      this change to destination side to make sure that the guest sees the same data.

      Calling bdrv_reset_dirty also troubles mirror job because the hbitmap iterator
      doesn't expect unsetting of bits after current position.

      So let's do it the opposite way which fixes both problems: set the dirty bits
      if we are to discard it.

      Reported-by: wangxiaolong@ucloud.cn
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dcfb3beb5130694b76b57de109619fcbf9c7e5b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:09 2015 +0800

      mirror: Do zero write on target if sectors not allocated

      If guest discards a source cluster, mirroring with bdrv_aio_readv is overkill.
      Some protocols do zero upon discard, where it's best to use
      bdrv_aio_write_zeroes, otherwise, bdrv_aio_discard will be enough.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0fc9f8ea2800b76eaea20a8a3a91fbeeb4bfa81b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:08 2015 +0800

      qmp: Add optional bool "unmap" to drive-mirror

      If specified as "true", it allows discarding on target sectors where source is
      not allocated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ba3f0e2545c365ebe1dbddb0e53058710d41881e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:07 2015 +0800

      block: Add bdrv_get_block_status_above

      Like bdrv_is_allocated_above, this function follows the backing chain until seeing
      BDRV_BLOCK_ALLOCATED.  Base is not included.

      Reimplement bdrv_is_allocated on top.

      [Initialized bdrv_co_get_block_status_above() ret to 0 to silence
      mingw64 compiler warning about the unitialized variable.  assert(bs !=
      base) prevents that case but I suppose the program could be compiled
      with -DNDEBUG.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Jun 12 16:01:30 2015 +0300

      timer: Use a single definition of NSEC_PER_SEC for the whole codebase

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: c6e55468856ba0b8f95913c4da111cc0ef266541.1434113783.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 471fae3c98d4f44b1957eb09d51ace440c585a20
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Jun 12 16:01:29 2015 +0300

      timer: Move NANOSECONDS_PER_SECONDS to timer.h

      We want to be able to reuse this define by making it common to
      multiple QEMU modules.

      This also makes it an integer since there's no need for it to be a
      float.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 6375912849da2ab561046dd013684535ccecca44.1434113783.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 126b8bbdfe8bc4042f13f230a4b36f90646f47c6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 28 16:17:09 2015 +0200

      blockdev: no need to drain+flush in hmp_drive_del

      bdrv_close already does that, and in fact hmp_drive_del would need
      another drain after the flush (which bdrv_close does).  So remove
      the duplication.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432822629-25401-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4b80ab2b7d950d5b22647b364e37eb81c756f061
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Jun 4 20:20:34 2015 -0400

      qapi: Rename 'dirty-bitmap' mode to 'incremental'

      If we wish to make differential backups a feature that's easy to access,
      it might be pertinent to rename the "dirty-bitmap" mode to "incremental"
      to make it clear what /type/ of backup the dirty-bitmap is helping us
      perform.

      This is an API breaking change, but 2.4 has not yet gone live,
      so we have this flexibility.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1433463642-21840-2-git-send-email-jsnow@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3e5feb6202149e8a963a33b911216e40d790f1d7
  Author: Jindřich Makovička <makovick@gmail.com>
  Date:   Wed Jun 24 07:05:25 2015 +0200

      qcow2: Handle EAGAIN returned from update_refcount

      Fixes a crash during image compression

      Signed-off-by: Jindřich Makovička <makovick@gmail.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5dd7a535b71a0f2f8e7af75c5d694174359ce323
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Jun 16 13:45:07 2015 +0200

      block/iscsi: add support for request timeouts

      libiscsi starting with 1.15 will properly support timeout of iscsi
      commands. The default will remain no timeout, but this can
      be changed via cmdline parameters, e.g.:

      qemu -iscsi timeout=30 -drive file=iscsi://...

      If a timeout occurs a reconnect is scheduled and the timed out command
      will be requeued for processing after a successful reconnect.

      The required API call iscsi_set_timeout is present since libiscsi
      1.10 which was released in October 2013. However, due to some bugs
      in the libiscsi code the use is not recommended before version 1.15.

      Please note that this patch bumps the libiscsi requirement to 1.10
      to have all function and macros defined. The patch fixes also a
      off-by-one error in the NOP timeout calculation which was fixed
      while touching these code parts.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1434455107-19328-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de7ea885c5394c1fba7443cbf33bd2745d32e6c2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:26 2015 +0200

      kvm: Switch to unlocked MMIO

      Do not take the BQL before dispatching MMIO requests of KVM VCPUs.
      Instead, address_space_rw will do it if necessary. This enables completely
      BQL-free MMIO handling in KVM mode for upcoming devices with fine-grained
      locking.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-10-git-send-email-pbonzini@redhat.com>

  commit 7070e085d490c396f9237c8f10bf8b6e69cd0066
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:25 2015 +0200

      acpi: mark PMTIMER as unlocked

      Accessing QEMU_CLOCK_VIRTUAL is thread-safe.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-9-git-send-email-pbonzini@redhat.com>

  commit 80b7d2efb63c225797345c152cdd3392b9fe7b72
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:24 2015 +0200

      kvm: Switch to unlocked PIO

      Do not take the BQL before dispatching PIO requests of KVM VCPUs.
      Instead, address_space_rw will do it if necessary. This enables
      completely BQL-free PIO handling in KVM mode for upcoming devices with
      fine-grained locking.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-8-git-send-email-pbonzini@redhat.com>

  commit 4b8523ee896750c37b4fa224a40d34703cbdf4c6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:23 2015 +0200

      kvm: First step to push iothread lock out of inner run loop

      This opens the path to get rid of the iothread lock on vmexits in KVM
      mode. On x86, the in-kernel irqchips has to be used because we otherwise
      need to synchronize APIC and other per-cpu state accesses that could be
      changed concurrently.

      Regarding pre/post-run callbacks, s390x and ARM should be fine without
      specific locking as the callbacks are empty. MIPS and POWER require
      locking for the pre-run callback.

      For the handle_exit callback, it is non-empty in x86, POWER and s390.
      Some POWER cases could do without the locking, but it is left in
      place for now.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-7-git-send-email-pbonzini@redhat.com>

  commit 4840f10eff37eebc609fcc933ab985dc66df95c6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:22 2015 +0200

      memory: let address_space_rw/ld*/st* run outside the BQL

      The MMIO case is further broken up in two cases: if the caller does not
      hold the BQL on invocation, the unlocked one takes or avoids BQL depending
      on the locking strategy of the target memory region and its coalesced
      MMIO handling.  In this case, the caller should not hold _any_ lock
      (a friendly suggestion which is disregarded by virtio-scsi-dataplane).

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-6-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 125b3806668106667dd2ae049593852859e12b63
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:21 2015 +0200

      exec: pull qemu_flush_coalesced_mmio_buffer() into address_space_rw/ld*/st*

      As memory_region_read/write_accessor will now be run also without BQL held,
      we need to move coalesced MMIO flushing earlier in the dispatch process.

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-5-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 196ea13104f802c508e57180b2a0d2b3418989a3
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:20 2015 +0200

      memory: Add global-locking property to memory regions

      This introduces the memory region property "global_locking". It is true
      by default. By setting it to false, a device model can request BQL-free
      dispatching of region accesses to its r/w handlers. The actual BQL
      break-up will be provided in a separate patch.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-4-git-send-email-pbonzini@redhat.com>

  commit afbe70535ff1a8a7a32910cc15ebecc0ba92e7da
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:19 2015 +0200

      main-loop: introduce qemu_mutex_iothread_locked

      This function will be used to avoid recursive locking of the iothread lock
      whenever address_space_rw/ld*/st* are called with the BQL held, which is
      almost always the case.

      Tracking whether the iothread is owned is very cheap (just use a TLS
      variable) but requires some care because now the lock must always be
      taken with qemu_mutex_lock_iothread().  Previously this wasn't the case.
      Outside TCG mode this is not a problem.  In TCG mode, we need to be
      careful and avoid the "prod out of compiled code" step if already
      in a VCPU thread.  This is easily done with a check on current_cpu,
      i.e. qemu_in_vcpu_thread().

      Hopefully, multithreaded TCG will get rid of the whole logic to kick
      VCPUs whenever an I/O event occurs!

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-3-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e7f7a3c86f884a77296a137b7c730a4d580c5c9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:18 2015 +0200

      main-loop: use qemu_mutex_lock_iothread consistently

      The next patch will require the BQL to be always taken with
      qemu_mutex_lock_iothread(), while right now this isn't the case.

      Outside TCG mode this is not a problem.  In TCG mode, we need to be
      careful and avoid the "prod out of compiled code" step if already
      in a VCPU thread.  This is easily done with a check on current_cpu,
      i.e. qemu_in_vcpu_thread().

      Hopefully, multithreaded TCG will get rid of the whole logic to kick
      VCPUs whenever an I/O event occurs!

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-2-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdf026317daa3b9dfa281f29e96fbb6fd48394c8
  Author: 马文霜 <kevinnma@tencent.com>
  Date:   Wed Jul 1 15:41:41 2015 +0200

      Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES

      Last month, we experienced several guests crash(6cores-8cores), qemu logs
      display the following messages:

      qemu-system-x86_64: /build/qemu-2.1.2/kvm-all.c:976:
      kvm_irqchip_commit_routes: Assertion `ret == 0' failed.

      After analysis and verification, we can confirm it's irq-balance
      daemon(in guest) leads to the assertion failure. Start a 8 core guest with
      two disks, execute the following scripts will reproduce the BUG quickly:

      irq_affinity.sh
      ========================================================================

      vda_irq_num=25
      vdb_irq_num=27
      while [ 1 ]
      do
          for irq in {1,2,4,8,10,20,40,80}
              do
                  echo $irq > /proc/irq/$vda_irq_num/smp_affinity
                  echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
                  dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
                  dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
              done
      done
      ========================================================================

      QEMU setup static irq route entries in kvm_pc_setup_irq_routing(), PIC and
      IOAPIC share the first 15 GSI numbers, take up 23 GSI numbers, but take up
      38 irq route entries. When change irq smp_affinity in guest, a dynamic route
      entry may be setup, the current logic is: if allocate GSI number succeeds,
      a new route entry can be added. The available dynamic GSI numbers is
      1021(KVM_MAX_IRQ_ROUTES-23), but available irq route entries is only
      986(KVM_MAX_IRQ_ROUTES-38), GSI numbers greater than route entries.
      irq-balance's behavior will eventually leads to total irq route entries
      exceed KVM_MAX_IRQ_ROUTES, ioctl(KVM_SET_GSI_ROUTING) fail and
      kvm_irqchip_commit_routes() trigger assertion failure.

      This patch fix the BUG.

      Signed-off-by: Wenshuang Ma <kevinnma@tencent.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62ac4a52e27c706c860403fd1d8535a9a1073a19
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Dec 11 14:25:11 2014 +0100

      s390x/css: Add a callback for when subchannel gets disabled

      We need a possibility to run code when a subchannel gets disabled.
      This patch adds the necessary infrastructure.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6e7cd94462d65405037c993fc4401d6fceed6660
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 25 13:48:58 2015 +0200

      s390-ccw.img: update

      Update for "s390-ccw.img: Consume service interrupts".

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit bdc7fe3638fa7693eed5886b5b2afe0858d875fc
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Fri Jun 19 15:40:45 2015 +0200

      s390-ccw.img: Consume service interrupts

      We have to consume the outstanding service interrupt after each
      service call, otherwise a correct implementation will return
      CC=2 on subsequent service calls.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ec7353a146bb39c3bb3e5ccc50ca585aed97b7cf
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Jun 24 10:57:23 2015 +0200

      css: mss/mcss-e vs. migration

      Our main channel_subsys structure is not a device (yet), but we need
      to setup mss/mcss-e again if the guest had enabled it before. Use
      a hack that should catch most configurations (assuming that the guest
      will have enabled at least one device in higher subchannel sets or
      channel subsystems if it enabled the functionality.)

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fa8b0ca5d1b69975b715a259d3586cadf7a5280f
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Jun 23 15:46:31 2015 +0200

      virtio-ccw: complete handling of guest-initiated resets

      For a guest-initiated reset, we need to not only reset the virtio device,
      but also reset the VirtioCcwDevice into a clean state. This includes
      resetting the indicators, or else a guest will not be able to e.g.
      switch from classic interrupts to adapter interrupts.

      Split off this routine into a new function virtio_ccw_reset_virtio()
      to make the distinction between resetting the virtio-related devices
      and the base subchannel device clear.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d2966f804d70a244f5dde395fc5d22a50ed3e74e
  Merge: 2b464e1 a435612
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 17:03:20 2015 +0100

      Merge remote-tracking branch 'remotes/vivier/tags/pull-m68k-20150629' into staging

      Trivial m68k cleanup

      # gpg: Signature made Mon Jun 29 16:38:40 2015 BST using DSA key ID ABF36C53
      # gpg: Good signature from "Laurent Vivier <laurent@vivier.eu>"
      # gpg:                 aka "Laurent Vivier <Laurent@vivier.eu>"
      # gpg:                 aka "Laurent Vivier <Laurent@lvivier.info>"
      # gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
      # gpg:                 aka "[jpeg image of size 3881]"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 9EC7 B78A C0AC E697 5E4B  BDE3 34A4 F6C9 ABF3 6C53

      * remotes/vivier/tags/pull-m68k-20150629:
        m68k: remove useless parameter op_size from gen_lea_indexed()
        m68k: remove useless file m68k-qreg.h
        m68k: is_mem is useless

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a435612616202c837d62626dbe3e33a4e9a95772
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 02:51:49 2015 +0200

      m68k: remove useless parameter op_size from gen_lea_indexed()

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit bb337ac978b6def085eabf17830d5cc2a1bce6a8
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 02:07:24 2015 +0200

      m68k: remove useless file m68k-qreg.h

      Unused since:

          commit e1f3808e03f73e7a7fa966afbed2455dd052202e
          Author: pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
          Date:   Sat May 24 22:29:16 2008 +0000

              Convert m68k target to TCG.

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit 805167adcb900fa7b2b114d639c418f5313d0b42
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 01:00:22 2015 +0200

      m68k: is_mem is useless

      Remove is_mem as it is never tested anymore since:

          commit bfa50bc2638d877cf2900712b7503be22e8811cb
          Author: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
          Date:   Tue Nov 18 20:26:41 2008 +0000

              Remove premature memop TB terminations (Jan Kiszka)

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit 2b464e13f0d30e6c0b8f69ec908fceab30aea986
  Merge: dc1e135 5f37fd8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 13:26:43 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150629' into staging

      TriCore bugfixes

      # gpg: Signature made Mon Jun 29 13:08:17 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150629:
        target-tricore: fix depositing bits from PCXI into ICR

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f37fd8e2980818ab71bc4b4e21129e29acd73f7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 24 14:01:10 2015 +0200

      target-tricore: fix depositing bits from PCXI into ICR

      Spotted by Coverity, because (env->PCXI & MASK_PCXI_PCPN) >> 24
      is always zero.  The immediately preceding assignment is also
      wrong though.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1435147270-1040-1-git-send-email-pbonzini@redhat.com>

  commit dc1e1350f8061021df765b396295329797d66933
  Merge: d14b9d7 d46f7c9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 15:57:43 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, pci fixes, enhancements

      Almost exclusively bugfixes, though in this case,
      we are adding functionality to the pxb in order
      to make OVMF work on it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Fri Jun 26 14:43:27 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        Fix glib_subprocess test
        hw/pci-bridge: format special OFW unit address for PXB host
        hw/core: explicit OFW unit address callback for SysBusDeviceClass
        hw/pci-bridge: disable SHPC in PXB
        hw/pci-bridge: introduce "shpc" property
        hw/pci: introduce shpc_present() helper function
        hw/pci-bridge: add macro for "msi" property
        hw/pci-bridge: add macro for "chassis_nr" property
        hw/pci-bridge: expose _test parameter in SHPC_VMSTATE()
        migration: introduce VMSTATE_BUFFER_UNSAFE_INFO_TEST()
        add pci-bridge-seat
        pc: cleanup and convert TMP ACPI device description to AML API
        MAINTAINERS: add ACPI entry
        vhost: correctly pass error to caller in vhost_dev_enable_notifiers()
        balloon: add a feature bit to let Guest OS deflate balloon on oom
        qdev: fix OVERFLOW_BEFORE_WIDEN
        virito-pci: fix OVERRUN problem

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 41da4bd6420afd1209c408974920f63ff9c658e1
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:46 2015 -0700

      cpu-defs: Move out TB_JMP defines

      These are not Architecture specific in any way so move them out of
      cpu-defs.h. tb-hash.h is an appropriate place as a leading user and
      their strong relationship to TB hashing and caching.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <43ceca65a3fa240efac49aa0bf604ad0442e1710.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e1b89321bafea9fb33d87852fc91fee579d17dfe
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:45 2015 -0700

      include/exec: Move tb hash functions out

      This is one of very few things in exec-all with a genuine CPU
      architecture dependency. Move these hashing helpers to a new
      header to trim exec-all.h down to a near architecture-agnostic
      header.

      The defs are only used by cpu-exec and translate-all which are both
      arch-obj's so the new tb-hash.h has no core code usage.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <9d048b96f7cfa64a4d9c0b88e0dd2877fac51d41.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9e0dc48c9f05505b53cb28f860456a0648e56ddf
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:42 2015 -0700

      include/exec: Move standard exceptions to cpu-all.h

      These exception indicies are generic and don't have any reliance on the
      per-arch cpu.h defs. Move them to cpu-all.h so they can be used by core
      code that does not have access to cpu-defs.h.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <dbebd3062c7cd4332240891a3564e73f374ddfcd.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6e0b07306d1793e8402dd218d2e38a7377b5fc27
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:34 2015 -0700

      cpu-defs: Move CPU_TEMP_BUF_NLONGS to tcg

      The usages of this define are pure TCG and there is no architecture
      specific variation of the value. Localise it to the TCG engine to
      remove another architecture agnostic piece from cpu-defs.h.

      This follows on from a28177820a868eafda8fab007561cc19f41941f4 where
      temp_buf was moved out of the CPU_COMMON obsoleting the need for
      the super early definition.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <498e8e5325c1a1aff79e5bcfc28cb760ef6b214e.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 94beb661bd90bcb477eed6d3b07aced988c40163
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Jun 7 14:59:09 2015 -0700

      memory_mapping: Rework cpu related includes

      This makes it more consistent with all other core code files, which
      either just rely on qemu-common.h inclusion or precede cpu.h with
      qemu-common.h.

      cpu-all.h should not be included in addition to cpu.h. Remove it.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <1433714349-7262-1-git-send-email-crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 27e7755bea57c66097000f7612271ceefcbeb4a4
  Author: Artyom Tarasenko <atar4qemu@gmail.com>
  Date:   Tue Jun 23 14:30:18 2015 +0200

      cutils: allow compilation with icc

      Use VEC_OR macro for operations on VECTYPE operands

      Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
      Message-Id: <3f62d7a3a265f7dd99e50d016a0333a99a4a082a.1435062067.git.atar4qemu@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 34664507c7f038842f20a2c787915680b1fabba2
  Author: Artyom Tarasenko <atar4qemu@gmail.com>
  Date:   Tue Jun 23 14:30:17 2015 +0200

      qemu-common: add VEC_OR macro

      Intel C Compiler version 15.0.3.187 Build 20150407 doesn't support
      '|' function for non floating-point simd operands.

      Define VEC_OR macro which uses _mm_or_si128 supported
      both in icc and gcc on x86 platform.

      Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
      Message-Id: <54c804cdb3b3a93e93ef98f085dc57c4092580b7.1435062067.git.atar4qemu@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d14b9d79be8a424ebc66450d565b81eff2296d55
  Merge: ccb0c7e 4e2c0b2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:40:47 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150626' into staging

      target-arm queue:
       * Change the virt board's default interface type for block devices to virtio
       * Improve some error messages that will now be triggered by some incorrect
         but previously worked-by-accident command lines
       * Print ELR if we're doing debug logging of AArch64 exception entry
       * Handle the "completely empty semihosting commandline" correctly for
         softmmu (we already did for linux-user)
       * Add GICv2m description to ACPI tables for virt board
       * Fix some incorrect table revision entries in virt board ACPI tables

      # gpg: Signature made Fri Jun 26 14:29:39 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150626:
        hw/arm/virt: Make block devices default to virtio
        qdev-properties-system: Improve error message for drive assignment conflict
        qdev-properties-system: Change set_pointer's parse callback to use Error
        target-arm: A64: Print ELR when taking exceptions
        target-arm: default empty semihosting cmdline
        hw/arm/virt-acpi-build: Add GICv2m description in ACPI MADT table
        hw/arm/virt-acpi-build: Fix table revision and some comments

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e2c0b2a4ab810c8989e181a010e75aeaa1c55f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:37 2015 +0100

      hw/arm/virt: Make block devices default to virtio

      Now we have virtio-pci, we can make the virt board's default block
      device type be IF_VIRTIO. This allows users to use simplified
      command lines that don't have to explicitly create virtio-pci-blk
      devices; the -hda &c very short options now also work.

      This means we also need to set no_cdrom to avoid getting a
      default cdrom device -- this is needed because the virtio-blk
      device will fail if it is connected to a block backend with
      no media, which is what the default cdrom device typically is.
      Providing a cdrom with media via -cdrom will succeed, but silently
      create a device with non-removable medium. this is probably
      not really what the user wants, but is the best we can do now.

      Note that this change means that some command lines which used
      to work (by accident) will stop working. Where a drive was connected
      manually to a device but without 'if=none' being specified, we
      used to treat this as an IDE drive, which we would then not autoplug
      because the board doesn't support IDE. Now we will treat it as a
      virtio disk and autoplug it, which means the attempt to use the
      drive manually will fail:
        qemu-system-arm: -drive file=img.qcow2,id=foo: Drive 'foo' is already
        in use because it has been automatically connected to another device
        (did you need 'if=none' in the drive options?)
      The command line will have to be changed to include 'if=none', as the
      error message suggests.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-4-git-send-email-peter.maydell@linaro.org

  commit 62f7dbde4c75e48921fd1b773865250130c57bd8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      qdev-properties-system: Improve error message for drive assignment conflict

      If the user forgot if=none on their drive specification they're likely
      to get an error message because the drive is assigned once automatically
      by QEMU and once by the manual id=/drive= user command line specification.
      Improve the error message produced in this case to explicitly guide the
      user towards if=none.

      We rephrase the "drive conflict but not for an if=something" error as
      well to keep the wording in line.

      The two cases that change are:

      (1) Drive specified as to be auto-connected and also manually connected
      (and the board does handle this if= type):

        qemu-system-x86_64 -nodefaults -display none \
           -drive if=scsi,file=tmp.qcow2,id=foo -device ide-hd,drive=foo

      Previously:
        qemu-system-x86_64: -device ide-hd,drive=foo: Property 'ide-hd.drive'
        can't take value 'foo', it's in use

      Now:
        qemu-system-x86_64: -device ide-hd,drive=foo: Drive 'foo' is already in
        use because it has been automatically connected to another device (did
        you need 'if=none' in the drive options?)

      (2) Drive specified to be manually connected in two different ways:

        qemu-system-x86_64 -nodefaults -display none \
         -drive if=none,file=tmp.qcow2,id=foo -device ide-hd,drive=foo \
         -device ide-hd,drive=foo

      Previously:
        qemu-system-x86_64: -device ide-hd,drive=foo: Property 'ide-hd.drive'
        can't take value 'foo', it's in use

      Now:
        qemu-system-x86_64: -device ide-hd,drive=foo: Drive 'foo' is already in
        use by another device

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-3-git-send-email-peter.maydell@linaro.org

  commit f1fb9f0dc087c02b230be4cc96c5c76521f188fa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      qdev-properties-system: Change set_pointer's parse callback to use Error

      Instead of having set_pointer() call a parse callback which returns
      an error number that we then convert to an Error string with
      error_set_from_qdev_prop_error(), make the parse callback take an
      Error** and set the error itself. This will allow parse routines
      to provide more helpful error messages than the generic ones.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-2-git-send-email-peter.maydell@linaro.org

  commit b21ab1fc217b4a2b8f2f85d16bdd8510a7817a34
  Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      target-arm: A64: Print ELR when taking exceptions

      When taking an exception print the content of the exception link
      register. This is useful especially for synchronous exceptions because
      in that case this registers holds the address of the instruction that
      generated the exception.

      Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
      Message-id: 1435036655-16132-1-git-send-email-soren.brinkmann@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3c2bda216a00676e40301b5843ac3d6c3b2537a
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      target-arm: default empty semihosting cmdline

      If neither explicit semihosting args nor -kernel are used,
      make SYS_GET_CMDLINE return an empty string.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Message-id: AC7B5AFC-06AE-4FAD-9852-B65708E80E09@livius.net
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca7937365305d144cf0c97b907dac6f70ea152ef
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      hw/arm/virt-acpi-build: Add GICv2m description in ACPI MADT table

      Add GICv2m description in ACPI MADT table, so guest can use MSI when
      booting with ACPI.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Andrew Jones <drjones@redhat.com>
      Message-id: 1434676210-2276-1-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d0652b5765859049c96a13372bbe075be44e756b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      hw/arm/virt-acpi-build: Fix table revision and some comments

      The table revision is not the ACPI spec version. Fix the wrong revision
      and also some comments.

      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433820378-8336-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ccb0c7e122db72d3a5da798c6414d4912bba828f
  Merge: 0a4a031 4b3bcd0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 11:32:58 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150626' into staging

      MIPS patches 2015-06-26

      Changes:
      * MIPS UHI semihosting support
      * microMIPS32 R6 support

      # gpg: Signature made Fri Jun 26 10:42:33 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150626:
        target-mips: add mips32r6-generic CPU definition
        target-mips: microMIPS32 R6 POOL16{A, C} instructions
        target-mips: microMIPS32 R6 Major instructions
        target-mips: microMIPS32 R6 POOL32{I, C} instructions
        target-mips: microMIPS32 R6 POOL32F instructions
        target-mips: microMIPS32 R6 POOL32A{XF} instructions
        target-mips: microMIPS32 R6 branches and jumps
        target-mips: add microMIPS32 R6 opcode enum
        target-mips: signal RI for removed instructions in microMIPS R6
        target-mips: raise RI exceptions when FIR.PS = 0
        target-mips: rearrange gen_compute_compact_branch
        target-mips: refactor {D}LSA, {D}ALIGN, {D}BITSWAP
        target-mips: remove an unused argument
        target-mips: add microMIPS TLBINV, TLBINVF
        target-mips: fix {RD, WR}PGPR in microMIPS
        target-mips: convert host to MIPS errno values when required
        target-mips: add Unified Hosting Interface (UHI) support
        target-mips: remove identical code in different branch
        hw/mips: Do not clear BEV for MIPS malta kernel load
        include/softmmu-semi.h: Make semihosting support 64-bit clean

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b3bcd016d83cc75f6a495c1db54b6c77f037adc
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:27 2015 +0100

      target-mips: add mips32r6-generic CPU definition

      Define a new CPU definition supporting MIPS32 Release 6 ISA and
      microMIPS32 Release 6 ISA.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ed7ce6c0f9d4370826557ce33d652beb88ccb3e6
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:26 2015 +0100

      target-mips: microMIPS32 R6 POOL16{A, C} instructions

      microMIPS32 Release 6 POOL16A/ POOL16C instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ab39ee452d74855adec91056812b8e1e5166302c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:25 2015 +0100

      target-mips: microMIPS32 R6 Major instructions

      Add new microMIPS32 Release 6 Major opcode instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3b4a5489447e7ed17cc504572cf729833853e7ab
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:24 2015 +0100

      target-mips: microMIPS32 R6 POOL32{I, C} instructions

      Add new microMIPS32 Release 6 POOL32I/POOL32C type instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2a24a7badeb6ad3ba72e7984f299623035d564d6
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:23 2015 +0100

      target-mips: microMIPS32 R6 POOL32F instructions

      Add new microMIPS32 Release 6 POOL32F instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e03320958305a68f2bc6a32c87d7ed48303438f9
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:22 2015 +0100

      target-mips: microMIPS32 R6 POOL32A{XF} instructions

      Add new microMIPS32 Release 6 pool32a/pool32axf instructions.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 65935f070aa710cf340e96ae7ee36d2c1d5c8d15
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:21 2015 +0100

      target-mips: microMIPS32 R6 branches and jumps

      Add new microMIPS32 Release 6 branch and jump instructions.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3a1f426828cd8ffeec1a4fa8ca6ca3ed4f800edb
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:20 2015 +0100

      target-mips: add microMIPS32 R6 opcode enum

      Add microMIPS32 Release 6 opcode enum.
      Remove RI checking for pre-R6 reserved opcode.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9e8f441a7e094c0dc33a1c8f521d9e5bcfc1b4da
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:19 2015 +0100

      target-mips: signal RI for removed instructions in microMIPS R6

      Signal a Reserved Instruction exception for removed instruction encoding
      in microMIPS Release 6.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e29c962804c4dd3fabd44e703aa87eec555ed910
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:18 2015 +0100

      target-mips: raise RI exceptions when FIR.PS = 0

      64-bit paired-single (PS) floating point data type is optional in the
      pre-Release 6.
      It has to raise RI exception when PS type is not implemented. (FIR.PS = 0)
      (The PS data type is removed in the Release 6.)
      Loongson-2E and Loongson-2F don't have any implementation field in
      FCSR0(FIR) but do support PS data format, therefore for these cores RI will
      not be signalled regardless of PS bit.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6893f07466b045c5faf314ab9e57ef3b4a6f9e49
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:17 2015 +0100

      target-mips: rearrange gen_compute_compact_branch

      The function will be also used for microMIPS Release 6.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1f1b4c008e250f870719ed38fbd0bcc14322fc01
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:16 2015 +0100

      target-mips: refactor {D}LSA, {D}ALIGN, {D}BITSWAP

      Refactor those instructions in order to reuse them for microMIPS32
      Release 6.
      Rearrange gen_move_low32().

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f60eeb0c5ddd8ceb8ca6b3ba032159027afab67a
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:15 2015 +0100

      target-mips: remove an unused argument

      Remove an unused argument from decode_micromips32_opc()

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e60ec06357470db5a0f25901ca19b6237e6da927
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:14 2015 +0100

      target-mips: add microMIPS TLBINV, TLBINVF

      Add microMIPS TLBINV, TLBINVF

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1bf5902de03732d4067c4e90171a1741d6542c45
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:13 2015 +0100

      target-mips: fix {RD, WR}PGPR in microMIPS

      rt, rs were swapped

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2c44b19c199f4ce2f1721120744d3d6e5d01d274
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:44 2015 +0100

      target-mips: convert host to MIPS errno values when required

      Convert only errno values which can be returned by system calls in
      mips-semi.c and are not generic to all archs.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 3b3c1694cfd394b73de426edebdbf90c28f664fd
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:43 2015 +0100

      target-mips: add Unified Hosting Interface (UHI) support

      Add UHI semihosting support for MIPS. QEMU run with "-semihosting" option
      will alter the behaviour of SDBBP 1 instruction -- UHI operation will be
      called instead of generating a debug exception.

      Also tweak Malta's pseudo-bootloader. On CPU reset the $4 register is set
      to -1 if semihosting arguments are passed to indicate that the UHI
      operations should be used to obtain input arguments.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit ff334767728011218c62f7476232d260cb5b28e6
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:42 2015 +0100

      target-mips: remove identical code in different branch

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit d6ca4277eee98b3c561e21ac105199891d346d79
  Author: Matthew Fortune <matthew.fortune@imgtec.com>
  Date:   Fri Jun 19 11:08:41 2015 +0100

      hw/mips: Do not clear BEV for MIPS malta kernel load

      The BEV flag controls whether the boot exception vector is still
      in place when starting a kernel.  When cleared the exception vector
      at EBASE (or hard coded address of 0x80000000) is used instead.

      The early stages of the linux kernel would benefit from BEV still
      being set to ensure any faults get handled by the boot rom exception
      handlers.  This is a moot point for system qemu as there aren't really
      any BEV handlers, but there are other good reasons to change this...

      The UHI (semi-hosting interface) defines special behaviours depending
      on whether an application starts in an environment with BEV set or
      cleared. When BEV is set then UHI assumes that a bootloader is
      relatively dumb and has no advanced exception handling logic.
      However, when BEV is cleared then UHI assumes that the bootloader
      has the ability to handle UHI exceptions with its exception handlers
      and will unwind and forward UHI SYSCALL exceptions to the exception
      vector that was installed prior to running the application.

      Signed-off-by: Matthew Fortune <matthew.fortune@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9f6f7ca1490563d98003149e6de32caf25c670da
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Jun 19 11:08:40 2015 +0100

      include/softmmu-semi.h: Make semihosting support 64-bit clean

      Correct addresses passed around in semihosting to use a data type suitable
      for both 32-bit and 64-bit targets.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 0a4a0312bf8b029cbd32a97db2cad669cf65ac49
  Merge: 58e8b33 1e81aba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 25 14:03:55 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Wed Jun 24 16:37:23 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net: simplify net_client_init1()
        net: drop if expression that is always true
        net: raise an error if -net type is invalid
        net: replace net_client_init1() netdev whitelist with blacklist
        net: add missing "netmap" to host_net_devices[]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 58e8b33518fd2bb6dce0ba7b6347c3df85aea3c6
  Merge: 355df30 1204854
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 25 11:19:46 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Wed Jun 24 16:27:53 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        virito-blk: drop duplicate check
        qemu-iotests: fix 051.out after qdev error message change
        iov: don't touch iov in iov_send_recv()
        raw-posix: Introduce hdev_is_sg()
        raw-posix: Use DPRINTF for DEBUG_FLOPPY
        raw-posix: DPRINTF instead of DEBUG_BLOCK_PRINT
        Fix migration in case of scsi-generic
        block: Use bdrv_is_sg() everywhere
        nvme: Fix memleak in nvme_dma_read_prp
        vvfat: add a label option
        util/hbitmap: Add an API to reset all set bits in hbitmap
        virtio-blk: Use blk_drain() to drain IO requests
        block-backend: Introduce blk_drain()
        throttle: Check current timers before updating any_timer_armed[]
        block: Let bdrv_drain_all() to call aio_poll() for each AioContext

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1e81aba5ac0b908ab859bf8ddf43ece33732d49c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:52 2015 +0100

      net: simplify net_client_init1()

      Drop the union and move the hubport creation into the !is_netdev case.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-6-git-send-email-stefanha@redhat.com

  commit 4ef0defbad9bc8b195f3392d1b7dcb42cd7ebe11
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:51 2015 +0100

      net: drop if expression that is always true

      Both is_netdev and !is_netdev paths already check that
      net_client_init_func[opts->kind] is non-NULL so there is no need for the
      if statement.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-5-git-send-email-stefanha@redhat.com

  commit d139e9a6cf01b8c31f5904b4ba40521d7224f7de
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:50 2015 +0100

      net: raise an error if -net type is invalid

      When a -net type is used that was not compiled into the binary there
      should be an error message.

      Note the special case for -net none, which is a no-op.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-4-git-send-email-stefanha@redhat.com

  commit 1322629b4f25730aed973d51983e7a3b021fe9c9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:49 2015 +0100

      net: replace net_client_init1() netdev whitelist with blacklist

      It's cumbersome to keep the whitelist up-to-date.  New netdev backends
      should most likely be allowed so a blacklist makes more sense than a
      whitelist.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-3-git-send-email-stefanha@redhat.com

  commit 027a247bbf703e94258d07e38948946d7b85e91c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:48 2015 +0100

      net: add missing "netmap" to host_net_devices[]

      Although hmp-commands.hx lists "netmap" as a valid host_net_add type,
      the command rejects it because it's missing from the list.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432743412-15943-2-git-send-email-stefanha@redhat.com

  commit 12048545019cd1d64c8147ea9277648e685fa489
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Jun 24 17:29:24 2015 +0800

      virito-blk: drop duplicate check

      in_num = req->elem.in_num, and req->elem.in_num is
      checked in line 489, so the check about in_num variable
      is superflous, let's drop it.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435138164-11728-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a30c4eb2ce7b2c15ab556be3cfe2340c17271ddd
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jun 23 15:56:09 2015 +0100

      qemu-iotests: fix 051.out after qdev error message change

      Commit f006cf7fa9a63ba8e4ccf57d46231ce594301727 ("qdev-monitor:
      Propagate errors through qdev_device_add()") dropped a meaningless error
      message.  This change in output caused qemu-iotests 051 to fail:

         QEMU_PROG: -device ide-drive,drive=disk: Device initialization failed.
        -QEMU_PROG: -device ide-drive,drive=disk: Device 'ide-drive' could not be initialized

      Update 051.out so the test passes again.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435071369-30936-1-git-send-email-stefanha@redhat.com

  commit d46f7c9e648d8098ac73b36834ac81237b8c2c2d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 24 10:45:42 2015 +0100

      Fix glib_subprocess test

      A typo means that the tests dependent on glib with subprocess
      support are never run.

      Fixes: 9d41401b90fa10b335d2e739149d36437cfbf622

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 48ea3dedc54dbcb3c738ddef02a336739910ecfd
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:17 2015 +0200

      hw/pci-bridge: format special OFW unit address for PXB host

      We have agreed that OpenFirmware device paths in the "bootorder" fw_cfg
      file should follow the pattern

        /pci@i0cf8,%x/...

      for devices that live behind an extra root bus. The extra root bus in
      question is the %x'th among the extra root buses. (In other words, %x
      gives the position of the affected extra root bus relative to the other
      extra root buses, in bus_nr order.) %x starts at 1, and is formatted in
      hex.

      The portion of the unit address that comes before the comma is dynamically
      taken from the main host bridge, similarly to sysbus_get_fw_dev_path().

      Cc: Kevin O'Connor <kevin@koconnor.net>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0b336b3b98d8983d821ef9b0f159acc7c77cbac7
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:16 2015 +0200

      hw/core: explicit OFW unit address callback for SysBusDeviceClass

      The sysbus_get_fw_dev_path() function formats OpenFirmware device path
      nodes ("driver-name@unit-address") for sysbus devices. The first choice
      for "unit-address" is the base address of the device's first MMIO region.
      The second choice is its first IO port.

      However, if two sysbus devices with the same "driver-name" lack both MMIO
      and PIO resources, then there is no good way to distinguish them based on
      their OFW nodes, because in this case unit-address is omitted completely
      for both devices. An example is TYPE_PXB_HOST ("pxb-host").

      For the sake of such devices, introduce the explicit_ofw_unit_address()
      "virtual member function". With this function, each sysbus device in the
      same SysBusDeviceClass can state its own address.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Tested-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d10dda2d60c8c225a89a53d53add799b69f6bb46
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:14 2015 +0200

      hw/pci-bridge: disable SHPC in PXB

      OVMF downloads the ACPI linker/loader script from QEMU when the edk2 PCI
      Bus driver globally signals the firmware that PCI enumeration and resource
      allocation have completed. At this point QEMU regenerates the ACPI payload
      in an fw_cfg read callback, and this is when the PXB's _CRS gets
      populated.

      Unfortunately, when this happens, the PCI_COMMAND_MEMORY bit is clear in
      the root bus's command register, *unlike* under SeaBIOS. The consequences
      unfold as follows:

      - When build_crs() fetches dev->io_regions[i].addr, it is all-bits-one,
        because pci_update_mappings() --> pci_bar_address() calculated it as
        PCI_BAR_UNMAPPED, due to the PCI_COMMAND_MEMORY bit being clear.

      - Consequently, the SHPC MMIO BAR (bar 0) of the bridge is not added to
        the _CRS, *despite* having been programmed in PCI config space.

      - Similarly, the SHPC MMIO BAR of the PXB is not removed from the main
        root bus's DWordMemory descriptor.

      - Guest OSes (Linux and Windows alike) notice the pre-programmed SHPC BAR
        within the PXB's config space, and notice that it conflicts with the
        main root bus's memory resource descriptors. Linux reports

        pci 0000:04:00.0: BAR 0: can't assign mem (size 0x100)
        pci 0000:04:00.0: BAR 0: trying firmware assignment [mem
                                 0x88200000-0x882000ff 64bit]
        pci 0000:04:00.0: BAR 0: [mem 0x88200000-0x882000ff 64bit] conflicts
                                 with PCI Bus 0000:00 [mem
                                 0x88200000-0xfebfffff]

        While Windows Server 2012 R2 reports

          https://technet.microsoft.com/en-us/library/cc732199%28v=ws.10%29.aspx

          This device cannot find enough free resources that it can use. If you
          want to use this device, you will need to disable one of the other
          devices on this system. (Code 12)

      This issue was apparently encountered earlier, see the "hack" in:

        https://lists.nongnu.org/archive/html/qemu-devel/2015-01/msg02983.html

      and the current hole-punching logic in build_crs() and build_ssdt() is
      probably supposed to remedy exactly that problem -- however, for OVMF they
      don't work, because at the end of the PCI enumeration and resource
      allocation, which cues the ACPI linker/loader client, the command register
      is clear.

      The "shpc" property of "pci-bridge", introduced in the previous patches,
      allows us to disable the standard hotplug controller cleanly, eliminating
      the SHPC bar and the conflict.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4e5c9bfecf5da13e8e0f790002a55bb1cc0437b1
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:13 2015 +0200

      hw/pci-bridge: introduce "shpc" property

      In the PCI expander bridge, we will want to disable those features of
      pci-bridge that relate to SHPC (standard hotplug controller):

      - SHPC bar and underlying MemoryRegion
      - interrupt (INTx or MSI)
      - effective hotplug callbacks
      - other SHPC hooks (initialization, cleanup, migration etc)

      Introduce a new feature request bit in the PCIBridgeDev.flags field, and
      turn off the above if the bit is explicitly cleared.

      Suggested-by: Michael S. Tsirkin <mst@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 23ab143dcce8d7f758eb6946ebf68d8689018a9c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:12 2015 +0200

      hw/pci: introduce shpc_present() helper function

      It follows msi_present() in "include/hw/pci/msi.h".

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7a7c6a41c5583b24f6a35b02c7f68c84ebd7e177
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:11 2015 +0200

      hw/pci-bridge: add macro for "msi" property

      This should help catch property name typos at compile time.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3cf0ecb3c4f9bb6a7a58a62c0209509b4c9d13c6
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:10 2015 +0200

      hw/pci-bridge: add macro for "chassis_nr" property

      This should help catch property name typos at compile time.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0034e56209c1333bfca53356ce82663d801a15c5
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:09 2015 +0200

      hw/pci-bridge: expose _test parameter in SHPC_VMSTATE()

      Change the signature of the function-like macro SHPC_VMSTATE(), so that we
      can produce and expect this field conditionally in the migration stream,
      starting with an upcoming patch.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9df0b0e09c48ad543e6d12ee0c17d1857f83d3ca
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:08 2015 +0200

      migration: introduce VMSTATE_BUFFER_UNSAFE_INFO_TEST()

      There is no _TEST() variant of VMSTATE_BUFFER_UNSAFE_INFO() yet, but we'll
      soon need it. Introduce it and rebase the original
      VMSTATE_BUFFER_UNSAFE_INFO() on top.

      The parameter order of the new function-like macro follows that of
      VMSTATE_SINGLE_TEST(): "_test" is introduced between "_state" and
      "_version".

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 355df30554445c043a12168e9c5f912742050548
  Merge: 000d604 3de3d69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 18:25:55 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-06-23' into staging

      trivial patches for 2015-06-23

      # gpg: Signature made Tue Jun 23 18:23:45 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-06-23: (21 commits)
        util/qemu-sockets: improve ai_flag hints for ipv6 hosts
        hw/display/tcx.c: Fix memory leak
        hw/display/cg3.c: Fix memory leak
        Makefile: Add "make ctags"
        Makefile: Fix "make cscope TAGS"
        qemu-options: Use @itemx where appropriate
        qemu-options: Improve -global documentation
        throttle: Fix typo in the documentation of block_set_io_throttle
        hw/display/qxl-logger.c: Constify some variable
        configure: rearrange --help and consolidate enable/disable together
        libcacard: pkgconfig: tidy dependent libs
        vt82c686: QOMify
        xen_pt: QOMify
        wdt_i6300esb: QOMify
        piix4: QOMify
        piix: piix3 QOMify
        pci-assign: QOMify
        Print error when failing to load PCI config data
        Grammar: 'as to'->'as for'
        remove libdecnumber/dpd/decimal128Local.h
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3de3d698d942d1116152417f882c897b26b44e41
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Thu May 21 14:33:29 2015 +0200

      util/qemu-sockets: improve ai_flag hints for ipv6 hosts

      *) Do not use AI_ADDRCONFIG on listening sockets, because this flag
      makes it impossible to explicitly listen on '127.0.0.1' if no global
      ipv4 address is configured additionally, making this a very
      uncomfortable option.
      *) Add AI_V4MAPPED hint for connecting sockets.

      If your system is globally only connected via ipv6 you often still want
      to be able to use '127.0.0.1' and 'localhost' (even if localhost doesn't
      also have an ipv6 entry).
      For example, PVE - unless explicitly asking for insecure mode - uses
      ipv4 loopback addresses with QEMU for live migrations tunneled over SSH.
      These fail to start because AI_ADDRCONFIG makes getaddrinfo refuse to
      work with '127.0.0.1'.

      As for the AI_V4MAPPED flag: glibc uses it by default, and providing
      non-0 flags removes it. I think it makes sense to use it.

      I also want to point out that glibc explicitly sidesteps POSIX standards
      when passing 0 as hints by then assuming both AI_V4MAPPED and
      AI_ADDRCONFIG (the latter being a rather weird choice IMO), while
      according to POSIX.1-2001 it should be assumed 0. (glibc considers its
      choice an improvement.)
      Since either AI_CANONNAME or AI_PASSIVE are passed in our cases, glibc's
      default flags in turn are disabled again unless explicitly added, which
      I do with this patch.

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8684e85ca911b41d6a82ac5bcc5a0bfaba5eb7da
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 19:13:45 2015 +0800

      hw/display/tcx.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 22b2aeb82c811b227862c21e7a607087efbe5563
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 19:13:42 2015 +0800

      hw/display/cg3.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae5fdc81a16534ea04fc475f8723e81857c46ad4
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 22 13:35:08 2015 +0800

      Makefile: Add "make ctags"

      This generates ctags file

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit eaa2ddbb76798ec70d12351c0db43a7728d29150
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 22 13:35:07 2015 +0800

      Makefile: Fix "make cscope TAGS"

      Cscope and TAGS files work in source directory rather than the build
      directory, also, don't ask users to run configure first, because they
      may have an out of tree build.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f9cfd6555a3afb142a74a68438c6f4ee4c127e66
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 15 14:35:59 2015 +0200

      qemu-options: Use @itemx where appropriate

      Doesn't appear to make a difference, but let's use it consistently.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae08fd5a365e650d70acfe1d9027501707041b52
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 15 14:35:58 2015 +0200

      qemu-options: Improve -global documentation

      Recent commit 3751d7c "vl: allow full-blown QemuOpts syntax for
      -global" overloaded its existing argument syntax DRIVER.PROP=VALUE
      with QemuOpts syntax.  Unambigious as long as no DRIVER contains '='.

      Its documentation claims that "the two syntaxes are equivalent."
      Improve it to spell out how exactly the old syntax gets desugared into
      the new one.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6b932c0a5f951f1cfd3c459d8946074b9df8b829
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 15 16:12:52 2015 +0300

      throttle: Fix typo in the documentation of block_set_io_throttle

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a91e21186f81f712af8c02c7eec996ce25fb391f
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Thu Jun 11 14:17:56 2015 +0100

      hw/display/qxl-logger.c: Constify some variable

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c23f23b970ae8ce75d2254c64cf23d95a757811e
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 17 22:19:26 2015 +0300

      configure: rearrange --help and consolidate enable/disable together

      This is an attempt to rearrange configure --help output a bit
      and consolidate pairs of --enable/disable into its own section.

      After this, help text is easier to sort, manage and read.
      More descriptive text can be added as well, since we now have
      more space.

      While at it, mention en/dis-able-vte.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1e4db0595777b9b9a5a6a9f49ac3d187dda341f9
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 17 21:02:03 2015 +0300

      libcacard: pkgconfig: tidy dependent libs

      libcacard.pc file lists only one package in Requires
      field, which is nss, while glib-2.0 is also a requiriment.
      Furthermore, for libraries used internally by the library
      (this is the way nss and glib are used by libcacard),
      Requires.private shold be used instead of Requires.

      Fix both issues.

      This does not affect linking of qemu because it links
      with objects from libcacard directly.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 417349e6e95d9aa4e0fbc01434de30e8d405ab56
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:27 2015 +0800

      vt82c686: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f9b9d292afcb55f23b8863c0388a4b3e42c79747
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:26 2015 +0800

      xen_pt: QOMify

      Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 41fc9050fed524d300062fd8fe7aecd5c7adf5ac
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:25 2015 +0800

      wdt_i6300esb: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit acff3e48b7e1ac18e034cc612346bdc38ad96ee1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:24 2015 +0800

      piix4: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b7c69719d21bea305b7cff6ecde0974edc5ff4b8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:23 2015 +0800

      piix: piix3 QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1ea6305a834a01bba55309d012ee1fdc46c3eff2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:22 2015 +0800

      pci-assign: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7c59364d0329d36a7759033962a469ca714f884d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 3 17:58:01 2015 +0100

      Print error when failing to load PCI config data

      When loading migration fails due to a disagreement about
      PCI config data we don't currently get any errors explaining
      that was the cause of the problem or which byte in the config
      data was at fault.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4aab6282f8e1f7652b0470b078a08ab5678fb929
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 3 19:43:56 2015 +0100

      Grammar: 'as to'->'as for'

      Fixup migrate-incoming text as requested by Eric in:

       http://lists.nongnu.org/archive/html/qemu-devel/2015-03/msg03362.html

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bfa3ab619731653e752c7cf0ab3395ec8e70fe79
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 3 17:37:27 2015 +0300

      remove libdecnumber/dpd/decimal128Local.h

      Commit 72ac97cdfc added two equivalent versions of decimal128Local.h,
      one in libdecnumber/dpd/ and another in include/libdecnumber/dpd/.
      Being identical by the code, the two files however differs in the
      licensing terms.  The one in libdecnumber/dpd/ (which is being
      removed by this patch) is licensed as GPL3.1 (plus gcc runtime
      exception), which, as far as I know, is not compatible with GPL-2.
      This file is not used (it is included from
      include/libdecnumber/dpd/decimal128.h, so version in include/ is
      used).

      More, the version in include/ can also be removed, since none
      of the 3 defines from that file are actually used by the code.
      Even more, one of the defines from there, decimal128SetSign,
      is redefined (to equivalent value) in libdecnumber/dpd/decimal128.c,
      but again, never used.

      What a mess...

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4969e90b8110d6880d1a7fcb3cab27c316a0d3e
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Jun 3 14:22:41 2015 +0100

      configure: append --extra-ldflags to LDFLAGS

      The help text says --extra-ldflags is appended to LDFLAGS so make it so.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 000d6042da0d73e5a71318b5fa96e5a084534d12
  Merge: 6966b2a ffffbb3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 17:46:20 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-220615-3' into staging

      xen-220615, more SOB lines

      # gpg: Signature made Tue Jun 23 17:19:08 2015 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-220615-3:
        Revert "xen-hvm: increase maxmem before calling xc_domain_populate_physmap"
        xen/pass-through: constify some static data
        xen/pass-through: log errno values rather than function return ones
        xen/pass-through: ROM BAR handling adjustments
        xen/pass-through: fold host PCI command register writes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffffbb369f3ed9bca5ff2867143f76d0c6e069c0
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Jun 22 13:00:42 2015 +0000

      Revert "xen-hvm: increase maxmem before calling xc_domain_populate_physmap"

      This reverts commit c1d322e6048796296555dd36fdd102d7fa2f50bf.

      The original commit fixes a bug when assigning a large number of
      devices which require option roms to a guest.  (One known
      configuration that needs extra memory is having more than 4 emulated
      NICs assigned.  Three or fewer NICs seems to work without this
      functionality.)

      However, by unilaterally increasing maxmem, it introduces two
      problems.

      First, now libxl's calculation of the required maxmem during migration
      is broken -- any guest which exercised this functionality will fail on
      migration.  (Guests which have the default number of devices are not
      affected.)

      Secondly, it makes it impossible for a higher-level toolstack or
      administer to predict how much memory a VM will actually use, making
      it much more difficult to effectively use all of the memory on a
      machine.

      Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 74526eb01886ca45774c1e9c736f61536fa2bda1
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jun 5 13:04:55 2015 +0100

      xen/pass-through: constify some static data

      This is done indirectly by adjusting two typedefs and helps emphasizing
      that the respective tables aren't supposed to be modified at runtime
      (as they may be shared between devices).

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 3782f60d2047cb86567889307ce78baacf518635
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jun 5 13:04:18 2015 +0100

      xen/pass-through: log errno values rather than function return ones

      Functions setting errno commonly return just -1, which is of no
      particular use in the log file.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 69976894c1d91c4b0c985fa05936cb6b8d01382b
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Mon Jun 8 14:11:51 2015 +0100

      xen/pass-through: ROM BAR handling adjustments

      Expecting the ROM BAR to be written with an all ones value when sizing
      the region is wrong - the low bit has another meaning (enable/disable)
      and bits 1..10 are reserved. The PCI spec also mandates writing all
      ones to just the address portion of the register.

      Use suitable constants also for initializing the ROM BAR register field
      description.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 950fe0aa3f55ad6bb135fc9cde9ebf4df05f62fc
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri May 15 13:46:11 2015 +0100

      xen/pass-through: fold host PCI command register writes

      The code introduced to address XSA-126 allows simplification of other
      code in xen_pt_initfn(): All we need to do is update "cmd" suitably,
      as it'll be written back to the host register near the end of the
      function anyway.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit eb6c6a604890201e321a6ace32973d10dc033245
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 18 12:17:29 2015 +0200

      add pci-bridge-seat

      Simplifies multiseat configuration, see
      docs/multiseat.txt update for details.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72d97b3a543a9c2c820bd463ba24751ae4247ac3
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Tue Jun 9 05:31:53 2015 +0200

      pc: cleanup and convert TMP ACPI device description to AML API

      remove some code duplication in acpi-build.c and drop 5
      ASL and binary blobs files with TPM ACPI device description,
      replacing them with 1 small hunk written in AML API.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0e0b3592f6cfc56b3a4cc2c040552b7caaf2329f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jun 23 08:09:34 2015 +0200

      MAINTAINERS: add ACPI entry

      Igor agreed to help review ACPI patches, add an entry to MAINTAINERS
      with all ACPI stuff I could think of.
      Note: I listed ARM ACPI files here just to make sure we are Cc'd, no
      plan to maintain ACPI for ARM through my tree :)

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 16617e36b02ebdc83f215d89db9ac00f7d6d6d83
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:13:14 2015 +0800

      vhost: correctly pass error to caller in vhost_dev_enable_notifiers()

      We override the error value r in fail_vq, this will cause the caller
      can't detect the failure which may cause the caller may disable the
      notifiers twice if vhost is failed to start. Fix this by using another
      variable to keep track the return value of set_host_notifier().

      Fixes b0b3db79559e57db340b292621c397e7a6cdbdc5 ("vhost-net: cleanup
      host notifiers at last step")

      Cc: qemu-stable@nongnu.org
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e3816255bf4b6377bb405331e2ee0dc14d841b80
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Mon Jun 15 13:52:52 2015 +0300

      balloon: add a feature bit to let Guest OS deflate balloon on oom

      Excessive virtio_balloon inflation can cause invocation of OOM-killer,
      when Linux is under severe memory pressure. Various mechanisms are
      responsible for correct virtio_balloon memory management. Nevertheless it
      is often the case that these control tools does not have enough time to
      react on fast changing memory load. As a result OS runs out of memory and
      invokes OOM-killer. The balancing of memory by use of the virtio balloon
      should not cause the termination of processes while there are pages in the
      balloon. Now there is no way for virtio balloon driver to free memory at
      the last moment before some process get killed by OOM-killer.

      This does not provide a security breach as balloon itself is running
      inside Guest OS and is working in the cooperation with the host. Thus
      some improvements from Guest side should be considered as normal.

      To solve the problem, introduce a virtio_balloon callback which is
      expected to be called from the oom notifier call chain in out_of_memory()
      function. If virtio balloon could release some memory, it will make the
      system return and retry the allocation that forced the out of memory
      killer to run.

      This behavior should be enabled if and only if appropriate feature bit
      is set on the device. It is off by default.

      This functionality was recently merged into vanilla Linux.

        commit 5a10b7dbf904bfe01bb9fcc6298f7df09eed77d5
        Author: Raushaniya Maksudova <rmaksudova@parallels.com>
        Date:   Mon Nov 10 09:36:29 2014 +1030

      This patch adds respective control bits into QEMU. It introduces
      deflate-on-oom option for balloon device which does the trick.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Raushaniya Maksudova <rmaksudova@parallels.com>
      CC: Anthony Liguori <aliguori@amazon.com>
      CC: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      Acked-by: James Bottomley <JBottomley@Odin.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 6b64640dd25846c4de42aa433db56e0ff975993a
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Thu May 21 09:50:10 2015 +0800

      iov: don't touch iov in iov_send_recv()

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-id: 555D39D2.4000705@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3307ed7b3fac5ba99eb3b84904b0b7cdc3592a61
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:45:00 2015 +0300

      raw-posix: Introduce hdev_is_sg()

      Until now, an SG device was identified only by checking if its path
      started with "/dev/sg". Then, hdev_open() would set the bs->sg flag
      accordingly. The patch relies on the actual properties of the device
      instead of the specified file path.

      To this end, test for an SG device (e.g. /dev/sg0) by ensuring that
      all of the following holds:

       - The specified file name corresponds to a character device
       - The device supports the SG_GET_VERSION_NUM ioctl
       - The device supports the SG_GET_SCSI_ID ioctl

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Message-id: 1435056300-14924-6-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a93a3982a6645463fa822131d38b17284edd5633
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:59 2015 +0300

      raw-posix: Use DPRINTF for DEBUG_FLOPPY

      Get rid of several #ifdef DEBUG_FLOPPY and substitute them with
      DPRINTF.

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-5-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bcb225550dcc0d6fcef8e97012bae572ba78f73a
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:58 2015 +0300

      raw-posix: DPRINTF instead of DEBUG_BLOCK_PRINT

      Building the QEMU tools fails if we #define DEBUG_BLOCK inside
      block/raw-posix.c. Here instead of adding qemu-log.o in block-obj-y
      so that DEBUG_BLOCK_PRINT can be used, we substitute the latter with
      a simple DPRINTF() (that does not cause bit-rot).

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-4-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1b6bc94d5d43ff3e39abadae19f2dbcb0954eb93
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:57 2015 +0300

      Fix migration in case of scsi-generic

      During migration, QEMU uses fsync()/fdatasync() on the open file
      descriptor for read-write block devices to flush data just before
      stopping the VM.

      However, fsync() on a scsi-generic device returns -EINVAL which
      causes the migration to fail. This patch skips flushing data in case
      of an SG device, since submitting SCSI commands directly via an SG
      character device (e.g. /dev/sg0) bypasses the page cache completely,
      anyway.

      Note that fsync() not only flushes the page cache but also the disk
      cache. The scsi-generic device never sends flushes, and for
      migration it assumes that the same SCSI device is used by the
      destination host, so it does not issue any SCSI SYNCHRONIZE CACHE
      (10) command.

      Finally, remove the bdrv_is_sg() test from iscsi_co_flush() since
      this is now redundant (we flush the underlying protocol at the end
      of bdrv_co_flush() which, with this patch, we never reach).

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-3-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b192af8acc597a6e8068873434e56e0c7de1b7d3
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:56 2015 +0300

      block: Use bdrv_is_sg() everywhere

      Instead of checking bs->sg use bdrv_is_sg() consistently throughout
      the code.

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-2-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 25940fa7e57ffce9d495b4c2aadc39790535856d
  Author: Lu Lina <lina.lulina@huawei.com>
  Date:   Fri Jun 19 14:27:34 2015 +0800

      nvme: Fix memleak in nvme_dma_read_prp

      Signed-off-by: Lu Lina <lina.lulina@huawei.com>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Message-id: 1434695254-69808-1-git-send-email-kathy.wangting@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d5941ddae82a35771656d7e35f64f7f8f19c5627
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Fri Jun 19 11:35:29 2015 +0200

      vvfat: add a label option

      Until now the vvfat volume label was hardcoded to be
      "QEMU VVFAT", now you can pass a file.label=labelname option
      to the -drive to change it.

      The FAT structure defines the volume label to be limited to
      11 bytes and is filled up spaces when shorter than that. The
      trailing spaces however aren't exposed to the user by
      operating systems.

      [Added missing comment '#' characters in block-core.json to fix build
      errors.
      --Stefan]

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Message-id: 1434706529-13895-2-git-send-email-w.bumiller@proxmox.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c6a8c3283f1d53e360073bdb32f87a97e78e2880
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Fri May 22 09:29:46 2015 +0800

      util/hbitmap: Add an API to reset all set bits in hbitmap

      The function bdrv_clear_dirty_bitmap() is updated to use
      faster hbitmap_reset_all() call.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 555E868A.60506@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e40b3bfc7e82823cf4df5f0bf668f56db41e53a
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 17 13:37:20 2015 +0300

      virtio-blk: Use blk_drain() to drain IO requests

      Each call of the virtio_blk_reset() function calls blk_drain_all(),
      which works for all existing BlockDriverStates, while draining only
      one is needed.

      This patch replaces blk_drain_all() by blk_drain() in
      virtio_blk_reset(). virtio_blk_data_plane_stop() should be called
      after draining because it restores vblk->complete_request.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Message-id: 1434537440-28236-3-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 97b0385a346829cf03efe131a26a4b6a4cd0a21f
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 17 13:37:19 2015 +0300

      block-backend: Introduce blk_drain()

      This patch introduces the blk_drain() function which allows to replace
      blk_drain_all() when only one BlockDriverState needs to be drained.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1434537440-28236-2-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2f388b93a147258f9dbc83ebe63365edac4aa7a2
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 15 18:41:15 2015 +0300

      throttle: Check current timers before updating any_timer_armed[]

      Calling throttle_group_config() cancels all timers from a particular
      BlockDriverState, so any_timer_armed[] should be updated accordingly.

      However, with the current code it may happen that a timer is armed in
      a different BlockDriverState from the same group, so any_timer_armed[]
      would be set to false in a situation where there is still a timer
      armed.

      The consequence is that we might end up with two timers armed. This
      should not have any noticeable impact however, since all accesses to
      the ThrottleGroup are protected by a lock, and the situation would
      become normal again shortly thereafter as soon as all timers have been
      fired.

      The correct way to solve this is to check that we're actually
      cancelling a timer before updating any_timer_armed[].

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1434382875-3998-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f406c03c093f1451ac0ba7fde31eeb78e5e5e417
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 10 14:38:17 2015 +0300

      block: Let bdrv_drain_all() to call aio_poll() for each AioContext

      After the commit 9b536adc ("block: acquire AioContext in
      bdrv_drain_all()") the aio_poll() function got called for every
      BlockDriverState, in assumption that every device may have its own
      AioContext. If we have thousands of disks attached, there are a lot of
      BlockDriverStates but only a few AioContexts, leading to tons of
      unnecessary aio_poll() calls.

      This patch changes the bdrv_drain_all() function allowing it find shared
      AioContexts and to call aio_poll() only for unique ones.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-id: 1433936297-7098-4-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6966b2a07190004e18ede33ce50a65009b36f3a6
  Merge: a320697 a5d4d7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 13:32:50 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150623-1' into staging

      virtio-input: property fixes, add evdev passthrough

      # gpg: Signature made Tue Jun 23 09:33:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150623-1:
        Add MAINTAINERS entry for virtio-input
        virtio-input: evdev passthrough
        virtio-input: move properties, use virtio_instance_init_common

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3206972a9eab65ec8e8f9ae320ad628ba4b58f1
  Merge: 0c8ff72 a0b1a66
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 10:38:00 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-22' into staging

      Monitor patches

      # gpg: Signature made Mon Jun 22 18:56:18 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-06-22: (24 commits)
        Include monitor/monitor.h exactly where needed
        Include qapi/qmp/qerror.h exactly where needed
        qerror: Move #include out of qerror.h
        qerror: Finally unused, clean up
        qmp: Wean off qerror_report()
        tpm: Avoid qerror_report() outside QMP command handlers
        qerror: Clean up QERR_ macros to expand into a single string
        qerror: Eliminate QERR_DEVICE_NOT_FOUND
        vl: Use error_report() for --display errors
        vl: Avoid qerror_report() outside QMP command handlers
        QemuOpts: Wean off qerror_report_err()
        qdev-monitor: Propagate errors through qdev_device_add()
        qdev-monitor: Propagate errors through set_property()
        qdev-monitor: Convert qbus_find() to Error
        qdev-monitor: Fix check for full bus
        qdev-monitor: Stop error avalanche in qbus_find_recursive()
        disas: Remove uses of CPU env
        monitor: Split mon_get_cpu fn to remove ENV_GET_CPU
        monitor: Fix failure path for "S" argument
        monitor: Point to "help" command on syntax error
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a5d4d7b580f42c47d240a2068c810e4147147f6e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jun 19 10:25:34 2015 +0200

      Add MAINTAINERS entry for virtio-input

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 006a5edebe656114e0e0a6fb24b8aae6401c1cf4
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 28 09:18:47 2014 +0100

      virtio-input: evdev passthrough

      This allows to assign host input devices to the guest:

      qemu -device virtio-input-host-pci,evdev=/dev/input/event<nr>

      The guest gets exclusive access to the input device, so be careful
      with assigning the keyboard if you have only one connected to your
      machine.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6f2b9a5b24c488d38ace01910c684749ff922e26
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 18 17:45:47 2015 +0200

      virtio-input: move properties, use virtio_instance_init_common

      Move properties from virtio-*-pci to virtio-*-device.
      Also make better use of QOM and attach common properties
      to the abstract parent classes (virtio-input-device and
      virtio-input-pci-device).

      Switch the hid device instance init functions over to use
      virtio_instance_init_common, so we get the properties of the
      virtio device aliased properly to the virtio pci proxy.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1fa795a853255fcc93e5d3e2a92d161a2ed96eb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:53:05 2015 +0800

      qdev: fix OVERFLOW_BEFORE_WIDEN

      Potentially overflowing expression "1 << prop->bitnr" with
      type "int" (32 bits, signed) is evaluated using 32-bit arithmetic,
      and then used in a context that expects an expression of type
      "uint64_t" (64 bits, unsigned).

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3750dabc69d76f0938cc726a64a70e4ae2fe21df
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:53:04 2015 +0800

      virito-pci: fix OVERRUN problem

      Overrunning array "proxy->guest_features" of 2 4-byte
      elements at element index 2 (byte offset 8) using index
      "proxy->gfselect" (which evaluates to 2). Normally, the
      Linux kernel driver just read/write '0' or '1' as the
      "proxy->gfselect" values, so using '<' instead of '=<' to
      make coverity happy and avoid potential harm.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a0b1a66ea39bca011108734147a72232a4d08c7a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 18:16:21 2015 +0100

      Include monitor/monitor.h exactly where needed

      In particular, don't include it into headers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit cc7a8ea740ec74a144e866a1d24aa6b490e31923
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 17:22:46 2015 +0100

      Include qapi/qmp/qerror.h exactly where needed

      In particular, don't include it into headers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit d49b68364414d649b8e26232f2a600d415611662
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 18:29:20 2015 +0100

      qerror: Move #include out of qerror.h

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4629ed1e98961bbe678db68ef5f4342ff174a6c3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 14:29:59 2015 +0100

      qerror: Finally unused, clean up

      Remove it except for two things in qerror.h:

      * Two #include to be cleaned up separately to avoid cluttering this
        patch.

      * The QERR_ macros.  Mark as obsolete.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 485febc6d1382a82e4e1640729fffbf0c1392a44
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 17:25:50 2015 +0100

      qmp: Wean off qerror_report()

      The traditional QMP command handler interface

          int qmp_FOO(Monitor *mon, const QDict *params, QObject **ret_data);

      doesn't provide for returning an Error object.  Instead, the handler
      is expected to stash it in the monitor with qerror_report().

      When we rebased QMP on top of QAPI, we didn't change this interface.
      Instead, commit 776574d introduced "middle mode" as a temporary aid
      for converting existing QMP commands to QAPI one by one.  More than
      three years later, we're still using it.

      Middle mode has two effects:

      * Instead of the native input marshallers

            static void qmp_marshal_input_FOO(QDict *, QObject **, Error **)

        it generates input marshallers conforming to the traditional QMP
        command handler interface.

      * It suppresses generation of code to register them with
        qmp_register_command()

        This permits giving them internal linkage.

      As long as we need qmp-commands.hx, we can't use the registry behind
      qmp_register_command(), so the latter has to stay for now.

      The former has to go to get rid of qerror_report().  Changing all QMP
      commands to fit the QAPI mold in one go was impractical back when we
      started, but by now there are just a few stragglers left:
      do_qmp_capabilities(), qmp_qom_set(), qmp_qom_get(), qmp_object_add(),
      qmp_netdev_add(), do_device_add().

      Switch middle mode to generate native input marshallers, and adapt the
      stragglers.  Simplifies both the monitor code and the stragglers.

      Rename do_qmp_capabilities() to qmp_capabilities(), and
      do_device_add() to qmp_device_add, because that's how QMP command
      handlers are named today.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 8b53a19675d2329695179e47aa3797692fb0d9ba
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 12:09:02 2015 +0100

      tpm: Avoid qerror_report() outside QMP command handlers

      qerror_report() is a transitional interface to help with converting
      existing monitor commands to QMP.  It should not be used elsewhere.
      Replace by error_report().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c6bd8c706a799eb0fece99f468aaa22b818036f3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 11:54:50 2015 +0100

      qerror: Clean up QERR_ macros to expand into a single string

      These macros expand into error class enumeration constant, comma,
      string.  Unclean.  Has been that way since commit 13f59ae.

      The error class is always ERROR_CLASS_GENERIC_ERROR since the previous
      commit.

      Clean up as follows:

      * Prepend every use of a QERR_ macro by ERROR_CLASS_GENERIC_ERROR, and
        delete it from the QERR_ macro.  No change after preprocessing.

      * Rewrite error_set(ERROR_CLASS_GENERIC_ERROR, ...) into
        error_setg(...).  Again, no change after preprocessing.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 75158ebbe259f0bd8bf435e8f4827a43ec89c877
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 16 08:57:47 2015 +0100

      qerror: Eliminate QERR_DEVICE_NOT_FOUND

      Error classes other than ERROR_CLASS_GENERIC_ERROR should not be used
      in new code.  Hiding them in QERR_ macros makes new uses hard to spot.
      Fortunately, there's just one such macro left.  Eliminate it with this
      coccinelle semantic patch:

          @@
          expression EP, E;
          @@
          -error_set(EP, QERR_DEVICE_NOT_FOUND, E)
          +error_set(EP, ERROR_CLASS_DEVICE_NOT_FOUND, "Device '%s' not found", E)

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c6bf0f7ffa90c720377eb6bddd27037041acbc5b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 18:23:45 2015 +0100

      vl: Use error_report() for --display errors

      Results in nicer error messages.  Before this patch:

          Invalid GTK option string: gtk,lirum-larum

      After:

          qemu-system-x86_64: -display gtk,lirum-larum: Invalid GTK option string

      Of course, the thing ought to use QemuOpts instead of parsing by hand.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 1459407e88632e6d66cd6b71326eaf78e0a80772
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 09:47:12 2015 +0100

      vl: Avoid qerror_report() outside QMP command handlers

      qerror_report() is a transitional interface to help with converting
      existing monitor commands to QMP.  It should not be used elsewhere.
      Replace by error_report() in initial startup helpers parse_sandbox()
      and parse_add_fd().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 70b9433109ed99217b812f19800de550e2e0ecd5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 12:50:26 2015 +0100

      QemuOpts: Wean off qerror_report_err()

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      The only remaining user in qemu-option.c is qemu_opts_parse().  Is it
      used in QMP context?  If not, we can simply replace
      qerror_report_err() by error_report_err().

      The uses in qemu-img.c, qemu-io.c, qemu-nbd.c and under tests/ are
      clearly not in QMP context.

      The uses in vl.c aren't either, because the only QMP command handlers
      there are qmp_query_status() and qmp_query_machines(), and they don't
      call it.

      Remaining uses:

      * drive_def(): Command line -drive and such, HMP drive_add and pci_add

      * hmp_chardev_add(): HMP chardev-add

      * monitor_parse_command(): HMP core

      * tmp_config_parse(): Command line -tpmdev

      * net_host_device_add(): HMP host_net_add

      * net_client_parse(): Command line -net and -netdev

      * qemu_global_option(): Command line -global

      * vnc_parse_func(): Command line -display, -vnc, default display, HMP
        change, QMP change.  Bummer.

      * qemu_pci_hot_add_nic(): HMP pci_add

      * usb_net_init(): Command line -usbdevice, HMP usb_add

      Propagate errors through qemu_opts_parse().  Create a convenience
      function qemu_opts_parse_noisily() that passes errors to
      error_report_err().  Switch all non-QMP users outside tests to it.

      That leaves vnc_parse_func().  Propagate errors through it.  Since I'm
      touching it anyway, rename it to vnc_parse().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f006cf7fa9a63ba8e4ccf57d46231ce594301727
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 14:00:41 2015 +0100

      qdev-monitor: Propagate errors through qdev_device_add()

      Also polish an error message while I'm touching the line anyway,

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit 4caa489d1337c1a72d2e36185e4586ad246b98e1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 13:58:02 2015 +0100

      qdev-monitor: Propagate errors through set_property()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit d282842999b914c38c8be4659012aa619c22af8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 19:16:04 2015 +0100

      qdev-monitor: Convert qbus_find() to Error

      As usual, the conversion breaks printing explanatory messages after
      the error: actual printing of the error gets delayed, so the
      explanations precede rather than follow it.

      Pity.  Disable them for now.  See also commit 7216ae3.

      While there, eliminate QERR_BUS_NOT_FOUND, and clean up unusual
      spelling in the error message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ed238ba2a0239368dd0cec9bfaf3300a5bd303ce
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 18:39:16 2015 +0100

      qdev-monitor: Fix check for full bus

      Property bus has always been too screwed up to be really usable for
      values other than plain bus IDs.  This just fixes a bug that crept in
      in commit 1395af6 "qdev: add a maximum device allowed field for the
      bus."

      It doesn't always fail when it should:

          $ qemu-system-x86_64 -nodefaults -device virtio-serial-pci -device virtio-rng-device,bus=pci.0/virtio-serial-pci/virtio-bus

      Happily plugs the virtio-rng-device into the virtio-bus provided by
      virtio-serial-pci, even though its only slot is already occupied by a
      virtio-serial-device.

      And sometimes fails when it shouldn't:

          $ qemu-system-x86_64 -nodefaults -device virtio-serial-pci -device virtserialport,bus=virtio-bus/virtio-serial-device

      Yes, the virtio-bus is full, but the virtio-serial-bus provided by
      virtio-serial-device isn't, and that's the one we're trying to use.

      Root cause: we check "bus full" when we resolve the first element of
      the path.  That's the correct one only when it's also the last one.

      Fix by moving the "bus full" check to right before we return a bus.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a5ec494e274ddcad6d487e3872e16964ef57e0de
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 17:26:31 2015 +0100

      qdev-monitor: Stop error avalanche in qbus_find_recursive()

      Reproducer:

          $ qemu-system-x86_64 -nodefaults -device virtio-rng-pci -device virtio-rng-pci -device virtio-rng-device,bus=virtio-bus
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' is full
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' is full
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' not found

      qbus_find_recursive() reports the "is full" error itself, and leaves
      reporting "not found" to its caller.  The result is confusion.  Write
      it a function contract that permits leaving all error reporting to the
      caller, and implement it.  Update callers to detect and report "is
      full".

      Screwed up when commit 1395af6 added the max_dev limit and the "is
      full" error condition to enforce it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d49190c4208f2c556c3a01962a81f8a85d522bb1
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 14:20:41 2015 -0700

      disas: Remove uses of CPU env

      disas does not need to access the CPU env for any reason. Change the
      APIs to accept CPU pointers instead. Small change pattern needs to be
      applied to all target translate.c. This brings us closer to making
      disas.o a common-obj and less architecture specific in general.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 5bcda5f7349da01aded719b595f32ce2b9d396db
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 14:20:40 2015 -0700

      monitor: Split mon_get_cpu fn to remove ENV_GET_CPU

      The monitor currently has one helper, mon_get_cpu() which will return
      an env pointer. The target specific users of this API want an env, but
      all the target agnostic users really just want the cpu pointer. These
      users then need to use the target-specifically defined ENV_GET_CPU to
      navigate back up to the CPU from the ENV. Split the API for the two
      uses cases to remove all need for ENV_GET_CPU.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e549d2aaeba1cfac207c9a9675cc203e6372a22e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:10 2015 -0400

      monitor: Fix failure path for "S" argument

      Since the "S" argument type is only used with the "?" flag,
      the bug can't bite.

      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit dd41eea77129a4cd8ae5170b02e0fee175af314e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:09 2015 -0400

      monitor: Point to "help" command on syntax error

      When a command fails due to incorrect syntax or input, suggest using
      the "help" command to get more information about the command.  This
      is only applicable for HMP.

      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ae50212ff717f3d295ebff352eb7d6cc08332b7e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:08 2015 -0400

      monitor: cleanup parsing of cmd name and cmd arguments

      There's too much going on in monitor_parse_command().
      Split up the arguments parsing bits into a separate function
      monitor_parse_arguments(). Let the original function check for
      command validity and sub-commands if any and return data (*cmd)
      that the newly introduced function can process and return a
      QDict. Also, pass a pointer to the cmdline to track current
      parser location.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19f2db5c84e563597bd8b3c3190aef591060dec2
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:07 2015 -0400

      monitor: remove debug prints

      The preferred solution is to use tracepoints and there
      is good chance of bitrot with the debug prints not being
      enabled at compile time. Remove them.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 34acbc95229f9f841bde83691a5af949c15e105b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri May 15 16:25:00 2015 -0600

      qobject: Use 'bool' inside qdict

      Now that qbool is fixed, let's fix getting and setting a bool
      value to a qdict member to also use C99 bool rather than int.

      I audited all callers to ensure that the changed return type
      will not cause any changed semantics.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fc48ffc39ed1060856475e4320d5896f26c945e8
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri May 15 16:24:59 2015 -0600

      qobject: Use 'bool' for qbool

      We require a C99 compiler, so let's use 'bool' instead of 'int'
      when dealing with boolean values.  There are few enough clients
      to fix them all in one pass.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0c8ff723bd29e5c8b2ca989f857ae5c37ec49c4e
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:26 2015 +1000

      m68k: fix usp processing on interrupt entry and exception exit

      The action to potentially switch sp register is not occurring at the correct
      point in the interrupt entry or exception exit sequences.

      For the interrupt entry case the sp on entry is used to create the stack
      exception frame - but this may well be the user stack pointer, since we
      haven't done the switch yet. Re-order the flow to switch the sp regs then
      use the current sp to create the exception frame.

      For the return from exception case the code is unwinding the sp after
      switching sp registers. But it should always unwind the supervisor sp
      first, then carry out any required sp switch.

      Note that these problems don't effect operation unless the user sp bit is
      set in the CACR register. Only a single sp is used in the default power up
      state. Previously Linux only used this single sp mode. But modern versions
      of Linux use the user sp mode now, so we need correct behavior for Linux
      to work.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Laurent Vivier <laurent@vivier.eu>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-4-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a8327e8a8288e301a2f01bc3ca2d465a3a4ca78
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:25 2015 +1000

      m68k: implement move to/from usp register instruction

      Fill out the code support for the move to/from usp instructions. They are
      being decoded, but there is no code to support there actions. So add it.

      Current versions of Linux running on the ColdFire 5208 use these instructions.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Laurent Vivier <laurent@vivier.eu>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-3-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c52f0cbba76310ad626e54996dbce08c7a8a820
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:24 2015 +1000

      m68k: implement more ColdFire 5208 interrupt controller functionality

      Implement the SIMR and CIMR registers of the 5208 interrupt controller.
      These are used by modern versions of Linux running on ColdFire (not sure
      of the exact version they were introduced, but they have been in for quite
      a while now).

      Without this change when attempting to run a linux-3.5 kernel you will
      see:

        qemu: hardware error: mcf_intc_write: Bad write offset 28

      and execution will stop and dump out.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-2-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0a3346f5dea0a679322df804e1e78d7c10d12a9f
  Merge: cb4e0f9 daeba96
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 22 12:50:30 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Changes to name string ownership for alias properties
      * Improvements around enum properties
      * Cleanups around -object handling
      * New helper functions
      * Cleanups of qdev init helper functions
      * Add path argument to qom-tree script
      * QTest cleanup to use new qtest_add_data_func() consistently

      # gpg: Signature made Fri Jun 19 18:14:38 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qdev: Un-deprecate qdev_init_nofail()
        qdev: Deprecated qdev_init() is finally unused, drop
        qom: Don't pass string table to object_get_enum() function
        qom: Add an object_property_add_enum() helper function
        qom: Make enum string tables const-correct
        qom: Add object_new_with_props() / object_new_withpropv() helpers
        qom: Add helper function for getting user objects root
        vl: Create (most) objects before creating chardev backends
        doc: Document user creatable object types in help text
        backends: Fix typename of 'policy' enum property in hostmem obj
        scripts: Add support for path as argument of qom-tree
        tests: Use qtest_add_data_func() consistently
        qdev: Free property names after registering gpio aliases
        qom: strdup() target property name on object_property_add_alias()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cb4e0f9ddf7d45de7e4716cbab661ea568bd0b6c
  Merge: ad7020a e4a511f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 22 11:50:07 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * i8254 security fix
      * Avoid long 100% CPU wait after restarting guests that use the periodic timer
      * Fixes for access clamping (WinXP, MIPS)
      * wixl/.msi support for qemu-ga on Windows

      # gpg: Signature made Fri Jun 19 11:30:53 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: clamp accesses against the MemoryRegionSection
        exec: do not clamp accesses to MMIO regions
        mc146818rtc: Reset the periodic timer on load
        qemu-timer: Call clock reset notifiers on forward jumps
        tests: virtio-scsi: Add test for unaligned WRITE SAME
        tests: virtio-scsi: Move start/stop to individual test functions
        libqos: Complete virtio device ID definition list
        libqos: Allow calling guest_free on NULL pointer
        tests: Link libqos virtio object to virtio-scsi-test
        i8254: fix out-of-bounds memory access in pit_ioport_read()
        qemu-ga: Building Windows MSI installation with configure/Makefile
        qemu-ga: Introduce Windows MSI script
        qemu-ga: debug printouts to help troubleshoot installation
        qemu-ga: adding vss-[un]install options
        qemu-log: Open file for logging when specified

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ad7020a7e7b27d468ecc2aacb04ba4eb09017074
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:52 2015 -0700

      target-microblaze: Remove dead code

      This code is already being run in the mb_cpu_realizefn()
      function. As PVR registers are preserved on reset this
      code is not required.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 033af8e9aaba1994c4816cea5828aaddc383a907
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:48 2015 -0700

      s3adsp1800: Remove the hardcoded values from the reset

      Remove the hardcoded values from the machine specific reset
      function, as the same values are already set in the standard
      MicroBlaze reset.

      This also allows the entire reset function to be deleted, as
      PVR registers are now preserved on reset.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a87310a62d1885b8f6d6b5b30227cbd9792d2c3c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:45 2015 -0700

      ml605_mmu: Move the hardcoded values to the init function

      Move the hard coded register values to the init function.
      This also allows the entire reset function to be deleted, as
      PVR registers are now preserved on reset.

      The hardcoded PVR0 values can be removed as they are setting
      the endianness and stack protection, which is already done
      or invalid.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 6fad9e986b82c7c7ed7cfa0cc3ee38b3510a5432
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:42 2015 -0700

      target-microblaze: Convert pvr-full to a CPU property

      Originally the pvr-full PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 72e38754853443830152a3cfe586db1d9b15e8fe
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:38 2015 -0700

      target-microblaze: Convert version_mask to a CPU property

      Originally the version_mask PVR bits were manually set for each
      machine. This is a hassle and difficult to read, instead set them
      based on the CPU properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a88bbb006a523deabb90245a283d1914abd34e3e
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:35 2015 -0700

      target-microblaze: Convert endi to a CPU property

      Originally the endi PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a6c3ed24748f06742413e174167b0faa7030c244
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:32 2015 -0700

      target-microblaze: Convert dcache-writeback to a CPU property

      Originally  the dcache-writeback PVR bits were manually set for each machine.
      This is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 714461237083c1eadcb9d686f8ce4088737c1d0a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:29 2015 -0700

      target-microblaze: Convert use-mmu to a CPU property

      Originally the use-mmu PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit be67e9ab9740d5a80e5c37bfd35247a4e449bc5a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:25 2015 -0700

      target-microblaze: Rename the usefpu variable

      Rename the usefpu variable to use_fpu.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f44c475cb6ded298486a589c4205ab70e485b48c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:32:35 2015 +1000

      target-microblaze: Disable stack protection by default

      Stack protection is not available when the MMU is enabled.
      As the MMU is enabled by default, disable stack protection
      by default.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 4e5d45ae5756123b3b7000c8b0b3d3a9ea4737da
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:31:58 2015 +1000

      target-microblaze: Convert use-fpu to a CPU property

      Originally the use-fpu PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f27183abaaaf48e9d1f8469c7e99a987444f4410
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:31:20 2015 +1000

      target-microblaze: Tidy up the base-vectors property

      Rename the "xlnx.base-vectors" string to "base-vectors" and
      move the base_vectors variable into the cfg struct.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 9aaaa181949e4a23ca298fb7006e2d8bac842e92
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:30:43 2015 +1000

      target-microblaze: Allow the stack protection to be disabled

      Microblaze stack protection is configurable and isn't always enabled.
      This patch allows the stack protection to be disabled from the
      CPU properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 8bac22423e4c3b70082dd6c1b492ccf21f3b5a0c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:30:05 2015 +1000

      target-microblaze: Preserve the pvr registers during reset

      Move the Microblaze PVR registers to the end of the CPUMBState
      and preserve them during reset. This is similar to what the
      QEMU ARM model does with some of it's registers.

      This allows the Microblaze PVR registers to only be set once
      at realise instead of constantly at reset.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 53432dc9ea37d3be4c8efc3023c2382e9da5334a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:29:28 2015 +1000

      target-microblaze: Fix up indentation

      Fix up the incorrect indentation level in the helper_stackprot() function.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit d87636b18f8de901e76bedd9c7f55d3eaed924ee
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 20:31:40 2015 -0700

      microblaze: s3adsp: Instantiate CPU using QOM

      Instantiate and realise the CPU directly, rather than using
      cpu_mb_init. Microblazes cpu_model argument is a dummy so remove the
      default cpu_model set logic.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit daeba9699d41ad79e2f3d34acea9c85c5d67a2ac
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 19 16:17:23 2015 +0200

      qdev: Un-deprecate qdev_init_nofail()

      It's a perfectly sensible helper function.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 0210afe6690be045cb849b2f16bffabda575a9bf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 19 16:17:22 2015 +0200

      qdev: Deprecated qdev_init() is finally unused, drop

      qdev_init() is a wrapper around setting property "realized" to true,
      plus error handling that passes errors to qerror_report_err().
      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      All code has been modernized to avoid qdev_init() and its
      inappropriate error handling.  We can finally drop it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a3590dacce94519c1747d8bf423744c6bb7d9941
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 27 16:07:56 2015 +0100

      qom: Don't pass string table to object_get_enum() function

      Now that properties can be explicitly registered as an enum
      type, there is no need to pass the string table to the
      object_get_enum() function. The object property registration
      already has a pointer to the string table.

      In changing this method signature, the hostmem backend object
      has to be converted to use the new enum property registration
      code, which simplifies it somewhat.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a8e3fbedc827f992657f5670212e854f62ec12ad
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:08 2015 +0100

      qom: Add an object_property_add_enum() helper function

      A QOM property can be parsed as enum using the visit_type_enum()
      helper function, but this forces callers to use the more complex
      generic object_property_add() method when registering it. It
      also requires that users of that object have access to the
      string map when they want to read the property value.

      This patch introduces a specialized object_property_add_enum()
      method which simplifies the use of enum properties, so the
      setters/getters directly get passed the int value.

        typedef enum {
           MYDEV_TYPE_FROG,
           MYDEV_TYPE_ALLIGATOR,
           MYDEV_TYPE_PLATYPUS,

           MYDEV_TYPE_LAST
        } MyDevType;

      Then provide a table of enum <-> string mappings

        static const char *const mydevtypemap[MYDEV_TYPE_LAST + 1] = {
           [MYDEV_TYPE_FROG] = "frog",
           [MYDEV_TYPE_ALLIGATOR] = "alligator",
           [MYDEV_TYPE_PLATYPUS] = "platypus",
           [MYDEV_TYPE_LAST] = NULL,
        };

      Assuming an object struct of

         typedef struct {
            Object parent_obj;
            MyDevType devtype;
            ...other fields...
         } MyDev;

      The property can then be registered as follows:

         static int mydev_prop_get_devtype(Object *obj,
                                           Error **errp G_GNUC_UNUSED)
         {
             MyDev *dev = MYDEV(obj);

             return dev->devtype;
         }

         static void mydev_prop_set_devtype(Object *obj,
                                            int value,
                                            Error **errp G_GNUC_UNUSED)
         {
             MyDev *dev = MYDEV(obj);

             dev->devtype = value;
         }

         object_property_add_enum(obj, "devtype",
                                  mydevtypemap, "MyDevType",
                                  mydev_prop_get_devtype,
                                  mydev_prop_set_devtype,
                                  NULL);

      Note there is no need to check the range of 'value' in
      the setter, because the string->enum conversion code will
      have already done that and reported an error as required.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2e4450ff432daef524cb3557fca68a3b7b5c7823
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:07 2015 +0100

      qom: Make enum string tables const-correct

      The enum string table parameters in various QOM/QAPI methods
      are declared 'const char *strings[]'. This results in const
      warnings if passed a variable that was declared as

         static const char * const strings[] = { .... };

      Add the extra const annotation to the parameters, since
      neither the string elements, nor the array itself should
      ever be modified.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a31bdae5a76ecc060c1eb8a66be1896072c1e8b2
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:06 2015 +0100

      qom: Add object_new_with_props() / object_new_withpropv() helpers

      It is reasonably common to want to create an object, set a
      number of properties, register it in the hierarchy and then
      mark it as complete (if a user creatable type). This requires
      quite a lot of error prone, verbose, boilerplate code to achieve.

      First a pair of functions object_set_props() / object_set_propv()
      are added which allow for a list of objects to be set in
      one single API call.

      Then object_new_with_props() / object_new_with_propv() constructors
      are added which simplify the sequence of calls to create an
      object, populate properties, register in the object composition
      tree and mark the object complete, into a single method call.

      Usage would be:

         Error *err = NULL;
         Object *obj;
         obj = object_new_with_propv(TYPE_MEMORY_BACKEND_FILE,
                                     object_get_objects_root(),
                                     "hostmem0",
                                     &err,
                                     "share", "yes",
                                     "mem-path", "/dev/shm/somefile",
                                     "prealloc", "yes",
                                     "size", "1048576",
                                     NULL);

      Note all property values are passed in string form and will
      be parsed into their required data types, using normal QOM
      semantics for parsing from string format.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit bc2256c4ae86308a1521c89456b599d441119418
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:05 2015 +0100

      qom: Add helper function for getting user objects root

      Add object_get_objects_root() function which is a convenience for
      obtaining the Object * located at /objects in the object
      composition tree. Convert existing code over to use the new
      API where appropriate.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f08f9271bfe3f19a5eb3d7a2f48532065304d5c8
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:04 2015 +0100

      vl: Create (most) objects before creating chardev backends

      Some types of object must be created before chardevs, other types of
      object must be created after chardevs. As such there is no option but
      to create objects in two phases.

      This takes the decision to create as many object types as possible
      right away before anyother backends are created, and only delay
      creation of those few which have an explicit dependency on the
      chardevs. Hopefully the set which need delaying will remain small
      over time.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b9174d4f250cacb43b7cd9e07cf9f86818d62afd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:03 2015 +0100

      doc: Document user creatable object types in help text

      The QEMU help for -object is essentially useless, just giving users
      the generic syntax. Move it down into its own section and introduce
      a nested table where each user creatable object can be documented.
      The existing memory-backend-file, rng-random and rng-egd object
      types are documented.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b1028b4e8683740cd257a9b77577734664e61511
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:02 2015 +0100

      backends: Fix typename of 'policy' enum property in hostmem obj

      The 'policy' property was being registered with a typename of
      'str', but it is in fact an enum of the 'HostMemPolicy' type.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 799810fb2810ec4cb82f12ec9b023e1bfe434d71
  Merge: ffdb140 a59d31a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 17:05:15 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150619' into staging

      target-arm queue:
       * support --semihosting-config,arg=value
       * Cortex-R5 support (including implementing them on the Zynq board)
       * Cortex-M4 support (without FPU)
       * enable vfio-calxeda-xgmac
       * don't reset ALIAS sysregs

      # gpg: Signature made Fri Jun 19 14:41:54 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150619:
        semihosting: add --semihosting-config arg sub-argument
        semihosting: create SemihostingConfig structure and semihost.h
        arm: xlnx-zynqmp: Add 2xCortexR5 CPUs
        arm: xlnx-zynqmp: Add boot-cpu property
        arm: xlnx-zynqmp: Preface CPU variables with "apu"
        target-arm: Add support for Cortex-R5
        target-arm: Implement PMSAv7 MPU
        target-arm: Add registers for PMSAv7
        target-arm/helper.c: define MPUIR register
        target-arm: Do not reset sysregs marked as ALIAS
        hw/arm/sysbus-fdt: enable vfio-calxeda-xgmac dynamic instantiation
        target-arm: Add the Cortex-M4 CPU

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a59d31a1ebdce796a469242800db89bf09c94580
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      semihosting: add --semihosting-config arg sub-argument

      Add new "arg" sub-argument to the --semihosting-config allowing the user
      to pass multiple input arguments separately. It is required for example
      by UHI semihosting to construct argc and argv.

      Also, update ARM semihosting to support new option (at the moment it is
      the only target which cares about arguments).

      If the semihosting is enabled and no semihosting args have been specified,
      then fall back to -kernel/-append. The -append string is split on whitespace
      before initializing semihosting.argv[1..n]; this is different from what
      QEMU MIPS machines' pseudo-bootloaders do (i.e. argv[1] contains the whole
      -append), but is more intuitive from UHI user's point of view and Linux
      kernel just does not care as it concatenates argv[1..n] into single cmdline
      string anyway.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1434643256-16858-3-git-send-email-leon.alrae@imgtec.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cfe67cef48696e8b901aff38a82056ae64d69c98
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      semihosting: create SemihostingConfig structure and semihost.h

      Remove semihosting_enabled and semihosting_target and replace them with
      SemihostingConfig structure containing equivalent fields. The structure
      is defined in vl.c where it is actually set.

      Also introduce separate header file include/exec/semihost.h allowing to
      access semihosting config related stuff from target specific semihosting
      code.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1434643256-16858-2-git-send-email-leon.alrae@imgtec.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b58850e79d8df1185bd4999df81fbe6954cd2790
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Add 2xCortexR5 CPUs

      Add the 2xCortexR5 CPUs to zynqmp board. They are powered off on reset
      (this is true of real hardware) by default or selectable as the boot
      processor.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: da34128c73ca13fc4f8c3293e1a33d1e1e345655.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6396a193d36e10ff38f26d4ef785aba97362f29e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Add boot-cpu property

      Add a string property that specifies the primary boot cpu. All CPUs
      except the one selected will start-powered-off. This allows for elf
      boots on any CPU, which prepares support for booting R5 elfs directly
      on the R5 processors.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 53331c00d80c7ce9c6a83712348773f1b38fae2b.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e5577bc5563ccf453249e884be9a223deabab5b
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Preface CPU variables with "apu"

      The CPUs currently supported by zynqmp are the APU (application
      processing unit) CPUs. There are other CPUs in Zynqmp so unqualified
      "cpus" in ambiguous. Preface the variables with "APU" accordingly, to
      prepare support adding the RPU (realtime processing unit) processors.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: ce32287fc365aea898465e981da3546a227e0811.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d6a6b13ea1dfeb25c43a648e94cfe4395906f1da
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      target-arm: Add support for Cortex-R5

      Introduce a CPU model for the Cortex R5 processor. ARMv7 with MPU,
      and both thumb and ARM div instructions.

      Also implement dummy ATCM and BTCM. These CPs are defined for R5 but
      don't have a lot of meaning in QEMU yet. Raz them so the guest can
      proceed if they are read. The TCM registers will return a size of 0,
      indicating no TCM.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: efe213163e6800578494aba864ac30329de4d396.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f6bda88ff839e2adefe4959b7def420b90703855
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      target-arm: Implement PMSAv7 MPU

      Unified MPU only. Uses ARM architecture major revision to switch
      between PMSAv5 and v7 when ARM_FEATURE_MPU is set. PMSA v6 remains
      unsupported and is asserted against.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: dcb03cda6dd754c5cc6a962fa11f25089811e954.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cb0b013a1fa421cdfb83257cd33f855cc90649a
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Add registers for PMSAv7

      Define the arm CP registers for PMSAv7 and their accessor functions.
      RGNR serves as a shared index that indexes into arrays storing the
      DRBAR, DRSR and DRACR registers. DRBAR and friends have to be VMSDd
      separately from the CP interface using a new PMSA specific VMSD
      subsection.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 172cf135fbd8f5cea413c00e71cc1c3cac704744.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3281af8114c6b8ead02f08b58e3c36895c1ea047
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm/helper.c: define MPUIR register

      Define the MPUIR register for MPU supporting ARMv6 and onwards.
      Currently we only support unified MPU.

      The size of the unified MPU is defined via the number of "dregions".
      So just a single config is added to specify this size. (When split MPU
      is implemented we will add an extra iregions config).

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 9f248950b803a08c8b3c978931663182f7e882e7.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b061a82b8afcc45ce09d770d9c0acdf429401054
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Do not reset sysregs marked as ALIAS

      cp_reg_reset() is called from g_hash_table_foreach() which does not
      define a specific ordering of the hash table iteration. Thus doing reset
      for registers marked as ALIAS would give an ambiguous result when
      resetvalue is different for original and alias registers. Exit
      cp_reg_reset() early when passed an alias register. Then clean up alias
      register definitions from needless resetvalue and resetfn.

      In particular, this fixes a bug in the handling of the PMCR register,
      which had different resetvalues for its 32 and 64-bit views.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1434554713-10220-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit decf4f807b4498ca35a87e9de82bc9a4e64cc29a
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      hw/arm/sysbus-fdt: enable vfio-calxeda-xgmac dynamic instantiation

      This patch allows the instantiation of the vfio-calxeda-xgmac device
      from the QEMU command line (-device vfio-calxeda-xgmac,host="<device>").

      A specialized device tree node is created for the guest, containing
      compat, dma-coherent, reg and interrupts properties.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1434455898-17895-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ba890a9b2509a0087bb7eafddae02ea5ecbb7bb4
  Author: Aurelio C. Remonda <aurelioremonda@gmail.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Add the Cortex-M4 CPU

      This patch adds the Cortex-M4 CPU. The M4 is basically the same as
      the M3, the main differences being the DSP instructions and an
      optional FPU.  Only no-FPU cortex-M4 is implemented here, cortex-M4F
      is not because the core target-arm code doesn't support the M-profile
      FPU model yet.

      Signed-off-by: Aurelio C. Remonda <aurelioremonda@gmail.com>
      Message-id: 1434461850-4104-1-git-send-email-aurelioremonda@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffdb1409a79c9cc91afd9f58df625fdca16bf8b9
  Merge: 89e9429 693a3e0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 12:54:08 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150619-1' into staging

      cocoa queue:
       * Add Machine menu, with entries for pause, resume, reset, power down, and
         media change and eject for removable drives

      # gpg: Signature made Fri Jun 19 11:24:11 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-cocoa-20150619-1:
        ui/cocoa.m: Add machine menu items to change and eject removable drive media
        ui/cocoa.m: Add Reset and Power Down menu items to Machine menu
        ui/cocoa.m: Add Machine menu with pause and resume menu items

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 89e9429c3cb42400f3a80890e0c20b18aa62a11d
  Merge: 473a494 1e7398a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 11:30:57 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, pci fixes, enhancements

      Most notably this includes virtio cross-endian patches.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Fri Jun 19 11:18:05 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        vhost: enable vhost without without MSI-X
        pci: Don't register a specialized 'config_write' if default behavior is intended
        hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()
        vhost_net: re-enable when cross endian
        vhost-net: tell tap backend about the vnet endianness
        tap: fix non-linux build
        tap: add VNET_LE/VNET_BE operations
        vhost: set vring endianness for legacy virtio
        virtio: introduce virtio_legacy_is_cross_endian()
        linux-headers: sync vhost.h
        vhost-user: part of virtio

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e4a511f8cc6f4a46d409fb5c9f72c38ba45f8d83
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 17 10:36:54 2015 +0200

      exec: clamp accesses against the MemoryRegionSection

      Because the clamping was done against the MemoryRegion,
      address_space_rw was effectively broken if a write spanned
      multiple sections that are not linear in underlying memory
      (with the memory not being under an IOMMU).

      This is visible with the MIPS rc4030 IOMMU, which is implemented
      as a series of alias memory regions that point to the actual RAM.

      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 965eb2fcdfe919ecced6c34803535ad32dc1249c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 17 10:40:27 2015 +0200

      exec: do not clamp accesses to MMIO regions

      It is common for MMIO registers to overlap, for example a 4 byte register
      at 0xcf8 (totally random choice... :)) and a 1 byte register at 0xcf9.
      If these registers are implemented via separate MemoryRegions, it is
      wrong to clamp the accesses as the value written would be truncated.

      Hence for these regions the effects of commit 23820db (exec: Respect
      as_translate_internal length clamp, 2015-03-16, previously applied as
      commit c3c1bb99) must be skipped.

      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae46e23964ad45d5bc72374040e87d8f52ac2178
  Author: Paul Donohue <qemu-devel@PaulSD.com>
  Date:   Fri Jun 12 10:10:14 2015 -0400

      mc146818rtc: Reset the periodic timer on load

      When loading a VM from a snapshot or migration, clock changes can cause
      the periodic timer to stall or loop rapidly.

      qemu-timer has a reset notifier mechanism that is used to avoid timer
      stalls or loops if the host clock changes while the VM is running when
      using QEMU_CLOCK_HOST.  However, when loading a snapshot or migration,
      qemu-timer is initialized and fires the reset notifier before
      mc146818rtc is initialized and has registered its reset handler.  In
      addition, this mechanism isn't used when using QEMU_CLOCK_REALTIME,
      which might also change when loading a snapshot or migration.

      To correct that problem, this commit resets the periodic timer after
      loading from a snapshot or migration if the clock has either jumped
      backward or has jumped forward by more than the clock jump limit that
      is used by the reset notifier code in qemu-timer.

      Signed-off-by: Paul Donohue <qemu-git@PaulSD.com>
      Message-Id: <20150612141013.GE2749@TopQuark.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb1a3a051d89975f26296163066bb0745ecca49d
  Author: Paul Donohue <qemu-devel@PaulSD.com>
  Date:   Fri Jun 12 10:08:45 2015 -0400

      qemu-timer: Call clock reset notifiers on forward jumps

      Commit 691a0c9c introduced a mechanism by which QEMU_CLOCK_HOST can
      notify other parts of the emulator when the host clock has jumped
      backward.  This is used to avoid stalling timers that were scheduled
      based on the host clock.

      However, if the host clock jumps forward, then timers that were
      scheduled based on the host clock may fire rapidly and cause other
      problems.  For example, the mc146818rtc periodic timer will block
      execution of the VM and consume host CPU while firing every interrupt
      for the time period that was skipped by the host clock.

      To correct that problem, this commit fires the reset notification if the
      host clock jumps forward by more than a hard-coded limit.  The limit is
      currently set to a value of 60 seconds, which should be small enough to
      prevent excessive timer loops, but large enough to avoid frequent resets
      in idle VMs.

      Signed-off-by: Paul Donohue <qemu-git@PaulSD.com>
      Message-Id: <20150612140845.GD2749@TopQuark.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 397c767b2de5b918a7b890d02aae83d6dcb2a470
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:20 2015 +0800

      tests: virtio-scsi: Add test for unaligned WRITE SAME

      This is an exercise for virtio-scsi tests using the libqos virtio
      library. A few common routines are added to facilitate future extensions
      of the test set.

      The added test case is a regression test for the bug in d7f4b1999e.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 693a3e01af8082f855094061650311fcaf3e1269
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add machine menu items to change and eject removable drive media

      Adds all removable devices to the Machine menu as a Change and Eject menu
      item pair. ide-cd0 would have a "Change ide-cd0..." and "Eject ide-cd0"
      menu items.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 270746142c3c96549ecd82c6097a6d85a35f27cf
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add Reset and Power Down menu items to Machine menu

      Add "Reset" and "Power Down" menu items to Machine menu.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1e7398a140f7a6bd9f5a438e7ad0f1ef50990e25
  Author: Pankaj Gupta <pagupta@redhat.com>
  Date:   Tue Jun 16 13:48:59 2015 +0530

      vhost: enable vhost without without MSI-X

      We use vhostforce to enable vhost even if Guests don't have MSI-X
      support and we fall back to QEMU virtio-net.

      This gives a very small performance gain, but the disadvantage
      is that guest now controls which virtio code is running
      (qemu or vhost) so our attack surface is doubled.

      This patch will enable vhost unconditionally whenever it's requested.
      For compatibility, enable vhost when vhostforce is set, as well.

      Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 74de5504fd063019433ec0746105da774ede790d
  Author: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
  Date:   Tue Jun 16 11:24:39 2015 +0300

      pci: Don't register a specialized 'config_write' if default behavior is intended

      Few devices have their specialized 'config_write' methods which simply
      call 'pci_default_write_config' followed by a 'msix_write_config' or
      'msi_write_config' calls, using exact same arguments.

      This is unnecessary as 'pci_default_write_config' already invokes
      'msi_write_config' and 'msix_write_config'.

      Also, since 'pci_default_write_config' is the default 'config_write'
      handler, we can simply avoid the registration of these specialized
      versions.

      Cc: Leonid Shatz <leonid.shatz@ravellosystems.com>
      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5ba03e2dd785362026917e4cc8a1fd2c64e8e62c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Jun 17 14:45:03 2015 +0200

      hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()

      This is done mainly for improving readability, and in preparation for the
      next patch, but Markus pointed out another bonus for the string being
      returned:

      "No arbitrary length limit. Before the patch, it's 39 characters, and the
      code breaks catastrophically when qdev_fw_name() is longer: the second
      snprintf() is called with its first argument pointing beyond path[], and
      its second argument underflowing to a huge size."

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Tested-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1717388645670336c48aa05d19b0acd07687a821
  Author: Cédric Le Goater <clg@fr.ibm.com>
  Date:   Wed Jun 17 15:23:54 2015 +0200

      vhost_net: re-enable when cross endian

      Cross-endianness is now checked by the core vhost code.

      revert 371df9f5e0f1 "vhost-net: disable when cross-endian"

      Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
      [ added commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ]
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:49 2015 +0200

      vhost-net: tell tap backend about the vnet endianness

      The default behaviour for TAP/MACVTAP is to consider vnet as native endian.

      This patch handles the cases when this is not true:
      - virtio 1.0: always little-endian
      - legacy cross-endian

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4ee9b43be9a6e4ae161a1e6322bfef90818589f6
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 18 16:52:23 2015 +0200

      tap: fix non-linux build

      tap_fd_set_vnet_le/tap_fd_set_vnet_be was missing,
      fix it up.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com>

  commit 8524f1c79e614552c0165db9cc75a8a6bd8607a5
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add Machine menu with pause and resume menu items

      Add Machine menu to the Macintosh interface with pause
      and resume menu items. These items can either pause or
      resume execution of the guest operating system.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Message-id: 6D7AE6AA-0595-4FAD-AACF-9DFAB87248F0@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 473a49460db0a90bfda046b8f3662b49f94098eb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jun 18 13:49:28 2015 -0300

      q35: Re-enable FDC on pc-q35-2.3 and older

      commit ea96bc629cbd52be98b2967a4b4f72e91dfc3ee4 doesn't match the patch
      submitted by Laszlo to qemu-devel. We reuse pc_q35_2_4_machine_options()
      inside pc_q35_2_3_machine_options(), so we need to undo the no_floppy
      change in pc_q35_2_3_machine_options().

      (This discrepancy was due to a bad merge.)

      This restores the previous behavior where all the 2.3 and older machines
      had no_floppy=0.

      Reported-by: Ján Tomko <jtomko@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-id: 1434646168-3100-1-git-send-email-ehabkost@redhat.com
      Cc: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      [PMM: mention that this was a merge issue, not a review issue]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff5397bc72a1716bb34302dd470343ebee7d6bf2
  Author: Martin Cerveny <M.Cerveny@computer.org>
  Date:   Wed May 13 14:14:54 2015 +0200

      scripts: Add support for path as argument of qom-tree

      Add processing of optional argument path as "tree base".

      Signed-off-by: Martin Cerveny <M.Cerveny@computer.org>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 53f77e4562f85ccf82c8831a4448e9aefb538837
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Mar 25 18:40:15 2015 +0100

      tests: Use qtest_add_data_func() consistently

      Replace uses of g_test_add_data_func() for QTest test cases.

      It is still valid to use it for any non-QTest test cases,
      which are not run for multiple target binaries.

      Suggested-by: John Snow <jsnow@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6bc5cf92c0ab0085ba9a6e0cebcf5a544f416ca7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 9 16:57:30 2015 -0300

      qdev: Free property names after registering gpio aliases

      Now that object_property_add_alias() strdup()s target_name, we can free
      the property names in qdev_pass_gpios().

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 1590d266d96b3f9b42443d6388dfc38f527ac2d8
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 9 16:57:29 2015 -0300

      qom: strdup() target property name on object_property_add_alias()

      With this, object_property_add_alias() callers can safely free the
      target property name, like what already happens with the 'name' argument
      to all object_property_add*() functions.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 8ffe756da0481233e1bd518b2b16489f51856292
  Merge: 1b58f5a e1d4210
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 18 13:32:39 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-06-18' into staging

      QAPI patches

      # gpg: Signature made Thu Jun 18 13:20:00 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qapi-2015-06-18:
        qapi-types: Bury code dead since commit 6b5abc7
        qapi-types: Split generate_fwd_builtin() off generate_fwd_struct()
        qapi-types: Drop unused members parameters
        qapi-types: Don't filter out expressions with 'gen'
        qapi: Catch and reject flat union branch of array type
        tests/qapi-schema: New flat union array branch test case
        qapi: Better separate the different kinds of helpers
        qapi: Move exprs checking from parse_schema() to check_exprs()
        qapi: Fix to reject stray 't', 'f' and 'n'
        qapi: Simplify inclusion cycle detection
        qapi: Fix file name in error messages for included files
        qapi: Improve a couple of confusing variable names
        qapi: Eliminate superfluous QAPISchema attribute input_dir
        qapi: Drop bogus command from docs
        MAINTAINERS: Fix up QAPI and QAPI schema file patterns

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e1d4210c3a50059a3889cedc44a8aa193fa63d7d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 09:45:55 2015 +0200

      qapi-types: Bury code dead since commit 6b5abc7

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c5ecd7e18f912ab5e91f09b0333fb07567885d42
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 09:22:32 2015 +0200

      qapi-types: Split generate_fwd_builtin() off generate_fwd_struct()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ae0a7a109037160465f55f8bab06897f0a904def
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 10:40:17 2015 +0200

      qapi-types: Drop unused members parameters

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4f3568002393380558705397bda4cd5f224ffe29
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 08:32:51 2015 +0200

      qapi-types: Don't filter out expressions with 'gen'

      Useless, because it can only occur in commands, and we're not dealing
      with commands here.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f9a1427361fe06ac67480d580412dc4ed6f5d03b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 13:07:43 2015 +0200

      qapi: Catch and reject flat union branch of array type

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 75276710ae0a9f802a9774a8d845a2c84f89305a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 13:03:04 2015 +0200

      tests/qapi-schema: New flat union array branch test case

      The new test demonstrates another generator crash.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 00e4b285a31d19dcd88bd46729c9e09bfc9cc7fd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 10:04:36 2015 +0200

      qapi: Better separate the different kinds of helpers

      Insert comments to separate sections dealing with parsing, semantic
      analysis, code generation, and so forth.

      Move helpers to their proper section.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4d076d67c2c74662db092ecf4f99600b18209b2e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 08:55:21 2015 +0200

      qapi: Move exprs checking from parse_schema() to check_exprs()

      To have expression semantic analysis in one place rather than two.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e565d934d21e3544b820cd03b88061e71ab644a0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 08:24:58 2015 +0200

      qapi: Fix to reject stray 't', 'f' and 'n'

      Screwed up in commit e53188a.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a1366087270b312d94ff8c4031395a4218f160d4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:54:09 2015 +0200

      qapi: Simplify inclusion cycle detection

      We maintain a stack of filenames in include_hist for convenient cycle
      detection.

      As error_path() demonstrates, the same information is readily
      available in the expr_info, so just use that, and drop include_hist.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8608d2525186062099a38971c276752e7a38903a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 18:32:29 2015 +0200

      qapi: Fix file name in error messages for included files

      We print the name as it appears in the include expression.  Tools
      processing error messages want it relative to the working directory.
      Make it so.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 54414047eca5bee7d5ba6e7af5fb251f8635896c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:22:45 2015 +0200

      qapi: Improve a couple of confusing variable names

      old name      new name
      ----------------------------
      input_file    fname
      input_relname fname
      input_fname   abs_fname
      include_path  incl_abs_fname
      parent_info   incl_info

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12c707944927b8aa42752198dcf419a0bafe5d33
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:49:13 2015 +0200

      qapi: Eliminate superfluous QAPISchema attribute input_dir

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 836c3b01d2630192d6f5a941ca073bc8d650574b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 14:38:58 2015 +0200

      qapi: Drop bogus command from docs

      Commit 87a560c4 added it in the wrong place.  Commit 59a2c4ce added it
      in the right place, but didn't remove it from the wrong place.  Do
      that now.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 0311c5bde313c9ffcda2a198bd7cc70ae130d973
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 15:15:54 2015 +0200

      MAINTAINERS: Fix up QAPI and QAPI schema file patterns

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1b58f5a7f6fbe811cc486cd5786483bad5d51bbf
  Merge: e207527 a3122b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 18 11:36:42 2015 +0100

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

      Update OpenBIOS images

      # gpg: Signature made Wed Jun 17 20:06:06 2015 BST using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-openbios-signed:
        Update OpenBIOS images

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e20752775197d3606c50703422d2c5d53ecf54bb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Jun 17 13:35:00 2015 +0100

      vfio: fix build error on CentOS 5.7

      Include linux/vfio.h after sys/ioctl.h, just like in hw/vfio/common.c.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Message-id: 1434544500-22405-1-git-send-email-leon.alrae@imgtec.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3122b681aee8a41268c610ca3a5e7a066a9091a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Wed Jun 17 20:02:15 2015 +0100

      Update OpenBIOS images

      Update OpenBIOS images to SVN r1340 built from submodule.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit c80cd6bb9c20ef518c56319ce44d2971171e677d
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:44 2015 +0200

      tap: add VNET_LE/VNET_BE operations

      The linux tap and macvtap backends can be told to parse vnet headers
      according to little or big endian. This is done through the TUNSETVNETLE
      and TUNSETVNETBE ioctls.

      This patch brings all the plumbing for QEMU to use these APIs.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 04b7a1523d65bb5c78832098cf3108a1aadcaf8a
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:39 2015 +0200

      vhost: set vring endianness for legacy virtio

      Legacy virtio is native endian: if the guest and host endianness differ,
      we have to tell vhost so it can swap bytes where appropriate. This is
      done through a vhost ring ioctl.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 41d283bdab08868a244b9c19dce507fdf15a8990
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:34 2015 +0200

      virtio: introduce virtio_legacy_is_cross_endian()

      This helper will be used by vhost and tap to detect cross-endianness in
      the legacy virtio case.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 332f64073bddc9240cd572f64682a44572b67049
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:29 2015 +0200

      linux-headers: sync vhost.h

      This patch brings the cross-endian vhost API to QEMU.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 06b008d941fd3e9684d38a9b3181a1cf301c78d1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:19 2015 +0800

      tests: virtio-scsi: Move start/stop to individual test functions

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bea2f0982b335c13448dbde8a409107764fa8b59
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:18 2015 +0800

      libqos: Complete virtio device ID definition list

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 28452758c405e16d9890c44d6031d44233e8cb38
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:17 2015 +0800

      libqos: Allow calling guest_free on NULL pointer

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ebe7d8b166c59b029521f8d95db011e5e0fc649d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:16 2015 +0800

      tests: Link libqos virtio object to virtio-scsi-test

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d4862a87e31a51de9eb260f25c9e99a75efe3235
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Wed Jun 17 12:46:11 2015 +0200

      i8254: fix out-of-bounds memory access in pit_ioport_read()

      Due converting PIO to the new memory read/write api we no longer provide
      separate I/O region lenghts for read and write operations. As a result,
      reading from PIT Mode/Command register will end with accessing
      pit->channels with invalid index.

      Fix this by ignoring read from the Mode/Command register.

      This is CVE-2015-3214.

      Reported-by: Matt Tait <matttait@google.com>
      Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9dacf32d2cbd66cbcce7944ebdfd6b2df20e33b8
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:40 2015 +0300

      qemu-ga: Building Windows MSI installation with configure/Makefile

      New options were added to enable Windows MSI installation package
      creation:

      Option --enable-guest-agent-msi, like the name suggests, enables building
      Windows MSI package for QEMU guest agent; option --disable-guest-agent-msi
      disables MSI package creation; by default, no MSI package is created

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-5-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66ae13bb9eb2b16b59698e992bfcea61563b9d78
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:39 2015 +0300

      qemu-ga: Introduce Windows MSI script

      The script enables building Windows MSI installation package on Linux with wixl tool.

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-4-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c69403fcd4a0cb89f838a212ab71e4a1a3464c95
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:38 2015 +0300

      qemu-ga: debug printouts to help troubleshoot installation

      Debug printouts extended, helps installation troubleshooting

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-3-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5e031072e71eebab3d7d2ea4609e84bc928d893e
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:37 2015 +0300

      qemu-ga: adding vss-[un]install options

      Existing command line options include '-s install' and '-s uninstall'.
      These options install/uninstall both Windows QEMU GA service
      and optional VSS COM server. The QEMU GA Windows service allows
      always-on serving guest agent's QMP commands and VSS COM server
      enables guest agent integration with Volume Shadow Service.

      This commit introdices new options '-s vss-install' and '-s vss-uninstall',
      affecting only GA VSS COM server registration. The new options are useful
      for registering and unregistering the COM server during MSI installation,
      upgrade and uninstallation.

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-2-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 67633bb4f7743be2cb2e70b61e482ab92bf1724e
  Author: Pranith Kumar <bobby.prani@gmail.com>
  Date:   Wed Jun 10 10:20:24 2015 -0400

      qemu-log: Open file for logging when specified

      qemu-log defaults to stderr when there is no '-D' option mentioned on command
      line. When '-D' option is specified, we also need to specify '-d' option for it
      to use the specified logfile. When using monitor to enable logging this is
      troublesome since there will be no '-d' option because of which monitor dumps
      the logs to stderr.

      Fix this by opening the log file when '-D' is specified on the command line.
      Also fix an ancient comment which does not hold true since changing location and
      log level has now been streamlined.

      Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      CC: Luiz Capitulino <lcapitulino@redhat.com>
      CC: Markus Armbruster <armbru@redhat.com>
      CC: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1433946024-18439-1-git-send-email-bobby.prani@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f754c3c9cce3c4789733d9068394be4256dfe6a8
  Merge: a09f4a9 1f68f1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 12:43:26 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-06-17

      This is a special one. Two awesome features in one pull request:

        - CCW support for TCG
        - Watchpoint support for TCG

      To celebrate this, we also switch the default machine model from s390-virtio
      to s390-ccw and give users a fully working s390x model again!

      # gpg: Signature made Wed Jun 17 11:42:26 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream: (26 commits)
        s390x: Switch to s390-ccw machine as default
        target-s390x: PER: add Breaking-Event-Address register
        target-s390x: PER instruction-fetch nullification event support
        target-s390x: PER store-using-real-address event support
        target-s390x: PER storage-alteration event support
        translate-all: fix watchpoints if retranslation not possible
        target-s390x: PER instruction-fetch event support
        target-s390x: PER successful-branching event support
        target-s390x: basic PER event handling
        target-s390x: add get_per_in_range function
        target-s390x: add get_per_atmid function
        target-s390x: add PER related constants
        target-s390x: mvc_fast_memmove: access memory through softmmu
        target-s390x: mvc_fast_memset: access memory through softmmu
        target-s390x: function to adjust the length wrt page boundary
        softmmu: provide tlb_vaddr_to_host function for user mode
        target-s390x: wire up I/O instructions in TCG mode
        target-s390x: wire up DIAG REIPL in TCG mode
        target-s390x: wire up DIAG IPL in TCG mode
        target-s390x: fix s390_cpu_initial_reset
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1f68f1d36c3af09ed31a529ad69c3d09880d10fd
  Author: Alexander Graf <agraf@suse.de>
  Date:   Tue Jun 16 23:06:33 2015 +0200

      s390x: Switch to s390-ccw machine as default

      We now finally have TCG support for the basic set of instructions necessary
      to run the s390-ccw machine. That means in any aspect possible that machine
      type is now superior to the legacy s390-virtio machine.

      Switch over to the ccw machine as default. That way people don't get a halfway
      broken machine with the s390x target.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 3da0ab35292fe93640cfdd95aa8bedec8f145d2c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:03 2015 +0200

      target-s390x: PER: add Breaking-Event-Address register

      This patch adds support for PER Breaking-Event-Address register. Like
      real hardware, it save the current PSW address when the PSW address is
      changed by an instruction. We have to take care of optimizations QEMU
      does, a branch to the next instruction is still a branch.

      This register is copied to low core memory when a program exception
      happens.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 83bb161299c019e25a3add59504f0b69e6257dcd
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:02 2015 +0200

      target-s390x: PER instruction-fetch nullification event support

      For the instruction-fetch nullification event, we just reuse the
      existing instruction-fetch code and trigger the exception immediately
      in that case.

      There is no need to save the CPU state in the TCG code as it has been
      saved by the previous instruction before calling the per_check_exception
      helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2f54394997bfc808bbfbebb2d8294edd17d63808
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:01 2015 +0200

      target-s390x: PER store-using-real-address event support

      This PER event happens each time the STURA or STURG instructions are
      used. As they use helpers, we can just save the event in the PER code
      there, if enabled.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 311918b979c5364c30392c1054ed77d047a83953
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:00 2015 +0200

      target-s390x: PER storage-alteration event support

      For the PER storage-alteration event we can use the QEMU watchpoint
      infrastructure. When PER is enabled or PER control register changed we
      enable the corresponding watchpoints. When a watchpoint arises we can
      save the event. Unfortunately the current code does not provide the
      address space used to trigger the watchpoint. For now we assume it comes
      from the default ASC.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8d302e76755b8157373073d7107e31b0b13f80c1
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:59 2015 +0200

      translate-all: fix watchpoints if retranslation not possible

      The tb_check_watchpoint function currently assumes that all memory
      access is done either directly through the TCG code or through an
      helper which knows its return address. This is obviously wrong as the
      helpers use cpu_ldxx/stxx_data functions to access the memory.

      Instead of aborting in that case, don't try to retranslate the code, but
      assume that the CPU state (and especially the program counter) has been
      saved before calling the helper. Then invalidate the TB based on this
      address.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f0e0d817c22539cd2ce1bcb5487e076f117b04c0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:58 2015 +0200

      target-s390x: PER instruction-fetch event support

      For the PER instruction-fetch, we can't use the QEMU breakpoint
      infrastructure as it triggers for a single address and not a full
      address range, and as it actually stop before the instruction and
      not before.

      We therefore call an helper with the just fetched instruction address,
      which check if the address is within the PER address range. If it is
      the case, an event is recorded and will be signaled through an
      exception.

      Note that we implement here the PER-3 behaviour, that is an invalid
      opcode is not considered as an instruction fetch. Without PER-3 this
      behavious is undefined.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2c2275eb41c612df4bd115cf71d6e651d105f69c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:57 2015 +0200

      target-s390x: PER successful-branching event support

      For the PER successful-branching event support, we can't rely on any
      QEMU infrastucture. We therefore call an helper in all places where
      a branch can be taken. We have to pay attention to the branch to next
      case, as it's still a taken branch.

      We don't need to care about the cases using goto_tb, as we have disabled
      them in the previous patch.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 777c98c32ce577a9671b9267ff6e2802f69ebafd
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:56 2015 +0200

      target-s390x: basic PER event handling

      This patch add basic support to generate PER exceptions. It adds two
      fields to the cpu structure to record for the PER address and PER
      code & ATMID values. When an exception is triggered and a PER event is
      pending, the two PER values are copied to the lowcore area.

      At the end of an instruction, an helper is checking for a possible
      pending PER event and triggers an exception in that case. For that to
      work with branches, we need to disable TB chaining when PER is
      activated. Fortunately it's already in the TB flags.

      Finally in case of a SERVICE CALL exception, we need to trigger the PER
      exception immediately after.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d453d103831c966e7920f146eb3416e43b588f89
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:55 2015 +0200

      target-s390x: add get_per_in_range function

      This function checks if an address is in between the PER starting
      address and the PER ending address, taking care of a possible
      address range loop.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a8f931a931f8866abdb2f836d0fb6fb7d2606645
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:54 2015 +0200

      target-s390x: add get_per_atmid function

      This function returns the ATMID field that is stored in the
      per_perc_atmid lowcore entry.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fb01bf4c6b86d9ac00ea87d60f97871ee1488188
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:53 2015 +0200

      target-s390x: add PER related constants

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6da528d14de29138ca5ac43d6d059889dd24f464
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:52 2015 +0200

      target-s390x: mvc_fast_memmove: access memory through softmmu

      mvc_fast_memmove is bypassing the softmmu functions, getting the
      physical source and destination addresses using the mmu_translate
      function and accessing the corresponding physical memory. This
      prevents watchpoints to work correctly.

      Instead use the tlb_vaddr_to_host function to get the host addresses
      corresponding to the guest source and destination addresses through the
      softmmu code and fallback to the byte level code in case the
      corresponding address are not in the QEMU TLB or being examined through
      a watchpoint. As a bonus it works even for area crossing pages by
      splitting the are into chunks contained in a single page, bringing some
      performances improvements. We can therefore remove the 8-byte
      loads/stores method, as it is now quite unlikely to be used.

      At the same time change the name of the function to fast_memmove as it's
      not specific to mvc and use the same argument order as the C memmove
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fc89efe693278c79273f3bbf6b581e8a749c85b0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:51 2015 +0200

      target-s390x: mvc_fast_memset: access memory through softmmu

      mvc_fast_memset is bypassing the softmmu functions, getting the
      physical address using the mmu_translate function and accessing the
      corresponding physical memory. This prevents watchpoints to work
      correctly.

      Instead use the tlb_vaddr_to_host function to get the host address
      corresponding to the guest address through the softmmu code and fallback
      to the byte level code in case the corresponding address is not in the
      QEMU TLB or being examined through a watchpoint. As a bonus it works
      even for area crossing pages by splitting the are into chunks contained
      in a single page, bringing some performances improvements.

      At the same time change the name of the function to fast_memset as it's
      not specific to mvc and use the same argument order as the C memset
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d7ce6b7a0ba4328a286d09d96395a8fc2fd6943c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:50 2015 +0200

      target-s390x: function to adjust the length wrt page boundary

      This patch adds a function to adjust the length of a transfer so that
      it doesn't cross a page boundary in softmmu mode. It does nothing in
      user mode.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2e83c496261c799b0fe6b8e18ac80cdc0a5c97ce
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:49 2015 +0200

      softmmu: provide tlb_vaddr_to_host function for user mode

      To avoid to many #ifdef in target code, provide a tlb_vaddr_to_host for
      both user and softmmu modes. In the first case the function always
      succeed and just call the g2h function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ad8a4570add09a7635cb8cd1c9327640521ee7a7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Jun 15 17:57:09 2015 +0200

      target-s390x: wire up I/O instructions in TCG mode

      The code handling the I/O instructions for KVM decodes the instruction
      itself. In TCG mode also pass the full instruction word to the helpers.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2ecacb0b4b6c73af424b7b4389fa55809368a98b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:08 2015 +0200

      target-s390x: wire up DIAG REIPL in TCG mode

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8df7eef3059394bd53cdf7609aac9a50a78aa030
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:07 2015 +0200

      target-s390x: wire up DIAG IPL in TCG mode

      DIAG IPL is already implemented for KVM, but not wired from TCG. For
      that change the format of the instruction so that we can get R1 and R3
      numbers in addition to the function code.

      The diag function can change plenty of things, including CC, so we
      should enter with a static CC. Also it doesn't set the value of general
      register 2 to 0 as in the current code. We also need to exit the CPU
      loop after a reset, which means a new PSW.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cbed0ba78f04ce9e2e718431f64eb4b621288aca
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:06 2015 +0200

      target-s390x: fix s390_cpu_initial_reset

      The s390_cpu_initial_reset function zeroes a big part of the CPU state
      structure, including CPU_COMMON, and thus the QEMU TLB structure. As
      they should not be initialized with zeroes only, we need to call the
      tlb_flush to initialize it correctly.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cc0d079d4582ee0ed97b5e3e3da4f6cb2b5bd67f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:05 2015 +0200

      target-s390x: initialize I/O interrupt queue

      env->io_index[] should be set to -1 during CPU reset to mark the
      I/O interrupt queue as empty.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7107e5a756317151666d47d1bc1e170293babaff
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:04 2015 +0200

      target-s390x: correctly initialize ext interrupt queue

      env->ext_index should be initialized to -1 to mark the external
      interrupt queue as emtpy. This should not be done in s390_cpu_initfn
      as all the interrupt fields are later reset to 0 by the memset in
      s390_cpu_initial_reset or s390_cpu_full_reset. Move the initialization
      there.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 06e3c077daa08c0a616e9507eb737401883ab645
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:03 2015 +0200

      target-s390x: fix setcc in TCG mode

      In TCG mode we should store the CC value in env->cc_op. However do it
      inconditionnaly because:
      - the tcg_enabled function is not inlined
      - it's probably faster to always store the value, especially given it
        is likely in the same cache line than env->psw.mask.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a499973ff32bc58f2db7b88ad5597ffdbc2becd7
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:02 2015 +0200

      virtio-ccw: disable ioevent bit when ioeventfds are not enabled

      This remove the corresponding error messages in TCG mode, and allow to
      simplify the s390_assign_subch_ioeventfd() function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d49f4ab48ec76e590ad72a2d6c3fba8459d3ded7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Jun 15 17:57:01 2015 +0200

      s390/ioinst: fix endianness in ioinst_schib_valid

      The ioinst_schib_valid gets a SCHIB in guest endianness, we should
      byteswap the fields we access.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ae52e585bf5e9678a77be033fd4b430a2e78dfed
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:00 2015 +0200

      s390/ioinst: fix IO_INT_WORD_ISC macro

      The I/O-Interruption Subclass field corresponds to bits 2 to 5 (BE
      notation) of the Interruption-Identification Word. The value should
      be shift by 27 instead of 24.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a09f4a9d19c500ea5cbcdc0bd7f0d540cf54f9f5
  Merge: 8c29f8d f3bcd42
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 11:12:35 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-seabios-1.8.2-20150617-1' into staging

      update seabios to release 1.8.2
      add vgabios for virtio-vga

      # gpg: Signature made Wed Jun 17 08:34:22 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-seabios-1.8.2-20150617-1:
        update seabios and vgabios binaries
        tag our seabios builds
        update seabios submodule to release 1.8.2

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c29f8d6b9595ac0f9ab1b41f22e91aebab482d7
  Merge: 93f6d1c f8d30a4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 10:13:40 2015 +0100

      Merge remote-tracking branch 'remotes/kvaneesh/tags/for-upstream-signed' into staging

      VirtFS update:

      * Fix for virtfs-proxy-helper crash
      * Gracefully handle the error condition on input validation in virtfs-proxy-helper

      # gpg: Signature made Tue Jun 16 16:21:28 2015 BST using RSA key ID 04C4E23A
      # gpg: Good signature from "Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 4846 9DE7 1860 360F A6E9  968C DE41 A4FE 04C4 E23A

      * remotes/kvaneesh/tags/for-upstream-signed:
        virtfs-proxy-helper: fail gracefully if socket path is too long
        virtfs-proxy-helper: add missing long option terminator

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3bcd42683dcc48c576281399d6cf6b34da6ba41
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:28:03 2015 +0200

      update seabios and vgabios binaries

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7edf2f0ec4edbde50be3b54306adf5b8b16ca68b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:24:55 2015 +0200

      tag our seabios builds

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 10500ce26069b7c4746e8a2276aa03220a29581c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:11:47 2015 +0200

      update seabios submodule to release 1.8.2

      git shortlog rel-1.8.1..rel-1.8.2
      =================================

      Gerd Hoffmann (1):
            vga: rework virtio-vga support

      Kevin O'Connor (5):
            vgabios: Add config option for assembler fixups
            vgabios: Emulate "leal" instruction
            build: Support "make VERSION=xyz" to override the default build version
            build: CONFIG_VGA_FIXUP_ASM should depend on CONFIG_BUILD_VGABIOS
            vgabios: On bda_save_restore() the saved vbe_mode also has flags in it

      Paolo Bonzini (1):
            smm: ignore bits 16,18-31 of SMM revision ID

      Vladimir Serbinenko (1):
            ahci: Ignore max_ports.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f8d30a4f96d6c3a12e692d2e69b8fe4734b916c6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 30 14:57:16 2015 +0100

      virtfs-proxy-helper: fail gracefully if socket path is too long

      Replace the assertion check with graceful failure when the socket path
      is too long.  Programs should not crash on invalid input.  Print an
      error message and exit properly.

      Cc: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit bf6667d63ef4c4fbaf91051589a594ec1c235308
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 30 14:57:15 2015 +0100

      virtfs-proxy-helper: add missing long option terminator

      The getopt_long(3) long options array must have a zeroed terminator.

      This patch solves a segmentation fault when an unknown command-line
      option is encountered:

        $ fsdev/virtfs-proxy-helper --help
        Segmentation fault (core dumped)

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 93f6d1c16036aaf34055d16f54ea770fb8d6d280
  Merge: 4316536 7a4dfd1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 16 10:35:43 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150615-1' into staging

      virtio-gpu: pci support bits and virtio-vga.

      # gpg: Signature made Mon Jun 15 13:55:19 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150615-1:
        virtio-vga: add vgabios configuration
        virtio-vga: add '-vga virtio' support
        virtio-vga: add virtio gpu device with vga compatibility
        virtio-gpu-pci: add virtio pci support
        virtio-gpu: fix error message

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4316536bf424d2e7f9cfa7d0dd561adb0986cc81
  Merge: 1dfe73b 45c874e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 16 09:07:22 2015 +0100

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150616' into staging

      linux-user patches for 2.4 softfreeze
      second spin with ioctl patch refreshed

      # gpg: Signature made Tue Jun 16 08:03:14 2015 BST using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150616:
        linux-user: ioctl() command type is int
        linux-user: fix the breakpoint inheritance in spawned threads
        linux-user: use __get_user and __put_user in cmsg conversions
        linux-user: Fix length handling in host_to_target_cmsg
        linux-user: Use abi_ulong for TARGET_ELF_PAGESTART
        linux-user: Allocate thunk size dynamically

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 45c874ebbae661238bfa3c0534480ebe2940b112
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Tue Jun 16 00:35:28 2015 +0200

      linux-user: ioctl() command type is int

      When executing a 64bit target chroot on 64bit host,
      the ioctl() command can mismatch.

      It seems the previous commit doesn't solve the problem in
      my case:

          9c6bf9c7 linux-user: Fix ioctl cmd type mismatch on 64-bit targets

      For example, a ppc64 chroot on an x86_64 host:

      bash-4.3# ls
      Unsupported ioctl: cmd=0x80087467
      Unsupported ioctl: cmd=0x802c7415

      The origin of the problem is in syscall.c:do_ioctl().

          static abi_long do_ioctl(int fd, abi_long cmd, abi_long arg)

      In this case (ppc64) abi_long is long (on the x86_64), and

          cmd = 0x0000000080087467

      then
          if (ie->target_cmd == cmd)

      target_cmd is int, so target_cmd = 0x80087467
      and to compare an int with a long, the sign is extended to 64bit,
      so the comparison is:

          if (0xffffffff80087467 == 0x0000000080087467)

      which doesn't match whereas it should.

      This patch uses int in the case of the target command type
      instead of abi_long.

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1d085f6cae51b1a0fb92ad03ce8bf038e29c9750
  Author: Thierry Bultel <thierry.bultel@basystemes.fr>
  Date:   Fri Jun 12 11:24:10 2015 +0200

      linux-user: fix the breakpoint inheritance in spawned threads

      When a thread is spawned, cpu_copy re-initializes
      the bp & wp lists of current thread, instead of the ones
      of the new thread.
      The effect is that breakpoints are no longer hit.

      Signed-off-by: Thierry Bultel <thierry.bultel@basystemes.fr>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 876e23cb2e545148a0ee4effda5c63c861855941
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 19:46:32 2015 +0100

      linux-user: use __get_user and __put_user in cmsg conversions

      The target payloads in cmsg conversions may not have the alignment
      required by the host. Using the get_user and put_user functions is
      the easiest way to handle this and also do the byte-swapping we
      require.

      (Note that prior to this commit target_to_host_cmsg was incorrectly
      using __put_user() rather than __get_user() for the SCM_CREDENTIALS
      conversion, which meant it wasn't getting the benefit of the
      misalignment handling.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit c2aeb2586bd258ad76fcfe308f883075e73ff1d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 19:46:31 2015 +0100

      linux-user: Fix length handling in host_to_target_cmsg

      The previous code for handling payload length when converting
      cmsg structures from host to target had a number of problems:
       * we required the msg->msg_controllen to declare the buffer
         to have enough space for final trailing padding (we were
         checking against CMSG_SPACE), whereas the kernel does not
         require this, and common userspace code assumes this. (In
         particular, glibc's "try to talk to nscd" code that it will
         run on startup will receive a cmsg with a 4 byte payload and
         only allocate 4 bytes for it, which was causing us to do
         the wrong thing on architectures that need 8-alignment.)
       * we weren't correctly handling the fact that the SO_TIMESTAMP
         payload may be larger for the target than the host
       * we weren't marking the messages with MSG_CTRUNC when we did
         need to truncate a message that wasn't truncated by the host,
         but were instead logging a QEMU message; since truncation is
         always the result of a guest giving us an insufficiently
         sized buffer, we should report it to the guest as the kernel
         does and don't log anything

      Rewrite the parts of the function that deal with length to
      fix these issues, and add a comment in target_to_host_cmsg
      to explain why the overflow logging it does is a QEMU bug,
      not a guest issue.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1dfe73b94de5a75038a725b17dc7d08a23a977ec
  Merge: b500e4d f264d51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:43:09 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150615' into staging

      target-arm queue:
       * Handle "extended small page" descriptors correctly
       * Use extended address bits from supersection short descriptors
       * Update interrupt status for all cores in gic_update
       * Fix off-by-one in exynos4210_fimd bit-swap code
       * Remove stray unused 'pending_exception' field
       * Add Cortex-A53 KVM support
       * Fix reset value of REVIDR
       * Add AArch32 MIDR aliases for ARMv8 cores
       * MAINTAINERS update for ARM ACPI code
       * Trust the kernel's value of MPIDR if we're using KVM
       * Various pxa2xx device updates to avoid old APIs
       * Mark pxa2xx copro registers as ARM_CP_IO so -icount works
       * Correctly UNDEF Thumb2 DSP insns on Cortex-M3
       * Initial work towards implementing PMSAv7
       * Fix a reset order bug introduced recently
       * Correct "preferred return address" for cpreg access exceptions
       * Add ACPI SPCR table for the virt board

      # gpg: Signature made Mon Jun 15 18:19:34 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150615: (28 commits)
        hw/arm/virt-acpi-build: Add SPCR table
        ACPI: Add definitions for the SPCR table
        target-arm: Correct "preferred return address" for cpreg access exceptions
        hw/arm/boot: fix rom_reset notifier registration order
        arm: helper: rename get_phys_addr_mpu
        arm: Add has-mpu property
        arm: Implement uniprocessor with MP config
        arm: Refactor get_phys_addr FSR return mechanism
        arm: helper: Factor out CP regs common to [pv]msa
        arm: Don't add v7mp registers in MPU systems
        arm: Do not define TLBTR in PMSA systems
        target-arm: Add the THUMB_DSP feature
        hw/sd/pxa2xx_mmci: Stop using old_mmio in MemoryRegionOps
        hw/arm/pxa2xx: Convert pxa2xx-ssp to VMState
        hw/arm/pxa2xx: Add reset method for pxa2xx_ssp
        hw/arm/pxa2xx: Convert pxa2xx-fir to QOM and VMState
        hw/arm/pxa2xx: Mark coprocessor registers as ARM_CP_IO
        target-arm: Use the kernel's idea of MPIDR if we're using KVM
        MAINTAINERS: Add myself as ARM ACPI Subsystem maintainer
        target-arm: add AArch32 MIDR aliases in ARMv8
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f264d51d8ad939d7fb339d61a8cf680ed0cb21a2
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      hw/arm/virt-acpi-build: Add SPCR table

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433929959-29530-3-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b8a0d75ef85b8f24c92a6c50817fa9579b4a98d9
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      ACPI: Add definitions for the SPCR table

      SPCR is the Serial Port Console Redirection Table. See the document
      linked from http://uefi.org/acpi. For serial port types, "Interface
      Type", see the documentation for the Debug Port Table 2 (DBG2).

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433929959-29530-2-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3977ee5d7a9f2e3664dd8b233f3224694e23b62b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      target-arm: Correct "preferred return address" for cpreg access exceptions

      The architecture defines that when taking an exception trying to
      access a coprocessor register, the "preferred return address" for
      the exception is the address of the instruction that caused the
      exception. Correct an off-by-4 error which meant we were returning
      the address after the instruction for traps which happened because
      of a failure of a runtime access-check function on an AArch32
      register. (Traps caused by translate-time checkable permissions
      failures had the correct address, as did traps on AArch64 registers.)

      This fixes https://bugs.launchpad.net/qemu/+bug/1463338

      Reported-by: Robert Buhren <robert@robertbuhren.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433861440-30133-1-git-send-email-peter.maydell@linaro.org

  commit 63a183ed0eac2956574745c84faffa042d99afb8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      hw/arm/boot: fix rom_reset notifier registration order

      commit ac9d32e39664e060cd1b538ff190980d57ad69e4 had the consequence to
      register the do_cpu_reset after the rom_reset one. Hence they get
      executed in the wrong order. This commit restores the registration of
      do_cpu_reset in arm_load_kernel.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reported-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434111582-9325-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13689d43646482f7305282de1bdd662c0d2b8b77
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: helper: rename get_phys_addr_mpu

      This get_phys_addr is really for pmsav5. Rename it accordingly.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: bf4b019aa87d682a45998105ef8e4d4e97a5e117.1434066412.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f325f568fbd0158cd413e7d637573ba90b3eaab
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Add has-mpu property

      For processors that support MPUs, add a property to de-feature it. This
      is similar to the implementation of the EL3 feature.

      The processor definition in init sets ARM_FEATURE_MPU if it can support
      an MPU. post_init exposes the property, defaulting to true. If cleared
      by the instantiator, ARM_FEATURE_MPU is then removed at realize time.

      This is to support R profile processors that may or may-not have an MPU
      configured.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 632918cc48786e868ea18aa6bd12f70597994cad.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8e81b319d1ae1224cc7059877dcdf04a5aad59d
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Implement uniprocessor with MP config

      Add a boolean for indicating uniprocessors with MP extensions. This
      drives the U bit in MPIDR. Prepares support for Cortex-R5.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a70a80583df265e0174f01fa1fc92b33ea6d1db5.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7cc4e82f04a1c5b218a657f677a2fdd1e1c2889
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Refactor get_phys_addr FSR return mechanism

      Currently, the return code for get_phys_addr is overloaded for both
      success/fail and FSR value return. This doesn't handle the case where
      there is an error with a 0 FSR. This case exists in PMSAv7.

      So rework get_phys_addr and friends to return a success/failure boolean
      return code and populate the FSR via a caller provided uint32_t
      pointer.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a209e3d8ae00cda55260c970891f520210e26bad.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8e5d75c950a1241f6e1243c37f28cd58f68fedc9
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: helper: Factor out CP regs common to [pv]msa

      V6+ PMSA and VMSA share some common registers that are currently
      in the VMSA definition block. Split them out into a new def that can
      be shared to PMSA.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 284db78a43c63c9bfbb60de539672c361bcb6af8.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e5cf9e35f25f9f932a6ce25107c11b67b426a43
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Don't add v7mp registers in MPU systems

      These registers are VMSA specific so they should be conditional on
      VMSA (i.e. !MPU).

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 7bb8843e45f2635c6b7a583c5bb5da51ed4442a0.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8085ce63c5967d200f1241b6c0a189371993c5df
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Do not define TLBTR in PMSA systems

      If doing a PMSA (MPU) system do not define the VMSA specific TLBTR CP.
      The def is done separately from VMSA registers group as it is affected
      by both the OMAP/STRONGARM RW errata and the MIDR backgrounding.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: b03fea3840207edf633f5c9189400c3dd6a28d14.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 62b44f059a84d1ac580a653fc4110dfabaef6b83
  Author: Aurelio C. Remonda <aurelioremonda@gmail.com>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      target-arm: Add the THUMB_DSP feature

      Create an ARM_FEATURE_THUMB_DSP controlling the Thumb encodings of
      the 85 DSP instructions (these are all Thumb2). This is enabled for
      all non-M-profile CPUs with Thumb2 support, as the instructions are
      mandatory for R and A profiles. On M profile they are optional and
      not present in the Cortex-M3 (though they are in the M4).

      The effect of this commit is that we will now treat the DSP
      encodings as illegal instructions on M3, when previously we
      incorrectly implemented them.

      Signed-off-by: Aurelio C. Remonda <aurelioremonda@gmail.com>
      Message-id: 1434311355-26554-1-git-send-email-aurelioremonda@gmail.com
      [PMM: added clz/crc32/crc32c and default case to the early-decode switch;
       minor format/spacing fixups; reworded commit message a bit]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13e1e476b4bc111d36fffaea025f90d8db52b697
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/sd/pxa2xx_mmci: Stop using old_mmio in MemoryRegionOps

      Update the pxa2xx_mmci device to stop using the old_mmio read
      and write callbacks in its MemoryRegionOps. This actually
      simplifies the code because the separate byte/halfword/word
      access functions were all calling into a single function to
      do the work anyway.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-6-git-send-email-peter.maydell@linaro.org

  commit 8e079caf82c3658ee64bca37c91953b38296d427
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Convert pxa2xx-ssp to VMState

      The pxa2xx-ssp device is already a QOM device but is still
      using the old-style register_savevm(); convert to VMState.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-5-git-send-email-peter.maydell@linaro.org

  commit ce3203464bee89d2ae958717222981326a37775e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Add reset method for pxa2xx_ssp

      The pxa2xx_ssp device was missing a reset method; add one.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter..crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-4-git-send-email-peter.maydell@linaro.org

  commit 1fd9f2df241554b68b3a19ad1c94c475c7bb85ea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Convert pxa2xx-fir to QOM and VMState

      Convert the pxa2xx-fir device to QOM, including using a
      VMState for its migration info.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-3-git-send-email-peter.maydell@linaro.org

  commit 14c3032a7ebd5a354381465453c0c0690b7342d1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Mark coprocessor registers as ARM_CP_IO

      The pxa2xx custom coprocessor registers in cp6 and cp14 do device
      accesses, so mark the non-constant regs as ARM_CP_IO so that
      icount works correctly and doesn't abort.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-2-git-send-email-peter.maydell@linaro.org

  commit eb5e1d3c85dffe677da2550d211f9304a7d5ba3b
  Author: Pavel Fedin <p.fedin@samsung.com>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      target-arm: Use the kernel's idea of MPIDR if we're using KVM

      When we're using KVM, the kernel's internal idea of the MPIDR
      affinity fields must match the values we tell it for the guest
      vcpu cluster configuration in the device tree. Since at the moment
      the kernel doesn't support letting userspace tell it the correct
      affinity fields to use, we must read the kernel's view and
      reflect that back in the device tree.

      Signed-off-by: Shlomo Pongratz <shlomo.pongratz@huawei.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Message-id: 02f601d0a1e6$90c7d630$b2578290$@samsung.com
      [PMM: Use a local #define rather than a global variable for
       the TCG ARM_CPUS_PER_CLUSTER setting. Tweak a comment. Update the
       commit message.]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f4d260e70aff7c3796d97c78ba0663696e2d503
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      MAINTAINERS: Add myself as ARM ACPI Subsystem maintainer

      Add Shannon Zhao as the maintainer for the ARM ACPI Subsystem.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433248318-6076-1-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac00c79ff6635ae9fd732ff357ada0d05e795500
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm: add AArch32 MIDR aliases in ARMv8

      According to ARMv8 ARM, there are additional aliases to MIDR system register in
      AArch32 state. So add them to the list.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433321048-23793-3-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13b72b2b9aa7ab7ee129e38e9587acd6a1b9a932
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm: Fix REVIDR reset value

      According to ARM Cortex-A53/A57 TRM, REVIDR reset value should be zero. So let
      REVIDR reset value be specified by CPU model and correct it for Cortex-A53/A57.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433321048-23793-2-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8772de2c53b44c75f18140646aa928e6d77cb9d8
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      hw/arm/virt: Add cortex-a53 cpu support in machine virt

      Add cortex-a53 cpu support in machine virt, so it can be used for TCG
      and KVM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433207452-4512-3-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7525465e6def0ef878741087b36e4657016dce80
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm/kvm64: Add cortex-a53 cpu support

      Since commit e353102(target-arm: cpu64: Add support for Cortex-A53) has
      added Cortex-A53 cpu support for target-arm, this patch just enables it
      for kvm-arm.

      Here adding XGENE_POTENZA just makes the enum continuous.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1433207452-4512-2-git-send-email-shannon.zhao@linaro.org
      [PMM: Don't add the CPU types to cpus_to_try[]; this array only
       lists old CPUs which were supported in pre-PREFERRED_TARGET kernels]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a79e0218e0ae27c9cdd2648bd46e5a916c903cc2
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm/cpu.h: remove pending_exception

      This isn't used by any of the code. In fact it looks like it was never
      used as it came in with ARMv7 support.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1434020015-8868-1-git-send-email-alex.bennee@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 644ead5be1a851abff16886240c5c6fc1c5137c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      hw/display/exynos4210_fimd: Fix bit-swapping code

      fimd_swap_data() includes code to reverse the bits in a
      64-bit integer, but an off-by-one error meant that it would
      try to shift off the top of the integer. Correct the bug
      (spotted by Coverity).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1432912615-23107-1-git-send-email-peter.maydell@linaro.org

  commit 235069a380147e31236b94c31528fc5170c3a421
  Author: Johan Karlsson <Johan.Karlsson@enea.com>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      arm_gic: gic_update should always update all cores

      This patch fixes so that gic_update always updates all the cores with
      new pending irq states.  If the function returns early it is possible
      to get interrupts that has already been acknowledged.

      Signed-off-by: Johan Karlsson <johan.karlsson@enea.com>
      [PMM: rebased to apply to current master]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e42a6ca37e39e56725518851f4388e46bd91129
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      target-arm: use extended address bits from supersection short descriptor

      Since ARMv7 with LPAE support, a supersection short translation table
      descriptor has had extended base address fields which hold bits 39:32 of
      translated address. These fields are IMPDEF in ARMv6 and ARMv7 without
      LPAE support.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433235718-30485-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc1891c74ae122a9dc7854f38bae7db03cd911e6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      target-arm: Handle "extended small page" descriptors correctly

      The old ARMv5-style page table format includes a kind of second level
      descriptor named the "extended small page" format, whose primary purpose
      is to allow specification of the TEX memory attribute bits on a 4K page.
      This exists on ARMv6 and also (as an implementation extension) on XScale
      CPUs; it's UNPREDICTABLE on v5.

      We were mishandling this in two ways:
       (1) we weren't implementing it for v6 (probably never noticed because
      Linux will use the new-style v6 page table format there)
       (2) we were not correctly setting the page_size, which is 4K, not 1K

      The latter bug went unnoticed for years because the only thing which
      the page_size affects is which TLB entries get flushed when the guest
      does a TLB invalidate on an address in the page, and prior to commit
      2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's
      habit of writing the SCTLR pointlessly a lot.

      (We can assume that after commit 2f0d8631b7 the bug went unnoticed
      for a year because nobody's actually using the Zaurus/XScale emulation...)

      Report the correct page size for these descriptors, and permit them
      on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus
      can boot the kernel OK but gets random segfaults when it tries to
      run userspace programs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1432844085-16441-1-git-send-email-peter.maydell@linaro.org

  commit b500e4db8e3e0b5f41a2dd14e2001200e5fc7d6b
  Merge: 46bca54 d95d7d8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 16:15:32 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-20150615-1' into staging

      audio: remove obsolete backends (esd, fmod, winwave).
      audio: stop using global variables, small fixes.
      audio: remove some obsolte and unused code.

      # gpg: Signature made Mon Jun 15 13:24:44 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-audio-20150615-1:
        ossaudio: use trace events instead of debug config flag
        alsaaudio: use trace events instead of verbose
        dsoundaudio: remove primary buffer
        dsoundaudio: remove *_retries kludges
        audio: remove plive
        audio: remove LOG_TO_MONITOR along with default_mon
        MAINTAINERS: remove malc from audio
        sdlaudio: do not allow multiple instances
        coreaudio: do not use global variables where possible
        dsoundaudio: do not use global variables
        paaudio: fix possible resource leak
        wavaudio: do not use global variables
        ossaudio: do not use global variables
        alsaaudio: do not use global variables
        paaudio: do not use global variables
        audio: expose drv_opaque to init_out and init_in
        only enable dsound in case the header file is present
        audio: remove winwave audio driver
        audio: remove fmod backend
        audio: remove esd backend

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a084ea39aec84d352dbd3de0f523daaaaac8c7d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 15 16:20:21 2015 +0200

      vhost-user: part of virtio

      vhost user is related to virtio, add it to the relevant entry.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 46bca5404b08201bb9df1ac32bc88fc7e6db1f74
  Merge: f3e3b08 8369e33
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 13:24:50 2015 +0100

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150615' into staging

      s390x/kvm/watchdog

      1. Implement a diag288 based watchdog
      2. Fix virtio-ccw BIOS for gcc >= 4.9

      # gpg: Signature made Mon Jun 15 12:36:25 2015 BST using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150615:
        s390/bios: build with -fdelete-null-pointer-checks
        watchdog: Add new Virtual Watchdog action INJECT-NMI
        nmi: Implement inject_nmi() for non-monitor context use
        s390x/watchdog: diag288 migration support
        s390x/kvm: diag288 instruction interception and handling
        s390x/watchdog: introduce diag288 watchdog device
        watchdog: change option wording to allow for more watchdogs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8369e339d24f365750da456588e742674c153437
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 12:24:03 2015 +0200

      s390/bios: build with -fdelete-null-pointer-checks

      Starting with version 4.9, GCC assumes it can't safely dereference null
      pointers, and uses this for some optimizations. On s390, the lowcore
      memory is located at address 0, so this assumption is wrong and breaks
      the s390-ccw firmware. Pass -fdelete-null-pointer-checks to avoid that.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1434363843-14576-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d95d7d802c33f6277c9fb967c14ae0cc99aeb072
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:07 2015 +0200

      ossaudio: use trace events instead of debug config flag

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fbb7ef56d55723a4996c288b50a16e6283eea13f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:06 2015 +0200

      alsaaudio: use trace events instead of verbose

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6dd35fd81e06d469b6f5280adee0a16ee383db57
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:05 2015 +0200

      dsoundaudio: remove primary buffer

      Enabling this option just creates a playback buffer with the specified settings,
      and then ignores it. It's probably some outdated hack to set audio formats on
      windows. (The first created stream dictates all other streams settings, at least
      on some Windows versions). Setting DAC_FIXED_SETTINGS should have the same
      effect as setting (the now removed) primary buffer.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2762955f723570944966347600b5746e7dd99388
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:04 2015 +0200

      dsoundaudio: remove *_retries kludges

      According to MSDN this may happen when the window is not in the foreground, but
      the default is 1 since a long time (which means no retries), so it should be ok.
      I've found no problems during testing it on Windows 7 and wine, so this was
      probably only the case with some old Windows versions.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 73ad33ef7ba0d1e7c7f276663f36c4f72b9193a9
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:03 2015 +0200

      audio: remove plive

      It was useless even 3 years ago, so it can probably safely go away:
      https://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg02427.html

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 06ac27f683c52890a6d174adba8c92354fa1eceb
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:02 2015 +0200

      audio: remove LOG_TO_MONITOR along with default_mon

      Setting QEMU_AUDIO_LOG_TO_MONITOR=1 can crash qemu (if qemu tries to log
      to the monitor before it's being initialized), and also nothing else in
      qemu logs to the monitor.

      This log to monitor feature was the last thing that used the default_mon
      variable, so I removed it too (as using it can cause problems).

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 65eb1e6b4c1c4f66deff9cdf9bfbdea267c59343
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 9 12:51:36 2015 +0200

      MAINTAINERS: remove malc from audio

      email bounces, with a appearently permanent error:
      "av1474@comtv.ru mail receiving disabled, rejecting"

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 81ebb07c56a28aa7ca47c38eb44690025a9dd6b9
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:55 2015 +0200

      sdlaudio: do not allow multiple instances

      Since SDL uses a lot of global data, we can't create independent
      instances of sdl audio backend.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d1f52a1d704de2252bc48c64ca4d46086cb249a2
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:54 2015 +0200

      coreaudio: do not use global variables where possible

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 191e1f0acd32360b917fa54a52389b97d9b52b6f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:52 2015 +0200

      dsoundaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49dd6d0d33e1a59b4055713079e64062bc5092b5
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:53 2015 +0200

      paaudio: fix possible resource leak

      qpa_audio_init did not clean up resources properly if the initialization
      failed. This hopefully fixes it.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f2dcc6cec285938967446d412b0477e02e26f3ca
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:51 2015 +0200

      wavaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4045a85ad1aadb1a56038ed3358e2093ba88f91f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:50 2015 +0200

      ossaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 765b37da3f2824afd45b38c038af44da42b956f6
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:48 2015 +0200

      alsaaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9a644c4b4dfc7ebe7994bfa568cbeaa1847ca5ff
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:49 2015 +0200

      paaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5706db1deb061ee9affdcea81e59c4c2cad7c41e
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:47 2015 +0200

      audio: expose drv_opaque to init_out and init_in

      Currently the opaque pointer returned by audio_driver's init is only
      exposed to the driver's fini, but not to audio_pcm_ops. This way if
      someone wants to share a variable with the driver and the pcm, he must
      use global variables. This patch fixes it by adding a third parameter to
      audio_pcm_op's init_out and init_in.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 307119e7d948bcdb5918fd762153deda471e695b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 10 09:07:35 2015 +0200

      only enable dsound in case the header file is present

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f3e3b083d4c266ea864ae3c83da49d4086857679
  Merge: 8aeaa05 67251a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 10:43:06 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer core and image format patches

      # gpg: Signature made Fri Jun 12 16:08:53 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (25 commits)
        block: Fix reopen flag inheritance
        block: Add BlockDriverState.inherits_from
        block: Add list of children to BlockDriverState
        queue.h: Add QLIST_FIX_HEAD_PTR()
        block: Drain requests before swapping nodes in bdrv_swap()
        block: Move flag inheritance to bdrv_open_inherit()
        block: Use QemuOpts in bdrv_open_common()
        block: Use macro for cache option names
        vmdk: Use bdrv_open_image()
        quorum: Use bdrv_open_image()
        check-qdict: Test cases for new functions
        qdict: Add qdict_{set,copy}_default()
        qdict: Add qdict_array_entries()
        iotests: Add tests for overriding BDRV_O_PROTOCOL
        block: driver should override flags in bdrv_open()
        block: Change bitmap truncate conditional to assertion
        block: record new size in bdrv_dirty_bitmap_truncate
        raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size
        vmdk: Use vmdk_find_index_in_cluster everywhere
        vmdk: Fix index_in_cluster calculation in vmdk_co_get_block_status
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3cec7cc22f95ce31565e8e2c03b06a2f7ae8bc6f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:46 2015 +0200

      audio: remove winwave audio driver

      DirectSound should be a superior choice on Windows.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 14382605da6bda74516f275695bd3345bc54c464
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:45 2015 +0200

      audio: remove fmod backend

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0bac111167e33838fa869cacd16f92e5899252b3
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:44 2015 +0200

      audio: remove esd backend

      ESD is no longer developed and replaced by PulseAudio.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 79cb1f1d698da5e1e183863aa3c8a91b2e750664
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Apr 20 16:15:20 2015 +0100

      linux-user: Use abi_ulong for TARGET_ELF_PAGESTART

      TARGET_ELF_PAGESTART is required to use abi_ulong to correctly handle
      addresses for different target bits width.
      This patch fixes a problem when running a 64-bit user mode application
      on 32-bit host machines.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 8be656b87c6bb1b9f8af3ff78094413d71e4443a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed May 6 23:47:32 2015 +0200

      linux-user: Allocate thunk size dynamically

      We store all struct types in an array of static size without ever
      checking whether we overrun it. Of course some day someone (like me
      in another, ancient ALSA enabling patch set) will run into the limit
      without realizing it.

      So let's make the allocation dynamic. We already know the number of
      structs that we want to allocate, so we only need to pass the variable
      into the respective piece of code.

      Also, to ensure we don't accidently overwrite random memory, add some
      asserts to sanity check whether a thunk is actually part of our array.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 8aeaa055f5d3d4e87bf870892ba301eae57bdc1d
  Merge: 0a2df85 2db33f8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 18:04:14 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri Jun 12 15:57:47 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        qemu-iotests: expand test 093 to support group throttling
        throttle: Update throttle infrastructure copyright
        throttle: add the name of the ThrottleGroup to BlockDeviceInfo
        throttle: acquire the ThrottleGroup lock in bdrv_swap()
        throttle: Add throttle group support
        throttle: Add throttle group infrastructure tests
        throttle: Add throttle group infrastructure
        throttle: Extract timers from ThrottleState into a separate structure
        raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size
        Revert "iothread: release iothread around aio_poll"

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 67251a311371c4d22e803f151f47fe817175b6c3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 9 18:54:04 2015 +0200

      block: Fix reopen flag inheritance

      When reopening an image, the block layer already takes care to reopen
      bs->file as well with recalculated inherited flags. The same must happen
      for any other child (most notably missing before this patch: backing
      files).

      If bs->file (or any other child) didn't originally inherit from bs, e.g.
      because it was created separately and then only referenced, it must not
      inherit flags on reopen either, so check the inherited_from field before
      propagation the reopen down.

      VMDK already reopened its extents manually; this code can now be
      dropped.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bddcec3745b0220d4a7eda700950812a94398668
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 9 18:47:50 2015 +0200

      block: Add BlockDriverState.inherits_from

      Currently, the block layer assumes that any block node can have only one
      parent, and if it has a parent, that it inherits some options/flags from
      this parent.

      This is not true any more: With references used in block device
      creation, a single node can be used by multiple parents, or it can be
      created separately and not inherit flags from any parent.

      To handle reopens correctly, a node must know from which parent it
      inherited options. This patch adds the information to BlockDriverState.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 6e93e7c41fdfdee3068770cae79380e1d986b76a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Apr 8 13:49:41 2015 +0200

      block: Add list of children to BlockDriverState

      This allows iterating over all children of a given BDS, not only
      including bs->file and bs->backing_hd, but also driver-specific
      ones like VMDK extents or Quorum children.

      For bdrv_swap(), the list of children of the swapped BDS stays at that
      BDS (because that's where the pointers stay as well). The list head
      moves and pointers to it must be fixed up therefore.

      The list of children in the parent of the swapped BDS is not affected by
      the swap. The contents of the BDS objects is swapped, so the existing
      pointer in the parent automatically points to the newly swapped in BDS.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit ae81693004fd95f7013e42811944707a92948d9a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 10 13:47:35 2015 +0200

      queue.h: Add QLIST_FIX_HEAD_PTR()

      If the head of a list has been moved to a different memory location, the
      le_prev link in the first list entry has to be fixed up. Provide a macro
      that implements this fixup.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 6ee4ce1ee75a651c246d926c2302281b51981f6d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 10 13:33:17 2015 +0200

      block: Drain requests before swapping nodes in bdrv_swap()

      bdrv_swap() requires that there are no requests in flight on either of
      the two devices. The request coroutine would work on the wrong
      BlockDriverState object (with bs->opaque even being interpreted as a
      different type potentially) and all sorts of bad things would result
      from this.

      The currently existing callers mostly ensure that there is no I/O
      pending on nodes that are swapped. In detail, this is:

      1. Live snapshots. This goes through qmp_transaction(), which calls
         bdrv_drain_all() before doing anything. The command is executed
         synchronously, so no new I/O can be issued concurrently.

      2. snapshot=on in bdrv_open(). We're in the middle of opening the image
         (both the original image and its temporary overlay), so there can't
         be any I/O in flight yet.

      3. Mirroring. bdrv_drain() is already used on the source device so that
         the mirror doesn't miss anything. However, the main loop runs between
         that and the bdrv_swap() (which is actually a bug, being addressed in
         another series), so there is a small window in which new I/O might be
         issued that would be in flight during bdrv_swap().

      It is safer to just drain the request queue of both devices in
      bdrv_swap() instead of relying on callers to do the right thing.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f3930ed0bb1945b59da8e591072b5c79606d0760
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Apr 8 13:43:47 2015 +0200

      block: Move flag inheritance to bdrv_open_inherit()

      Instead of letting every caller of bdrv_open() determine the right flags
      for its child node manually and pass them to the function, pass the
      parent node and the role of the newly opened child (like backing file,
      protocol layer, etc.).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 18edf289a8951f3a48caff3b5fe17f2d414c2924
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 17:12:56 2015 +0200

      block: Use QemuOpts in bdrv_open_common()

      Instead of manually parsing options and then deleting them from the
      options QDict, just use QemuOpts like most other places that deal with
      block device options.

      More options will be added there and then QemuOpts is a lot more
      manageable than open-coding everything.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 54861b9280e95dd16c062b26a9d0adfe3608c63c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 16:55:00 2015 +0200

      block: Use macro for cache option names

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit a646836784a0fc50fee6f9a0d3fb968289714128
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 15:35:59 2015 +0200

      vmdk: Use bdrv_open_image()

      Besides standardising on a single interface for opening child nodes,
      this patch allows the user to specify options to individual extent
      nodes. Overriding file names isn't possible with this yet, so it's of
      limited usefulness, but still a step forward.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>

  commit ea6828d81b34d42f407e8de28694d2751ee660a2
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jan 21 18:49:28 2015 +0100

      quorum: Use bdrv_open_image()

      Besides standardising on a single interface for opening child nodes,
      this simplifies the .bdrv_open() implementation of the quorum block
      driver by using block layer functionality for handling BlockdevRefs.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit ef1919df26b9b094aa41733466b134111fcdbd36
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 28 17:37:55 2015 +0200

      check-qdict: Test cases for new functions

      This adds test cases for the following new QDict functions:

      * qdict_array_entries()
      * qdict_set_default_str()
      * qdict_copy_default()

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 7990d2c99c974ae8e3c3f719d8321ddc6eac93bc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jan 19 21:22:45 2015 +0100

      qdict: Add qdict_{set,copy}_default()

      In the block layer functions that determine options for a child block
      device, it's a common pattern to either copy options from the parent's
      options or to set a default string if the option isn't explicitly set
      yet for the child. Provide convenience functions so that it becomes a
      one-liner for each option.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bd50530a9f40f6560a03caeaaddd451e2ce90ed8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jan 21 17:15:44 2015 +0100

      qdict: Add qdict_array_entries()

      This counts the entries in a flattened array in a QDict without
      actually splitting the QDict into a QList.

      bdrv_open_image() doesn't take a QList, but rather a QDict and a key
      prefix string, so this is more convenient for block drivers which have a
      dynamically sized list of child nodes (e.g. Quorum) and are to be
      converted to using bdrv_open_image() as the standard interface for
      opening child nodes.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0a2df857a7038c75379cc575de5d4be4c0ac629e
  Merge: 9faffeb fafa4d5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 15:39:05 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri Jun 12 13:57:20 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        qmp/hmp: add rocker device support
        rocker: bring link up/down on PHY enable/disable
        rocker: update tests using hw-derived interface names
        rocker: Add support for phys name
        iohandler: Change return type of qemu_set_fd_handler to "void"
        event-notifier: Always return 0 for posix implementation
        xen_backend: Remove unused error handling of qemu_set_fd_handler
        oss: Remove unused error handling of qemu_set_fd_handler
        alsaaudio: Remove unused error handling of qemu_set_fd_handler
        main-loop: Drop qemu_set_fd_handler2
        Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler
        tap: Drop tap_can_send
        net/socket: Drop net_socket_can_send
        netmap: Drop netmap_can_send
        l2tpv3: Drop l2tpv3_can_send
        stubs: Add qemu_set_fd_handler

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a68197ff5b11f5a58d48e485d16a36758aeca7f4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Mar 19 14:53:17 2015 -0400

      iotests: Add tests for overriding BDRV_O_PROTOCOL

      This adds tests for overriding the qemu-internal BDRV_O_PROTOCOL flag by
      explicitly specifying a block driver. As one test must be run over the
      NBD protocol while the other must not, this patch adds two separate
      iotests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 53a295131274c87914c97053e2ca00f19a9c2efa
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Mar 19 14:53:16 2015 -0400

      block: driver should override flags in bdrv_open()

      The BDRV_O_PROTOCOL flag should have an impact only if no driver is
      specified explicitly. Therefore, if bdrv_open() is called with an
      explicit block driver argument (either through the options QDict or
      through the drv parameter) and that block driver is a protocol block
      driver, BDRV_O_PROTOCOL should be set; if it is a format block driver,
      BDRV_O_PROTOCOL should be unset.

      While there was code to unset the flag in case a format block driver
      has been selected, it only followed the bdrv_fill_options() function
      call whereas the flag in fact needs to be adjusted before it is used
      there.

      With that change, BDRV_O_PROTOCOL will always be set if the BDS should
      be a protocol driver; if the driver has been specified explicitly, the
      new code will set it; and bdrv_fill_options() will only "probe" a
      protocol driver if BDRV_O_PROTOCOL is set. The probing after
      bdrv_fill_options() cannot select a protocol driver.

      Thus, bdrv_open_image() to open BDS.file is never called if a protocol
      BDS is about to be created. With that change in turn it is impossible to
      call bdrv_open_common() with a protocol drv and file != NULL, which
      allows us to remove the bdrv_swap() call.

      This change breaks a test case in qemu-iotest 051:
      "-drive file=t.qcow2,file.driver=qcow2" now works because the explicitly
      specified "qcow2" overrides the BDRV_O_PROTOCOL which is automatically
      set for the "file" BDS (and the filename is just passed down).
      Therefore, this patch removes that test case.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06207b0ff596aa4bb192d1fafc593847ed888e39
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Jun 10 13:24:54 2015 -0400

      block: Change bitmap truncate conditional to assertion

      This is an artifact of an older version that had both all-bitmap and
      single-bitmap truncate functions, and some info got lost in the shuffle.

      Bitmaps can only be frozen during a backup operation, and a backup
      operation should prevent a resize operation, so just assert that this
      cannot happen.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5270b6a0d0cf41e49d634007ace40f5dfc381940
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jun 8 16:49:15 2015 -0400

      block: record new size in bdrv_dirty_bitmap_truncate

      ce1ffea8 neglected to update the BdrvDirtyBitmap structure
      itself for internal consistency. It's currently not an issue,
      but for migration and persistence series this will cause headaches.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8684454e152ca2e100f4b59d80de2be27186206
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 9 10:45:16 2015 +0200

      raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size

      Image files with an unaligned image size have a final hole that starts
      at EOF, i.e. in the middle of a sector. Currently, *pnum == 0 is
      returned when checking the status of this sector. In qemu-img, this
      triggers an assertion failure.

      In order to fix this, one type for the sector that contains EOF must be
      found. Treating a hole as data is safe, so this patch rounds the
      calculated number of data sectors up, so that a partial sector at EOF is
      treated as a full data sector.

      This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1229394

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Cole Robinson <crobinso@redhat.com>

  commit 90df601f06de14f062d2e8dc1bc57f0decf86fd1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:02:57 2015 +0800

      vmdk: Use vmdk_find_index_in_cluster everywhere

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 61f0ed1d54601b91b8195c1a30d7046f83283b40
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:02:56 2015 +0800

      vmdk: Fix index_in_cluster calculation in vmdk_co_get_block_status

      It has the similar issue with b1649fae49a8. Since the calculation
      is repeated for a few times already, introduce a function so it can be
      reused.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bc85ef265a0118d044ff62ae217c186cb08e0866
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:19 2015 +0200

      qcow2: Add DEFAULT_L2_CACHE_CLUSTERS

      If a relatively large cluster size is chosen, the default of 1 MB L2
      cache is not really appropriate. In this case, unless overridden by the
      user, the default cache size should not be determined by its size in
      bytes but by the number of L2 tables (clusters) it is supposed to
      contain.

      Note that without this patch, MIN_L2_CACHE_SIZE will effectively take
      over the same role. However, providing space for just two L2 tables is
      not enough to be the default.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a4291eafc597c0944057930acf3e51d899f79c2e
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:18 2015 +0200

      iotests: qcow2 COW with minimal L2 cache size

      This adds a test case to test 103 for performing a COW operation in a
      qcow2 image using an L2 cache with minimal size (which should be at
      least two clusters so the COW can access both source and destination
      simultaneously).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 57e216695948a79d9ced82fc217a37cce70fd986
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:17 2015 +0200

      qcow2: Set MIN_L2_CACHE_SIZE to 2

      The L2 cache must cover at least two L2 tables, because during COW two
      L2 tables are accessed simultaneously.

      Reported-by: Alexander Graf <agraf@suse.de>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Tested-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9aa711d75030356f1e179b9f71780da5fd1a45bb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 19 10:46:13 2015 +0000

      qemu-iotests: Fix 128 if sudo required

      If passwordless "sudo" works, use it in the qemu-io cmd.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ff793890faeb119c8dad53b7ed614407ff7b027a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 12:01:41 2015 -0400

      iotests: remove assertIsNotNone call

      RHEL6 doesn't have Python 2.7, so replace this call with
      assertNotEqual(x, None) which will work just as well.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9faffeb7772fddcb5d3fb2dbdcfe7e8a38f01637
  Merge: 4cb618a d218b28
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 14:31:13 2015 +0100

      Merge remote-tracking branch 'remotes/aurel/tags/pull-sh4-next-20150612' into staging

      sh4 linux-user cpu and hwcap
      misc optimizations and cleanup
      convert r2d to new MMIO accessor style

      # gpg: Signature made Fri Jun 12 11:28:43 2015 BST using RSA key ID 1DDD8C9B
      # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
      # gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
      # gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

      * remotes/aurel/tags/pull-sh4-next-20150612:
        target-sh4: remove dead code
        target-sh4: factorize fmov implementation
        target-sh4: split out Q and M from of SR and optimize div1
        target-sh4: optimize negc using add2 and sub2
        target-sh4: optimize subc using sub2
        target-sh4: optimize addc using add2
        target-sh4: Split out T from SR
        target-sh4: use bit number for SR constants
        sh4/r2d: convert to new MMIO accessor style
        linux-user: Add HWCAP for SH4
        linux-user: Default sh4 to sh7785

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2db33f88d2b340c049c576ad75d442e4b6ffe768
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:48 2015 +0200

      qemu-iotests: expand test 093 to support group throttling

      This patch improves the test by attaching a different number of drives
      to the VM and putting them in the same throttling group. The test
      verifies that the I/O is evenly distributed among all members of the
      group, and that the limits are enforced.

      By default the test is repeated 3 times with 1, 2 and 3 drives, but
      the maximum number of simultaneous drives is configurable.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 513df1da5c658878191b579ebcddd985adcd4122.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a291d5d9b9940e1b07319041afc2c4b9285b9c48
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:47 2015 +0200

      throttle: Update throttle infrastructure copyright

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 07dcd4ed02f0110b13b3140f477b761b8bb8e270.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b8fe1694e506362706cde65d1bf55b23e62b150e
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:46 2015 +0200

      throttle: add the name of the ThrottleGroup to BlockDeviceInfo

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 172df91f09c69c6f0440a697bbd1b3f95b077ee4.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit db6283385cb708b9d589e5b57e96eab4afd0269e
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:45 2015 +0200

      throttle: acquire the ThrottleGroup lock in bdrv_swap()

      bdrv_swap() touches the fields of a BlockDriverState that are
      protected by the ThrottleGroup lock. Although those fields end up in
      their original place, they are temporarily swapped in the process,
      so there's a chance that an operation on a member of the same group
      happening on a different thread can try to use them.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: d92dc40d7c4f1fc5cda5cbbf4ffb7a4670b79d17.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 76f4afb40fa076ed23fe0ab42c7a768ddb71123f
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:44 2015 +0200

      throttle: Add throttle group support

      The throttle group support use a cooperative round robin scheduling
      algorithm.

      The principles of the algorithm are simple:
      - Each BDS of the group is used as a token in a circular way.
      - The active BDS computes if a wait must be done and arms the right
        timer.
      - If a wait must be done the token timer will be armed so the token
        will become the next active BDS.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: f0082a86f3ac01c46170f7eafe2101a92e8fde39.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1fee955f9cc5903b3c7f79bbd90929aefad583a6
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:43 2015 +0200

      throttle: Add throttle group infrastructure tests

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: ba7b9dc7fca43efbb31d5f3aad91a8dbdbea635b.1433779731.git.berto@igalia.com
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2ff1f2e3a39daf4a401a8904d00b29ea8c450463
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:42 2015 +0200

      throttle: Add throttle group infrastructure

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 2fdb4de17210b733a13eb472c33cd08b45f8fd21.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0e5b0a2d54f4dca2f6d1a676da8ec089dc143001
  Author: Benoît Canet <benoit.canet@nodalink.com>
  Date:   Mon Jun 8 18:17:41 2015 +0200

      throttle: Extract timers from ThrottleState into a separate structure

      Group throttling will share ThrottleState between multiple bs.
      As a consequence the ThrottleState will be accessed by multiple aio
      context.

      Timers are tied to their aio context so they must go out of the
      ThrottleState structure.

      This commit paves the way for each bs of a common ThrottleState to
      have its own timer.

      Signed-off-by: Benoit Canet <benoit.canet@nodalink.com>
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 6cf9ea96d8b32ae2f8769cead38f68a6a0c8c909.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f4a769abaa51badea666093077c50c568c35de17
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 9 10:55:08 2015 +0200

      raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size

      Image files with an unaligned image size have a final hole that starts
      at EOF, i.e. in the middle of a sector. Currently, *pnum == 0 is
      returned when checking the status of this sector. In qemu-img, this
      triggers an assertion failure.

      In order to fix this, one type for the sector that contains EOF must be
      found. Treating a hole as data is safe, so this patch rounds the
      calculated number of data sectors up, so that a partial sector at EOF is
      treated as a full data sector.

      This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1229394

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1433840108-9996-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da5e1de95bb235330d7724316e7a29239d1359d5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jun 3 10:15:33 2015 +0100

      Revert "iothread: release iothread around aio_poll"

      This reverts commit a0710f7995f914e3044e5899bd8ff6c43c62f916.

      In qemu-devel email message <556DBF87.2020908@de.ibm.com>, Christian
      Borntraeger writes:

        Having many guests all with a kernel/ramdisk (via -kernel) and
        several null block devices will result in hangs. All hanging
        guests are in partition detection code waiting for an I/O to return
        so very early maybe even the first I/O.

        Reverting that commit "fixes" the hangs.

      Reverting this commit for the 2.4 release.  More time is needed to
      investigate and correct this patch.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fafa4d508b42a70a59a6bd647a2c0cfad86246c3
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:21 2015 -0700

      qmp/hmp: add rocker device support

      Add QMP/HMP support for rocker devices.  This is mostly for debugging purposes
      to see inside the device's tables and port configurations.  Some examples:

      (qemu) info rocker sw1
      name: sw1
      id: 0x0000013512005452
      ports: 4

      (qemu) info rocker-ports sw1
                  ena/    speed/ auto
            port  link    duplex neg?
           sw1.1  up     10G  FD  No
           sw1.2  up     10G  FD  No
           sw1.3  !ena   10G  FD  No
           sw1.4  !ena   10G  FD  No

      (qemu) info rocker-of-dpa-flows sw1
      prio tbl hits key(mask) --> actions
      2    60       pport 1 vlan 1 LLDP src 00:02:00:00:02:00 dst 01:80:c2:00:00:0e
      2    60       pport 1 vlan 1 ARP src 00:02:00:00:02:00 dst 00:02:00:00:03:00
      2    60       pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:00:02 proto 58
      3    50       vlan 2 dst 33:33:ff:00:00:02 --> write group 0x32000001 goto tbl 60
      2    60       pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:03:00 proto 58
      3    50  1    vlan 2 dst 33:33:ff:00:03:00 --> write group 0x32000001 goto tbl 60
      2    60       pport 2 vlan 2 ARP src 00:02:00:00:03:00 dst 00:02:00:00:02:00
      3    50  2    vlan 2 dst 00:02:00:00:02:00 --> write group 0x02000001 goto tbl 60
      2    60  1    pport 2 vlan 2 IP src 00:02:00:00:03:00 dst 00:02:00:00:02:00 proto 1
      3    50  2    vlan 1 dst 00:02:00:00:03:00 --> write group 0x01000002 goto tbl 60
      2    60  1    pport 1 vlan 1 IP src 00:02:00:00:02:00 dst 00:02:00:00:03:00 proto 1
      2    60       pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:00:01 proto 58
      3    50       vlan 1 dst 33:33:ff:00:00:01 --> write group 0x31000000 goto tbl 60
      2    60       pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:02:00 proto 58
      3    50  1    vlan 1 dst 33:33:ff:00:02:00 --> write group 0x31000000 goto tbl 60
      1    60  173  pport 2 vlan 2 LLDP src <any> dst 01:80:c2:00:00:0e --> write group 0x02000000
      1    60  6    pport 2 vlan 2 IPv6 src <any> dst <any> --> write group 0x02000000
      1    60  174  pport 1 vlan 1 LLDP src <any> dst 01:80:c2:00:00:0e --> write group 0x01000000
      1    60  174  pport 2 vlan 2 IP src <any> dst <any> --> write group 0x02000000
      1    60  6    pport 1 vlan 1 IPv6 src <any> dst <any> --> write group 0x01000000
      1    60  181  pport 2 vlan 2 ARP src <any> dst <any> --> write group 0x02000000
      1    10  715  pport 2 --> apply new vlan 2 goto tbl 20
      1    60  177  pport 1 vlan 1 ARP src <any> dst <any> --> write group 0x01000000
      1    60  174  pport 1 vlan 1 IP src <any> dst <any> --> write group 0x01000000
      1    10  717  pport 1 --> apply new vlan 1 goto tbl 20
      1    0   1432 pport 0(0xffff) --> goto tbl 10

      (qemu) info rocker-of-dpa-groups sw1
      id (decode) --> buckets
      0x32000001 (type L2 multicast vlan 2 index 1) --> groups [0x02000001,0x02000000]
      0x02000001 (type L2 interface vlan 2 pport 1) --> pop vlan out pport 1
      0x01000002 (type L2 interface vlan 1 pport 2) --> pop vlan out pport 2
      0x02000000 (type L2 interface vlan 2 pport 0) --> pop vlan out pport 0
      0x01000000 (type L2 interface vlan 1 pport 0) --> pop vlan out pport 0
      0x31000000 (type L2 multicast vlan 1 index 0) --> groups [0x01000002,0x01000000]

      [Added "query-" prefixes to rocker.json commands as suggested by Eric
      Blake <eblake@redhat.com>.
      --Stefan]

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1433985681-56138-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5ff1547b756a820bc7b695fe393b25d82467d1fe
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:20 2015 -0700

      rocker: bring link up/down on PHY enable/disable

      When the OS driver enables/disables the port, go ahead and set the port's
      link status to up/down in response to the change.  This more closely
      emulates real hardware when the PHY for the port is brought up/down
      and the PHY negotiates carrier (link status) with link partner.  In
      the case of qemu, the virtual rocker device can't really do link
      negotiation with the link partner as that requires signally over a
      physical medium (the wire), so just pretend the negotiation was
      successful and bring the link up when the port is enabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1433985681-56138-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 73da0232098a69d06ce0d49ad8751b7c5e8b9448
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:19 2015 -0700

      rocker: update tests using hw-derived interface names

      With previous patch to support phy name attribute for each port, the OS
      can name port interfaces using the hw-derived name.  So update rocker
      tests to use the new hw-derived interface names.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1433985681-56138-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 773495364ffbfc6a4d1e13e24e932f96409ba1d3
  Author: David Ahern <dsahern@gmail.com>
  Date:   Wed Jun 10 18:21:18 2015 -0700

      rocker: Add support for phys name

      Add ROCKER_TLV_CMD_PORT_SETTINGS_PHYS_NAME to port settings. This attribute
      exports the port name to the guest OS allowing it to name interfaces with
      sensible defaults.

      Mostly done by Scott for phys_id support; adapted to phys_name by David.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: David Ahern <dsahern@gmail.com>
      Message-id: 1433985681-56138-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f4d248bdc33167ab9e91b1470ef47a61dffd0b38
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:24 2015 +0800

      iohandler: Change return type of qemu_set_fd_handler to "void"

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-14-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1e354528bdaf9671ffc94e531e6967233abe7b8f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:23 2015 +0800

      event-notifier: Always return 0 for posix implementation

      qemu_set_fd_handler cannot fail, let's always return 0.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-13-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6b5166f8a82888638bb9aba9dc49aa7fa25f292f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:22 2015 +0800

      xen_backend: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-12-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b027a538c6790bcfc93ef7f4819fe3e581445959
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:21 2015 +0800

      oss: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-11-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit be93f216278d84d283187c95cef16c0b60b711b8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:20 2015 +0800

      alsaaudio: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-10-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6484e422479c93f28e3f8a68258b0eacd3b31e6d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:19 2015 +0800

      main-loop: Drop qemu_set_fd_handler2

      All users are converted to qemu_set_fd_handler now, drop
      qemu_set_fd_handler2 and IOHandlerRecord.fd_read_poll.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-9-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 82e1cc4bf91a2e1c3b62297b10b0ab1d93adfc45
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:18 2015 +0800

      Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler

      Done with following Coccinelle semantic patch, plus manual cosmetic changes in
      net/*.c.

          @@
          expression E1, E2, E3, E4;
          @@
          -   qemu_set_fd_handler2(E1, NULL, E2, E3, E4);
          +   qemu_set_fd_handler(E1, E2, E3, E4);

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-8-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a90a7425cf592a3afeff3eaf32f543b83050ee5c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:17 2015 +0800

      tap: Drop tap_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be sent to peer when it arrives. If the device can't
      receive, it will be queued to incoming_queue, and when the device status
      changes, this queue will be flushed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-7-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e99c631f116221d169ea53953d91b8aa74d297a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:16 2015 +0800

      net/socket: Drop net_socket_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be sent to peer when it arrives. If the device can't
      receive, it will be queued to incoming_queue, and when the device status
      changes, this queue will be flushed.

      If the peer is not ready, disable the read poll until send completes.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e8dd1d9c396104f0fac4b39a701143df49df2a74
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:15 2015 +0800

      netmap: Drop netmap_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be copied from s->fd to s->iov when it arrives. If the
      device can't receive, it will be queued to incoming_queue, and when the
      device status changes, this queue will be flushed.

      Also remove the qemu_can_send_packet() check in netmap_send. If it's
      true, we are good; if it's false, the qemu_sendv_packet_async would
      return 0 and read poll will be disabled until netmap_send_completed is
      called.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 95b1416ae93106923f733941e52dfe55c4318643
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:14 2015 +0800

      l2tpv3: Drop l2tpv3_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be copied from s->fd to s->msgvec when it arrives. If the
      device can't receive, it will be queued to incoming_queue, and when the
      device status changes, this queue will be flushed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0bc12c4f7e8b5ff0f83908bdef0c247f1ca1a9d8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:12 2015 +0800

      stubs: Add qemu_set_fd_handler

      Some qemu_set_fd_handler2 stub callers will be converted to
      call qemu_set_fd_handler, add this stub for them before making the
      change.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4cb618abc1818586c08011ff0a84a015787b1672
  Merge: a4ef02f 6773f9b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 12:49:40 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150612' into staging

      MIPS patches 2015-06-12

      Changes:
      * improve dp8393x network card and rc4030 chipset emulation
      * support misaligned R6 and MSA memory accesses
      * support MIPS eXtended and Large Physical Addressing
      * add Config5.FRE bit and ERETNC instruction (Config5.LLB)
      * support ememsize on MALTA

      # gpg: Signature made Fri Jun 12 09:38:11 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150612: (29 commits)
        target-mips: enable XPA and LPA features
        target-mips: remove misleading comments in translate_init.c
        target-mips: add MTHC0 and MFHC0 instructions
        target-mips: add CP0.PageGrain.ELPA support
        target-mips: support Page Frame Number Extension field
        target-mips: extend selected CP0 registers to 64-bits in MIPS32
        target-mips: correct MFC0 for CP0.EntryLo in MIPS64
        net/dp8393x: fix hardware reset
        net/dp8393x: correctly reset in_use field
        net/dp8393x: add load/save support
        net/dp8393x: add PROM to store MAC address
        net/dp8393x: QOM'ify
        net/dp8393x: use dp8393x_ prefix for all functions
        net/dp8393x: do not use old_mmio accesses
        net/dp8393x: always calculate proper checksums
        dma/rc4030: convert to QOM
        dma/rc4030: use trace events instead of custom logging
        dma/rc4030: document register at offset 0x210
        dma/rc4030: do not use old_mmio accesses
        dma/rc4030: use AddressSpace and address_space_rw in users
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4ef02fd9b3d12b105b56942166c8364ade9be0f
  Merge: d8e3b72 4fa3dd1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 11:06:03 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150612' into staging

      migration/next for 20150612

      # gpg: Signature made Fri Jun 12 05:56:21 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150612: (21 commits)
        Remove unneeded memset
        Rename RDMA structures to make destination clear
        Teach analyze-migration.py about section footers
        Add a protective section footer
        Disable section footers on older machine types
        Merge section header writing
        Move loadvm_handlers into MigrationIncomingState
        Move copy out of qemu_peek_buffer
        Create MigrationIncomingState
        qemu_ram_foreach_block: pass up error value, and down the ramblock name
        Split header writing out of qemu_savevm_state_begin
        Add qemu_get_counted_string to read a string prefixed by a count byte
        migration: Use normal VMStateDescriptions for Subsections
        migration: create savevm_state
        migration: Remove duplicated assignment of SETUP status
        rdma: Fix qemu crash when IPv6 address is used for migration
        arch_init: Clean up the duplicate variable 'len' defining in ram_load()
        migration: reduce include files
        migration: Add myself to the copyright list of both files
        migration: move savevm.c inside migration/
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d218b28d28b8f4de297bfd35c082b22f153cf0df
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: remove dead code

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91b4d29f4eecab14c5f8888ecd7b3a740ad80b7c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: factorize fmov implementation

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 1d565b21e1aecbb0da6589f3c4ea83c9c788ad63
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: split out Q and M from of SR and optimize div1

      Splitting Q and M out of SR, it's possible to optimize div1 by using
      TCG code instead of an helper.

      At the same time removed the now unused gen_copy_bit_i32 function.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 60eb27fe4951fbe6cf5e24cc3d6df7e97c43a909
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize negc using add2 and sub2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit d0f44a55fa321e042bd6b2a0fa25ac48864b7a25
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize subc using sub2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit a2368e01c95a093d250a0e5d3cef53dddf642f1e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize addc using add2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 34086945254c035a03e01e472d99e4524a2f2416
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: Split out T from SR

      In preparation for more efficient setting of this field.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 5ed9a259c164bb9fd2a6fe8a363a4bda2e4a5461
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: use bit number for SR constants

      Use the bit number for SR constants instead of using a bit mask. This
      make possible to also use the constants for shifts.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 563807520ff19e6ed2d40695f543f1fba7ba432f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:16:43 2015 +0200

      sh4/r2d: convert to new MMIO accessor style

      The documentation is clear to use 16-bit accesses for all registers.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e42fd944f02dda893fc8773959d6db75f2a49367
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat May 23 15:06:54 2015 -0700

      linux-user: Add HWCAP for SH4

      Only exposing FPU and LLSC as the only features
      supported by the translator.

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91c45a38f282b970f443f8e9d6bdb6ffaa00dfbf
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat May 23 15:06:53 2015 -0700

      linux-user: Default sh4 to sh7785

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 7a4dfd1e4a741991df1acf31672b391648e0aa0c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 13:04:17 2014 +0200

      virtio-vga: add vgabios configuration

      Add seavgabios configuration for virtio-vga,
      hook up the new vgabios in the makefiles.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a94f0c5ca2f0e3dba4a64f40c9d2e1149017d81d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:28:48 2014 +0200

      virtio-vga: add '-vga virtio' support

      Some convinience fluff:  Add support for '-vga virtio', also add
      virtio-vga to the list of vga cards so '-device virtio-vga' will
      turn off the default vga.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c5d4dac86b61070c078a7b35e25f56d2c8bff508
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:25:45 2014 +0200

      virtio-vga: add virtio gpu device with vga compatibility

      This patch adds a virtio-vga device.  It is simliar to virtio-gpu-pci,
      but it also adds in vga compatibility, so guests without native
      virtio-gpu support can drive the device in vga mode.  It is compatible
      with stdvga.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9eafb62d47ac1c8c2d431e1b4829445444ccc2ee
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:20:34 2014 +0200

      virtio-gpu-pci: add virtio pci support

      This patch adds virtio-gpu-pci, which is the pci proxy for the virtio
      gpu device.  With this patch in place virtio-gpu is functional.  You
      need a linux guest with a virtio-gpu driver though, and output will
      appear pretty late in boot, once the kernel initialized drm and fbcon.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2c84167b4efa4a0e81946ef624e96005396e14b2
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Mar 17 08:56:18 2015 +0100

      virtio-gpu: fix error message

      iov limit was raised, but the error message still has the old limit ...

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6773f9b687e0a8ab4b638ef88d075fb233fb7669
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:33:43 2015 +0100

      target-mips: enable XPA and LPA features

      Enable XPA in MIPS32R5-generic and LPA in MIPS64R6-generic.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 28b027d5b63c7550c7390041d6dd50948c8f55b8
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:33:35 2015 +0100

      target-mips: remove misleading comments in translate_init.c

      PABITS are not hardcoded to 36 bits and we do not model 59 PABITS (which is
      the architectural limit) in QEMU.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 5204ea79ea739b557f47fc4db96c94edcb33a5d6
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Sep 11 16:28:17 2014 +0100

      target-mips: add MTHC0 and MFHC0 instructions

      Implement MTHC0 and MFHC0 instructions. In MIPS32 they are used to access
      upper word of extended to 64-bits CP0 registers.

      In MIPS64, when CP0 destination register specified is the EntryLo0 or
      EntryLo1, bits 1:0 of the GPR appear at bits 31:30 of EntryLo0 or
      EntryLo1. This is to compensate for RI and XI, which were shifted to bits
      63:62 by MTC0 to EntryLo0 or EntryLo1. Therefore creating separate
      functions for EntryLo0 and EntryLo1.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e117f52636d04502fab28bd3abe93347c29f39a5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:09:38 2015 +0100

      target-mips: add CP0.PageGrain.ELPA support

      CP0.PageGrain.ELPA enables support for large physical addresses. This field
      is encoded as follows:
      0: Large physical address support is disabled.
      1: Large physical address support is enabled.

      If this bit is a 1, the following changes occur to coprocessor 0 registers:
      - The PFNX field of the EntryLo0 and EntryLo1 registers is writable and
        concatenated with the PFN field to form the full page frame number.
      - Access to optional COP0 registers with PA extension, LLAddr, TagLo is
        defined.

      P5600 can operate in 32-bit or 40-bit Physical Address Mode. Therefore if
      XPA is disabled (CP0.PageGrain.ELPA = 0) then assume 32-bit Address Mode.
      In MIPS64 assume 36 as default PABITS (when CP0.PageGrain.ELPA = 0).

      env->PABITS value is constant and indicates maximum PABITS available on
      a core, whereas env->PAMask is calculated from env->PABITS and is also
      affected by CP0.PageGrain.ELPA.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit cd0d45c40133ef8b409aede5ad8a99aeaf6a70fe
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Sep 11 16:28:16 2014 +0100

      target-mips: support Page Frame Number Extension field

      Update tlb->PFN to contain PFN concatenated with PFNX. PFNX is 0 if large
      physical address is not supported.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 284b731a6ae47b9ebabb9613e753c4d83cf75dd3
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jun 9 17:14:13 2015 +0100

      target-mips: extend selected CP0 registers to 64-bits in MIPS32

      Extend EntryLo0, EntryLo1, LLAddr and TagLo from 32 to 64 bits in MIPS32.

      Introduce gen_move_low32() function which moves low 32 bits from 64-bit
      temp to GPR; it sign extends 32-bit value on MIPS64 and truncates on
      MIPS32.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit b435f3f3d174721382b55bbd0c785ec50c1796a9
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Mar 20 12:06:10 2015 +0000

      target-mips: correct MFC0 for CP0.EntryLo in MIPS64

      CP0.EntryLo bits 31:30 have to be cleared.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 4fa3dd17dc29c316726f0d4a354a4d895e130c73
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Apr 20 16:57:21 2015 +0100

      Remove unneeded memset

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit a97270ad5d6dd0382ecb4568674226c8463e59fb
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Apr 20 16:57:16 2015 +0100

      Rename RDMA structures to make destination clear

      RDMA has two data types that are named confusingly;
         RDMALocalBlock (pointed to indirectly by local_ram_blocks)
         RDMARemoteBlock (pointed to by block in RDMAContext)

      RDMALocalBlocks, as the name suggests is a data strucuture that
      represents the RDMAable RAM Blocks on the current side of the migration
      whichever that is.

      RDMARemoteBlocks is always the shape of the RAMBlocks on the
      destination, even on the destination.

      Rename:
           RDMARemoteBlock -> RDMADestBlock
           context->'block' -> context->dest_blocks

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 73d9a7961ab1b083fb2095413a3bd091e35f4369
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:53 2015 +0100

      Teach analyze-migration.py about section footers

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f68945d42bab700d95b87f62e0898606ce2421ed
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:52 2015 +0100

      Add a protective section footer

      Badly formatted migration streams can go undetected or produce
      misleading errors due to a lock of checking at the end of sections.
      In particular a section that adds an extra 0x00 at the end
      causes what looks like a normal end of stream and thus doesn't produce
      any errors, and something that ends in a 0x01..0x04 kind of look
      like real section headers and then fail when the section parser tries
      to figure out which section they are.  This is made worse by the
      choice of 0x00..0x04 being small numbers that are particularly common
      in normal section data.

      This patch adds a section footer consisting of a marker (0x7e - ~)
      followed by the section-id that was also sent in the header.  If
      they mismatch then it throws an error explaining which section was
      being loaded.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 37fb569c0198cba58e3e1bdf6b9702c8248b89dd
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:51 2015 +0100

      Disable section footers on older machine types

      The next patch adds section footers; but we don't want to
      break migration compatibility so disable them on older
      machine types

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit ce39bfc9186005d222a78db4a7fbdc83e2d62481
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:50 2015 +0100

      Merge section header writing

      The header writing for device sections is open coded in
      a few places, merge it into one.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1a8f46f8d61ef885ff9d0bda251e4e9830c932ef
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:16 2015 +0100

      Move loadvm_handlers into MigrationIncomingState

      In postcopy we need the loadvm_handlers to be used in a couple
      of different instances of the loadvm loop/routine, and thus
      it can't be local any more.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7c1e52ba6f3994dc127118f491258ce84d0beb52
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:15 2015 +0100

      Move copy out of qemu_peek_buffer

      qemu_peek_buffer currently copies the data it reads into a buffer,
      however a future patch wants access to the buffer without the copy,
      hence rework to remove the copy to the layer above.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit bca7856ae8220d9f15ff0f44b97397529e26a552
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:14 2015 +0100

      Create MigrationIncomingState

      There are currently lots of pieces of incoming migration state scattered
      around, and postcopy is adding more, and it seems better to try and keep
      it together.

      allocate MIS in process_incoming_migration_co

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e3807054e20fb3b94d18cb751c437ee2f43b6fac
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:13 2015 +0100

      qemu_ram_foreach_block: pass up error value, and down the ramblock name

      check the return value of the function it calls and error if it's non-0
      Fixup qemu_rdma_init_one_block that is the only current caller,
        and rdma_add_block the only function it calls using it.

      Pass the name of the ramblock to the function; helps in debugging.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f796baa1b3efcf105ba3a465f797e05ac2b3dcfc
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:12 2015 +0100

      Split header writing out of qemu_savevm_state_begin

      Split qemu_savevm_state_begin to:
        qemu_savevm_state_header   That writes the initial file header.
        qemu_savevm_state_begin    That sets up devices and does the first
                                   device pass.

      Used later in postcopy.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b3af1bc9d21e6bec7dfd283d91b465c9f815b6d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:11 2015 +0100

      Add qemu_get_counted_string to read a string prefixed by a count byte

      and use it in loadvm_state and ram_load.

      Where ever it's used, check the return and error if it failed.

      Minor: ram_load was using a 257 byte array for its string, the
             maximum length is 255 bytes + 0 terminator, so fix to 256

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 5cd8cadae8db905afcbf877cae568c27d1d55a8a
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Sep 23 14:09:54 2014 +0200

      migration: Use normal VMStateDescriptions for Subsections

      We create optional sections with this patch.  But we already have
      optional subsections.  Instead of having two mechanism that do the
      same, we can just generalize it.

      For subsections we just change:

      - Add a needed function to VMStateDescription
      - Remove VMStateSubsection (after removal of the needed function
        it is just a VMStateDescription)
      - Adjust the whole tree, moving the needed function to the corresponding
        VMStateDescription

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0163a2e025cda6acb33e100d296965671ace17d9
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 13 13:37:04 2015 +0200

      migration: create savevm_state

      This way, we will put savevm global state here, instead of lots of variables.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit e45a1ebfc65fb23be8cddb684d97eaa92725484d
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 17:14:28 2015 +0200

      migration: Remove duplicated assignment of SETUP status

      We assign the MIGRATION_STATUS_SETUP status in two places.  Just in
      succession.  Just remove the second one.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 5b61d5752156dcbbe2bf1366c877a676ed9f8f51
  Author: Padmanabh Ratnakar <padmanabh.ratnakar@avagotech.com>
  Date:   Wed Jun 3 04:44:10 2015 +0530

      rdma: Fix qemu crash when IPv6 address is used for migration

      Qemu crashes when IPv6 address is specified for migration and access
      to any RDMA uverbs device available on the system is blocked using cgroups.
      Fix the crash by checking the return value of ibv_open_device routine.

      Signed-off-by: Meghana Cheripady <meghana.cheripady@avagotech.com>
      Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@avagotech.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 5ee6926582cca64238967b2d00d870265cdb10b8
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri May 15 17:00:03 2015 +0800

      arch_init: Clean up the duplicate variable 'len' defining in ram_load()

      There are two places that define 'len' variable, It's OK for compiling,
      but makes it difficult for reading.

      Remove the local one which defined in the inside 'while' loop.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7205c9ec525fe375dd34c0f116c36dc4aab4c0f7
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 13:54:36 2015 +0200

      migration: reduce include files

      To make changes easier, with the copy, I maintained almost all include
      files.  Now I remove the unnecessary ones on this patch.  This compiles
      on linux x64 with all architectures configured, and cross-compiles for
      windows 32 and 64 bits.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 76cc7b587f1cd1679821e034a2d9974af9bc7d2b
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 13:20:21 2015 +0200

      migration: Add myself to the copyright list of both files

      If anyone feels like adding himself to the list, just sent me a patch.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c3049a56d69f1ee7e85b5100ba5d0e3dc69a14f1
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 12:49:01 2015 +0200

      migration: move savevm.c inside migration/

      Now, everything is in place.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 56e93d26b85bac76b93211393163c2ebcdee9481
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu May 7 19:33:31 2015 +0200

      migration: move ram stuff to migration/ram

      For historic reasons, ram migration have been on arch_init.c.  Just
      split it into migration/ram.c, the same that happened with block.c.

      There is only code movement, no changes altogether.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 795dc6e46d953d70b4b7ddd3f4956f8f4b9d8565
  Author: Mao Chuan Li <maochuan@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:36 2015 +0800

      watchdog: Add new Virtual Watchdog action INJECT-NMI

      This patch allows QEMU to inject a NMI into a guest when the
      watchdog expires.

      Signed-off-by: Mao Chuan Li <maochuan@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      CC: Eric Blake <eblake@redhat.com>
      CC: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f9a535e089abcbc7ac99db83c8c6e4644e395b12
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:35 2015 +0800

      nmi: Implement inject_nmi() for non-monitor context use

      Let's introduce a general "inject_nmi()" function that doesn't rely on the cpu
      index of the monitor, but uses cpu index 0 as default (except for x86).
      This function can then later be used from a non-monitor context.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      CC: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d67f5fe63caa0f707fa91c760508c340e050b6f0
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:34 2015 +0800

      s390x/watchdog: diag288 migration support

      Add vmstate structure to keep state and data during migration.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 8fc639af4b62930671b6988c1f7eedf9e7c9f7bc
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Jun 11 13:55:26 2015 +0200

      s390x/kvm: diag288 instruction interception and handling

      Intercept the diag288 requests from kvm guests, and hand the
      requested command to the diag288 watchdog device for further
      handling.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 188f24c2c149bcb0088c6317e99e09afc007de34
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:32 2015 +0800

      s390x/watchdog: introduce diag288 watchdog device

      This patch introduces a new diag288 watchdog device that will, just like
      other watchdogs, monitor a guest and take corresponding actions when it
      detects that the guest is not responding.

      diag288 is s390x specific. The wiring to s390x KVM will be done in
      separate patches.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [split out qemu-option.hx base changes]

  commit d7933ef3ac81149a51ba43ddac9fe70405008aba
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Jun 11 17:32:05 2015 +0200

      watchdog: change option wording to allow for more watchdogs

      We will introduce a new watchdog for s390x. Lets adopt
      qemu-options.hx to allow more watchdog devices.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [split out qemu-option.hx base changes]

  commit d8e3b729cf452d2689c8669f1ec18158db29fd5a
  Merge: afa25c4 4ebc736
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 15:33:38 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, acpi, virtio

      Most notably this includes virtio 1 patches
      Still not all devices converted, and not fully spec compliant,
      so disabled by default.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu Jun 11 12:53:08 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (42 commits)
        i386/acpi-build: fix PXB workarounds for unsupported BIOSes
        i386/acpi-build: more traditional _UID and _HID for PXB root buses
        vhost-scsi: move qdev properties into vhost-scsi.c
        virtio-9p-device: move qdev properties into virtio-9p-device.c
        virtio-serial-bus: move qdev properties into virtio-serial-bus.c
        virtio-rng: move qdev properties into virtio-rng.c
        virtio-scsi: move qdev properties into virtio-scsi.c
        virtio-net.h: Remove unsed DEFINE_VIRTIO_NET_PROPERTIES
        virtio-net: move qdev properties into virtio-net.c
        virtio-input: emulated devices [pci]
        virtio-input: core code & base class [pci]
        pci: add PCI_CLASS_INPUT_*
        virtio-pci: fill VirtIOPCIRegions early.
        virtio-pci: drop identical virtio_pci_cap
        virtio-pci: move cap type to VirtIOPCIRegion
        virtio-pci: move virtio_pci_add_mem_cap call to virtio_pci_modern_region_map
        virtio-pci: add virtio_pci_modern_region_map()
        virtio-pci: add virtio_pci_modern_regions_init()
        virtio-pci: add struct VirtIOPCIRegion for virtio-1 regions
        virtio-balloon: switch to virtio_add_feature
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit afa25c4bb5bd0732dca4aa0691fd4682d242925f
  Merge: 0b70743 08d49df
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 14:40:25 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150611-1' into staging

      sdl2: fix crash in handle_windowevent() when restoring the screen size

      # gpg: Signature made Thu Jun 11 08:57:38 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150611-1:
        sdl2: fix crash in handle_windowevent() when restoring the screen size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b70743d4f4f260b2fe6ed53fecc6bc6cda13910
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Thu Jun 11 09:44:40 2015 +0100

      hw/vfio/platform: replace g_malloc0_n by g_new0

      g_malloc0_n() is introduced since glib-2.24 while QEMU currently
      requires glib-2.22. This may cause a link error on some distributions.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 169b71331eaff7a28e3d4fabe8733e7db91f01aa
  Merge: 39e16a5 5a9259a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 12:12:58 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150611-1' into staging

      spice: fix segfault in qemu_spice_create_update, ui_info tweaks.

      # gpg: Signature made Thu Jun 11 08:48:49 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150611-1:
        spice: ui_info tweaks
        spice-display: fix segfault in qemu_spice_create_update

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ebc736e9938a7e88ecc785734b17145bf802a56
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 11 02:37:59 2015 +0200

      i386/acpi-build: fix PXB workarounds for unsupported BIOSes

      The patch

        apci: fix PXB behaviour if used with unsupported BIOS

      uses the following condition to see if a "PXB mem/IO chunk" has *not* been
      configured by the BIOS:

        (!range_base || range_base > range_limit)

      When this condition evaluates to true, said patch *omits* the
      corresponding entry from the _CRS.

      Later on the patch checks for the opposite condition (with the intent of
      *adding* entries to the _CRS if the "PXB mem/IO chunks" *have* been
      configured). Unfortunately, the condition was negated incorrectly: only
      the first ! operator was removed, which led to the nonsensical expression

        (range_base || range_base > range_limit)

      leading to bogus entries in the _CRS, and causing BSOD in Windows Server
      2012 R2 when it runs on OVMF.

      The correct negative of the condition seen at the top is

        (range_base && range_base <= range_limit)

      Fix the expressions.

      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c96d9286a6d70452e5fa4f1e3f840715e325be95
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 11 02:37:58 2015 +0200

      i386/acpi-build: more traditional _UID and _HID for PXB root buses

      The ACPI specification permits the _HID and _UID objects to evaluate to
      strings. (See "6.1.5 _HID (Hardware ID)" and "6.1.12 _UID (Unique ID)" in
      the ACPI v6.0 spec.)

      With regard to related standards, the UEFI specification can also express
      a device address composed from string _HID and _UID identifiers, inside
      the Expanded ACPI Device Path Node. (See "9.3.3 ACPI Device Path", Table
      49, in the UEFI v2.5 spec.)

      However, numeric (integer) contents for both _HID and _UID are more
      traditional. They are recommended by the UEFI spec for size reasons:

        [...] the ACPI Device Path node is smaller and should be used if
        possible to reduce the size of device paths that may potentially be
        stored in nonvolatile storage [...]

      External tools support them better (for example the --acpi_hid and
      --acpi_uid options of "efibootmgr" only take numeric identifiers).
      Finally, numeric _HID and _UID contents are existing practice in the QEMU
      source.

      This patch was tested with a Fedora 20 LiveCD and a preexistent Windows
      Server 2012 R2 guest. Using "acpidump" and "iasl" in the Fedora guest, we
      get, in the SSDT:

      > Scope (\_SB)
      > {
      >   Device (PC04)
      >   {
      >     Name (_UID, 0x04)  // _UID: Unique ID
      >     Name (_HID, EisaId ("PNP0A03") /* PCI Bus */)  // _HID: Hardware ID

      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 39e16a5b708358202e8d2252e3d84863666dc9e5
  Merge: 0e12e61 060ab76
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 11:18:11 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150611-1' into staging

      gtk: don't exit early in case gtk init fails

      # gpg: Signature made Thu Jun 11 10:38:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150611-1:
        gtk: don't exit early in case gtk init fails

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 060ab76356fff6a420bc881a574c40a5dda086af
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jun 5 13:07:58 2015 +0200

      gtk: don't exit early in case gtk init fails

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>

  commit bd8f1ebce430eb6c1dd92e34baf7bc35aa600464
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:49 2015 +0200

      net/dp8393x: fix hardware reset

      Documentation is not clear of what happens when doing a hardware reset,
      but firmware expect all registers to be zero unless specified otherwise.

      This fixes reboot on MIPS Magnum.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 409b52bfe199d8106dadf7c5ff3d88d2228e89b5
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:48 2015 +0200

      net/dp8393x: correctly reset in_use field

      Don't write more than the field width, which is always 16 bit.
      Fixes network in NetBSD 5.1/arc

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1670735dd7087224cf8fabd37c78fc2aa1f0b22f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:47 2015 +0200

      net/dp8393x: add load/save support

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 89ae0ff9b73ee74c9ba707a09a07ad77b9fdccb4
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:46 2015 +0200

      net/dp8393x: add PROM to store MAC address

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 104655a5c818ea8de1329cef50d1cc8defc524f3
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:45 2015 +0200

      net/dp8393x: QOM'ify

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3df5de64f06f6b288b1cf30ce2bad7878a96454b
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:44 2015 +0200

      net/dp8393x: use dp8393x_ prefix for all functions

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 84689cbb97d2f8c7bb1ebe069f887eaaaddb0902
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:43 2015 +0200

      net/dp8393x: do not use old_mmio accesses

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f2f62c4db244f392381c9061c4185ced98f9be57
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:42 2015 +0200

      net/dp8393x: always calculate proper checksums

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d791d60f1cf944f578aa26ca9f8903ce5dda1c78
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:41 2015 +0200

      dma/rc4030: convert to QOM

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 95c357bc461b00785284403bf56567657d42e915
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:40 2015 +0200

      dma/rc4030: use trace events instead of custom logging

      Remove also unneeded debug logs.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit dc6e3e1e1aef2e6b2ed2ddf80c9559c91f685ecd
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:39 2015 +0200

      dma/rc4030: document register at offset 0x210

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b421f3f52aed306ecc69221a13fac22d03905956
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:38 2015 +0200

      dma/rc4030: do not use old_mmio accesses

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit dd8205130bab277a27889b6d3c0c6c7651585732
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:37 2015 +0200

      dma/rc4030: use AddressSpace and address_space_rw in users

      Now that rc4030 internally uses an AddressSpace for DMA handling, make its root
      memory region public. This is especially usefull for dp8393x netcard, which now
      uses well known QEMU types and methods.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit a3d586f704609a45b6037534cb2f34da5dfd8895
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:36 2015 +0200

      dma/rc4030: create custom DMA address space

      Add a new memory region in system address space where DMA address space
      definition (the 'translation table') belongs, so we can update on the fly
      the DMA address space.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9b1d21c53b73c8f8f79e4aae69c4eb7a5270d6d4
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:35 2015 +0200

      mips jazz: compile only in 64 bit

      Remove now useless device models from other MIPS configurations

      We're now compiling 12 files less than before.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ce9782f40ac16660ea9437bfaa2c9c34d5ed8110
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Jun 4 17:00:31 2015 +0100

      target-mips: add ERETNC instruction and Config5.LLB bit

      ERETNC is identical to ERET except that an ERETNC will not clear the LLbit
      that is set by execution of an LL instruction, and thus when placed between
      an LL and SC sequence, will never cause the SC to fail.

      Presence of ERETNC is denoted by the Config5.LLB.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit adc370a48fd26b92188fa4848dfb088578b1936c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:24 2015 +0100

      target-mips: Misaligned memory accesses for MSA

      MIPS SIMD Architecture vector loads and stores require misalignment support.
      MSA Memory access should work as an atomic operation. Therefore, it has to
      check validity of all addresses for a vector store access if it is spanning
      into two pages.

      Separating helper functions for each data format as format is known in
      translation.
      To use mmu_idx from cpu_mmu_index() instead of calculating it from hflag.
      Removing save_cpu_state() call in translation because it is able to use
      cpu_restore_state() on fault as GETRA() is passed.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      [leon.alrae@imgtec.com: remove unused do_* functions]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3b4afc9e75ab1a95f33e41f462921093f8a109c4
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:23 2015 +0100

      softmmu: Add probe_write()

      Probe for whether the specified guest write access is permitted.
      If it is not permitted then an exception will be taken in the same
      way as if this were a real write access (and we will not return).
      Otherwise the function will return, and there will be a valid
      entry in the TLB for this access.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit be3a8c53b4f18bcc51a462d977cc61a0f46ebb1c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:22 2015 +0100

      target-mips: Misaligned memory accesses for R6

      Release 6 requires misaligned memory access support for all ordinary memory
      access instructions (for example, LW/SW, LWC1/SWC1).
      However misaligned support is not provided for certain special memory accesses
      such as atomics (for example, LL/SC).

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 71c199c81d290b2077ee7cf5400332a342de3a97
  Author: Paul Burton <paul.burton@imgtec.com>
  Date:   Mon May 25 14:21:04 2015 +0100

      mips_malta: provide ememsize env variable to kernels

      Commit 94c2b6aff43c (mips_malta: support up to 2GiB RAM) provided
      support for using over 256MB of RAM with the MIPS Malta board, including
      capping the memsize variable that QEMUs pseudo-bootloader provides to
      the kernel at 256MB in order to match YAMON. It didn't however provide
      the ememsize variable which kernels supporting memory outside of the
      unmapped address spaces (ie. EVA or highmem) may use to determine the
      true size of the RAM present in the system.

      Set ememsize to the size of RAM so that such kernels may use all
      available memory without the user having to manually specifying its size
      & location.

      Signed-off-by: Paul Burton <paul.burton@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 7c979afd11b09a16634699dd6344e3ba10c9677e
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 21 16:06:28 2015 +0100

      target-mips: add Config5.FRE support allowing Status.FR=0 emulation

      This relatively small architectural feature adds the following:

      FIR.FREP: Read-only. If FREP=1, then Config5.FRE and Config5.UFE are
                available.

      Config5.FRE: When enabled all single-precision FP arithmetic instructions,
                   LWC1/LWXC1/MTC1, SWC1/SWXC1/MFC1 cause a Reserved Instructions
                   exception.

      Config5.UFE: Allows user to write/read Config5.FRE using CTC1/CFC1
                   instructions.

      Enable the feature in MIPS64R6-generic CPU.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit eab9944c7801525737626fa45cddaf00932dd2c8
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 21 16:06:27 2015 +0100

      target-mips: move group of functions above gen_load_fpr32()

      Move the "Tests" group of functions so that gen_load_fpr32() and
      gen_store_fpr32() can use generate_exception().

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 5a9259a0b5d6f9424f94539cd9c715b1d166d90c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:21:50 2015 +0100

      spice: ui_info tweaks

      Use the new dpy_ui_info_supported function.
      Clarifies the control flow.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c6e484707f28b3e115e64122a0570f6b3c585489
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 9 21:08:47 2015 +0200

      spice-display: fix segfault in qemu_spice_create_update

      Although it is pretty unusual the stride for the guest image and the
      mirror image maintained by spice-display can be different.  So use
      separate variables for them.

      https://bugzilla.redhat.com/show_bug.cgi?id=1163047

      Cc: qemu-stable@nongnu.org
      Reported-by: perrier vincent <clownix@clownix.net>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0e12e61ff9a3407d123d0dbc4d945aec98d60fdf
  Merge: 3974c9d 62232bf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 18:13:58 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150610-1' into staging

      stdvga: factor out mmio subregion init
      virtio-gpu: add virtio gpu core code, 2d mode

      # gpg: Signature made Wed Jun 10 10:03:11 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150610-1:
        virtio-gpu/2d: add virtio gpu core code
        virtio: update headers, add virtio-gpu (2d)
        stdvga: factor out mmio subregion init
        stdvga: pass VGACommonState instead of PCIVGAState
        stdvga: fix offset in pci_vga_ioport_read

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21549a4642e1f1b438ffc31dd9dc35f134b10e5b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:36 2015 +0800

      vhost-scsi: move qdev properties into vhost-scsi.c

      As only one place in vhost-scsi.c uses DEFINE_VHOST_SCSI_PROPERTIES,
      there is no need to expose it. Inline it into vhost-scsi.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 83a84878da2e00b4d350bd90d6775c1f6320e7b4
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:35 2015 +0800

      virtio-9p-device: move qdev properties into virtio-9p-device.c

      As only one place in virtio-9p-device.c uses
      DEFINE_VIRTIO_9P_PROPERTIES, there is no need to expose it. Inline it
      into virtio-9p-device.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 448777c411b80df0263eb00b9df2f829cdc7cc9b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:34 2015 +0800

      virtio-serial-bus: move qdev properties into virtio-serial-bus.c

      As only one place in virtio-serial-bus.c uses
      DEFINE_VIRTIO_SERIAL_PROPERTIES, there is no need to expose it. Inline
      it into virtio-serial-bus.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fe704809b974d8dd8e020b4d3f48ede338a886fe
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:33 2015 +0800

      virtio-rng: move qdev properties into virtio-rng.c

      As only one place in virtio-rng.c uses DEFINE_VIRTIO_RNG_PROPERTIES,
      there is no need to expose it. Inline it into virtio-rng.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0c63237a90f37fffe8a8016f24f61bb228653e86
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:32 2015 +0800

      virtio-scsi: move qdev properties into virtio-scsi.c

      As only one place in virtio-scsi.c uses DEFINE_VIRTIO_SCSI_PROPERTIES
      and DEFINE_VIRTIO_SCSI_FEATURES, there is no need to expose them. Inline
      them into virtio-scsi.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit db58c063e159f02f0232d1557f0930fd32a6580f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:31 2015 +0800

      virtio-net.h: Remove unsed DEFINE_VIRTIO_NET_PROPERTIES

      Remove unsed DEFINE_VIRTIO_NET_PROPERTIES in virtio-net.h and delete a
      space typo.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 87108bb26ce04637980c0897caeabee8901e72c9
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:30 2015 +0800

      virtio-net: move qdev properties into virtio-net.c

      As only one place in virtio-net.c uses DEFINE_VIRTIO_NET_FEATURES,
      there is no need to expose it. Inline it into virtio-net.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 710e2d90da1a16807f7885d37b203ce739fdc53a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:42 2015 +0200

      virtio-input: emulated devices [pci]

      This patch adds virtio-pci support for the emulated virtio-input
      devices.  Using them is as simple as adding "-device virtio-tablet-pci"
      to your command line.  If you want add multiple devices but don't want
      waste a pci slot for each you can compose a multifunction device this way:

      qemu -device virtio-keyboard-pci,addr=0d.0,multifunction=on \
           -device virtio-tablet-pci,addr=0d.1,multifunction=on

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f958c8aa138718b8126a300d6faece522f7674b8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:41 2015 +0200

      virtio-input: core code & base class [pci]

      This patch adds the virtio-pci support bits for virtio-input-device.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ffaa05037134d48e3ccd7ebbf2d58db26590b96d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:40 2015 +0200

      pci: add PCI_CLASS_INPUT_*

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6ce27a593ab39ac28baebc3045901925046bebd
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:39 2015 +0200

      virtio-pci: fill VirtIOPCIRegions early.

      Initialize the modern bar and the VirtIOPCIRegion fields early, in
      realize.  Also add a size field to VirtIOPCIRegion and variables for
      pci bars to VirtIOPCIProxy.

      This allows virtio-pci subclasses to change things before the
      device_plugged callback applies them.  virtio-vga will use that to
      arrange regions in a way that virtio-vga is compatible to both stdvga
      (in vga mode) and virtio-gpu-pci (in pci mode).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cc52ea90f835aa66d431db712b22f8b15bec2e46
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:38 2015 +0200

      virtio-pci: drop identical virtio_pci_cap

      Now the three struct virtio_pci_caps are identical,
      lets drop two of them ;)

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fc004905c5b4b7568aad50087c156a5f4dfae1a7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:37 2015 +0200

      virtio-pci: move cap type to VirtIOPCIRegion

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 54790d71e4adcfaae95dac3c7019b10721e609de
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:36 2015 +0200

      virtio-pci: move virtio_pci_add_mem_cap call to virtio_pci_modern_region_map

      Also fill offset and length automatically,
      from VirtIOPCIRegion->offset and region size.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a3cc2e81592aba6d818005c078b94b16ba47a02c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:35 2015 +0200

      virtio-pci: add virtio_pci_modern_region_map()

      Add function to map modern virtio regions.
      Add offset to VirtIOPCIRegion.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1141ce2190c85daacfa9b874476651ed0f7dc6df
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:34 2015 +0200

      virtio-pci: add virtio_pci_modern_regions_init()

      Add init function for the modern pci regions,
      move over the init code.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 588255ad5021f06789f438f7b045015c54e30841
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:33 2015 +0200

      virtio-pci: add struct VirtIOPCIRegion for virtio-1 regions

      For now just place the MemoryRegion there,
      following patches will add more.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 40de55affda76392627e68d3b1ba5a6a11c492bc
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:32 2015 +0200

      virtio-balloon: switch to virtio_add_feature

      This was missed during the conversion of feature bit manipulation.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit fbdc6892dd8a842a3d86b8315ff56399e0387b74
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:31 2015 +0200

      virtio_balloon: header update

      add modern header

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 975acc0ae6d60260859884a9235ae3c62e2969a2
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 12:34:30 2015 +0200

      virtio-pci: correctly set host notifiers for modern bar

      Currently, during host notifier set. We only add eventfd for legacy
      bar, this is not correct since:

      - Non-transitional device does not have legacy bar, so qemu will crash
        since proxy->bar was not initialized.
      - Modern device uses modern bar and notify cap to notify the device,
        we should add eventfd for proxy->notify.

      So this patch fixes the above two issues by adding eventfd based on
      whether legacy or modern device were supported.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4e93a68eb369b2f7adbef7a4f6afd7a30a0ed927
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:29 2015 +0200

      virtio-pci: make modern bar 64bit + prefetchable

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 23c5e3977502a1b57fa2d8cf8cf4b5c9e45f0d1f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:28 2015 +0200

      virtio-pci: change & document virtio pci bar layout.

      This patch adds variables for the pci bars (to get rid of the magic
      numbers in the code) and moves the modern virtio bar to region 4 so
      regions 2+3 are kept free.  virtio-vga wants use them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8aca0d75869f8ad0aa0032c50d8c85dcad65302f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:27 2015 +0200

      virtio-pci: make QEMU_VIRTIO_PCI_QUEUE_MEM_MULT smaller

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit e266d421490e0ae83044bbebb209b2d3650c0ba6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:26 2015 +0200

      virtio-pci: add flags to enable/disable legacy/modern

      Add VIRTIO_PCI_FLAG_DISABLE_LEGACY and VIRTIO_PCI_FLAG_DISABLE_MODERN
      for VirtIOPCIProxy->flags.  Also add properties for them.  They can be
      used to disable modern (virtio 1.0) or legacy (virtio 0.9) modes.

      By default only legacy is advertized, modern will be turned on by
      default once all remaining spec compilance issues are addressed.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 54c720d49d3f9741b52ac95c65a5cc990254a5d8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:25 2015 +0200

      virtio-pci: switch to modern accessors for 1.0

      virtio 1.0 config space is in LE format for all
      devices, use modern wrappers when accessed through
      the 1.0 BAR.

      Reported-by: Rusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit adfb743c90c7aa5e92907ce875e4f35747ee1963
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:24 2015 +0200

      virtio: add modern config accessors

      virtio 1.0 defines config space as LE,
      as opposed to pre-1.0 which was native endian.

      Add API for transports to execute word/dword accesses in
      little endian format - will be useful for mmio
      and pci (byte access is also wrapped, for completeness).

      For simplicity, we still keep config in host native
      endian format, byteswap to LE on guest access.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8f059081d93f1802480059d1d49fe5c1d32f60c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:23 2015 +0200

      virtio: generation counter support

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit dfb8e184db758bff275f94f7aa634300886cfe21
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:22 2015 +0200

      virtio-pci: initial virtio 1.0 support

      This is somewhat functional.  With this, and linux driver from my tree,
      I was able to use virtio net as virtio 1.0 device for light browsing.

      At the moment, dataplane and vhost code is
      still missing.

      Based on Cornelia's virtio 1.0 patchset:
          Date: Thu, 11 Dec 2014 14:25:02 +0100
          From: Cornelia Huck <cornelia.huck@de.ibm.com>
          To: virtualization@lists.linux-foundation.org, qemu-devel@nongnu.org
          Cc: rusty@rustcorp.com.au, thuth@linux.vnet.ibm.com, mst@redhat.com,
          Cornelia Huck <cornelia.huck@de.ibm.com>
          Subject: [PATCH RFC v6 00/20] qemu: towards virtio-1 host support
          Message-Id: <1418304322-7546-1-git-send-email-cornelia.huck@de.ibm.com>

      which is itself still missing some core bits.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit c17bef33601737e24a3d53259ddb6db28ac4d6d2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:21 2015 +0200

      linux-headers: add virtio_pci

      Easier than duplicating code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9a2ba82302bea7faf3b9579f9168b89c73ae34ad
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:20 2015 +0200

      vhost: 64 bit features

      Make sure that all vhost interfaces use 64 bit features, as the virtio
      core does, and make sure to use ULL everywhere possible to be on the
      safe side.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b1506132001eee6b11cf23b5968cd66ec141a9ed
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:19 2015 +0200

      vhost_net: add version_1 feature

      Add VERSION_1 to list of features that we should
      test at the backend.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit df91055db5c9cee93d70ca8c08d72119a240b987
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:18 2015 +0200

      virtio-net: enable virtio 1.0

      virtio-net (non-vhost) now should have everything in place to support
      virtio 1.0: let's enable the feature bit for it.

      Note that VIRTIO_F_VERSION_1 is technically a transport feature; once
      every device is ready for virtio 1.0, we can move setting this
      feature bit out of the individual devices.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit bb9d17f831fa8e70494eab8421d83a542e3d8508
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:17 2015 +0200

      virtio-net: support longer header

      virtio-1 devices always use num_buffers in the header, even if
      mergeable rx buffers have not been negotiated.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6a3cddb22d3f0f729e267d45f350ae31bdebbcf
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:16 2015 +0200

      virtio-net: no writeable mac for virtio-1

      Devices operating as virtio 1.0 may not allow writes to the mac
      address in config space.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0b352fd680e1ca7827ddea47b5e9b603320913b6
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:15 2015 +0200

      virtio: allow to fail setting status

      virtio-1 allow setting of the FEATURES_OK status bit to fail if
      the negotiated feature bits are inconsistent: let's fail
      virtio_set_status() in that case and update virtio-ccw to post an
      error to the guest.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6c0196d702e8482a17638ee79f45ce27cdd1ef5d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:14 2015 +0200

      virtio: disallow late feature changes for virtio-1

      For virtio-1 devices, the driver must not attempt to set feature bits
      after it set FEATURES_OK in the device status. Simply reject it in
      that case.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit f5a5628cf0b65b223fa0c9031714578dfac4cf04
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:13 2015 +0200

      dataplane: allow virtio-1 devices

      Handle endianness conversion for virtio-1 virtqueues correctly.

      Note that dataplane now needs to be built per-target.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit ab223c9518e8c7eb542ef3133de1a34475b69790
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:12 2015 +0200

      virtio: allow virtio-1 queue layout

      For virtio-1 devices, we allow a more complex queue layout that doesn't
      require descriptor table and rings on a physically-contigous memory area:
      add virtio_queue_set_rings() to allow transports to set this up.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3c185597c86b8cd0a07c46e7a5bd5aac28bb7200
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:11 2015 +0200

      virtio: endianness checks for virtio 1.0 devices

      Add code that checks for the VERSION_1 feature bit in order to make
      decisions about the device's endianness. This allows us to support
      transitional devices.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3974c9d8ccfccbd81edc9df271fcae7082f3921d
  Merge: eed8a8f 5efed5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 16:52:34 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-fw_cfg-20150610-1' into staging

      fw_cfg: drop write support, qemu cmdline support, bugfixes.
      bios-tables-test: fix smbios test.

      # gpg: Signature made Wed Jun 10 07:29:53 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-fw_cfg-20150610-1:
        bios-tables-test: handle false-positive smbios signature matches
        fw_cfg: insert fw_cfg file blobs via qemu cmdline
        fw_cfg: prohibit insertion of duplicate fw_cfg file names
        fw_cfg: prevent selector key conflict
        fw_cfg: remove support for guest-side data writes
        fw_cfg: fix FW_CFG_BOOT_DEVICE update on ppc and sparc
        fw_cfg: add fw_cfg_modify_i16 (update) method
        QemuOpts: increase number of vm_config_groups

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit eed8a8f572e659c85f8711d79c20da95021e06e2
  Merge: e015fe0 7a8d15d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 15:46:39 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150609.0' into staging

      Initial VFIO platform device support, v2 (Eric Auger, et al.)

      # gpg: Signature made Tue Jun  9 15:25:40 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150609.0:
        hw/vfio/platform: calxeda xgmac device
        hw/vfio/platform: add irq assignment
        hw/vfio/platform: vfio-platform skeleton

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e015fe008a3a8901913248cdb50c62dba795c588
  Merge: b041114 9f7c594
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 15:10:14 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/CVE-2015-3209-pcnet-tx-buffer-fix-pull-request' into staging

      # gpg: Signature made Wed Jun 10 15:04:11 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/CVE-2015-3209-pcnet-tx-buffer-fix-pull-request:
        pcnet: force the buffer access to be in bounds during tx

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f7c594c006289ad41169b854d70f5da6e400a2a
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Sun May 24 10:53:44 2015 +0200

      pcnet: force the buffer access to be in bounds during tx

      4096 is the maximum length per TMD and it is also currently the size of
      the relay buffer pcnet driver uses for sending the packet data to QEMU
      for further processing. With packet spanning multiple TMDs it can
      happen that the overall packet size will be bigger than sizeof(buffer),
      which results in memory corruption.

      Fix this by only allowing to queue maximum sizeof(buffer) bytes.

      This is CVE-2015-3209.

      [Fixed 3-space indentation to QEMU's 4-space coding standard.
      --Stefan]

      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Reported-by: Matt Tait <matttait@google.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 24bfa207efb9b9d591552eefc1f414ff33ef0eac
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 23:05:58 2015 -0400

      vhost: put log correctly in vhost_dev_start()

      We allocate an dummy log even if the size is zero. So we should put it
      unconditionally too.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 62232bf48456bda4058ceae05851bc58c1032338
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:12:28 2014 +0200

      virtio-gpu/2d: add virtio gpu core code

      This patch adds the core code for virtio gpu emulation,
      covering 2d support.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 53476e07d299b7fc33fa480db6bd9a6b1e2e8a97
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri May 22 15:37:33 2015 +0200

      virtio: update headers, add virtio-gpu (2d)

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 220869e12d96bfb0b44d8e47394587c30e9a093f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:50:46 2015 +0200

      stdvga: factor out mmio subregion init

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf45ec6a52af77ec2cdfe229b6f496a29b8f7886
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:09:49 2015 +0200

      stdvga: pass VGACommonState instead of PCIVGAState

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 24cdff7c8278849747035f9554f8c538beabf949
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:03:54 2015 +0200

      stdvga: fix offset in pci_vga_ioport_read

      Simliar to pci_vga_ioport_write.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5efed5a172881f601ac3c57c22ec5c5721f895be
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon May 18 08:47:24 2015 -0400

      bios-tables-test: handle false-positive smbios signature matches

      It has been reported that sometimes the .rodata section of SeaBIOS,
      containing the constant string against which the SMBIOS signature
      ends up being compared, also falls within the guest f-segment. In
      that case, the test obviously fails, unless we continue searching
      for the *real* SMBIOS entry point.

      Rather than stopping at the first match for the SMBIOS signature
      ("_SM_") in the f-segment (0xF0000-0xFFFFF), continue scanning
      until either a valid entry point table is found, or the f-segment
      has been exhausted.

      Reported-by: Bruce Rogers <brogers@suse.com>
      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Tested-by: Bruce Rogers <brogers@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 81b2b81062612ebeac4cd5333a3b15c7d79a5a3d
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:53 2015 -0400

      fw_cfg: insert fw_cfg file blobs via qemu cmdline

      Allow user supplied files to be inserted into the fw_cfg
      device before starting the guest. Since fw_cfg_add_file()
      already disallows duplicate fw_cfg file names, qemu will
      exit with an error message if the user supplies multiple
      blobs with the same fw_cfg file name, or if a blob name
      collides with a fw_cfg name programmatically added from
      within the QEMU source code. A warning message will be
      printed if the fw_cfg item name does not begin with the
      prefix "opt/", which is recommended for external, user
      provided blobs.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0eb973f91521c6bcb6399d25327711d083f6eb10
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:52 2015 -0400

      fw_cfg: prohibit insertion of duplicate fw_cfg file names

      Exit with an error (instead of simply logging a trace event)
      whenever the same fw_cfg file name is added multiple times via
      one of the fw_cfg_add_file[_callback]() host-side API calls.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0f9b214139d11ef058fa0f1c11c89e94fa6ef95d
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:51 2015 -0400

      fw_cfg: prevent selector key conflict

      Enforce a single assignment of data for each distinct selector key.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 023e3148567ac898c7258138f8e86c3c2bb40d07
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:50 2015 -0400

      fw_cfg: remove support for guest-side data writes

      From this point forward, any guest-side writes to the fw_cfg
      data register will be treated as no-ops. This patch also removes
      the unused host-side API function fw_cfg_add_callback(), which
      allowed the registration of a callback to be executed each time
      the guest completed a full overwrite of a given fw_cfg data item.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 48779e501810c5046ff8af7b9cf9c99bec2928a1
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon Jun 8 14:10:45 2015 -0400

      fw_cfg: fix FW_CFG_BOOT_DEVICE update on ppc and sparc

      On ppc, sparc, and sparc64, the value of the FW_CFG_BOOT_DEVICE 16bit
      fw_cfg entry is repeatedly modified from a series of callbacks, which
      currently results in the previous value's dynamically allocated memory
      being leaked.

      This patch switches updating to the new fw_cfg_modify_i16() call, which
      does not cause memory leaks.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1edd34b638f73d39a175fbc4f9ad5c97800d7470
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon Jun 8 14:10:44 2015 -0400

      fw_cfg: add fw_cfg_modify_i16 (update) method

      Allow the ability to modify the value of an existing 16-bit integer
      fw_cfg item.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1ceaefbd0d09642fcff05c6b8da49ad8fbc050cb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri May 29 14:37:54 2015 +0200

      QemuOpts: increase number of vm_config_groups

      Adding the fw_cfg cmd line support patch by
      Gabriel L. Somlo hits the limit.

      Fix this by making the array larger.

      Cc: Gabriel L. Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b0411142f482df92717f8b4a3b746081a62b724f
  Merge: 44ee94e 36e60ef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 15:29:34 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150609' into staging

      Collected TCG patches

      # gpg: Signature made Tue Jun  9 15:06:18 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150609:
        tcg/optimize: rename tcg_constant_folding
        tcg/optimize: fold constant test in tcg_opt_gen_mov
        tcg/optimize: fold temp copies test in tcg_opt_gen_mov
        tcg/optimize: remove opc argument from tcg_opt_gen_mov
        tcg/optimize: remove opc argument from tcg_opt_gen_movi
        tcg: fix dead computation for repeated input arguments
        tcg: fix register allocation with two aliased dead inputs
        tcg: Handle MO_AMASK in tcg_dump_ops
        tcg: Mask TCGMemOp appropriately for indexing

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7a8d15d7702444be715b6ae32574659483c0c158
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 9 09:00:07 2015 +0100

      hw/vfio/platform: calxeda xgmac device

      The platform device class has become abstract. This patch introduces
      a calxeda xgmac device that derives from it.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 36e60ef6ac5d8a262d0fbeedfdb2b588514cb1ea
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:27 2015 +0200

      tcg/optimize: rename tcg_constant_folding

      The tcg_constant_folding folding ends up doing all the optimizations
      (which is a good thing to avoid looping on all ops multiple time), so
      make it clear and just rename it tcg_optimize.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-6-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 97a79eb70dd35a24fda87d86196afba5e6f21c5d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jun 5 11:19:18 2015 +0200

      tcg/optimize: fold constant test in tcg_opt_gen_mov

      Most of the calls to tcg_opt_gen_mov are preceeded by a test to check if
      the source temp is a constant. Fold that into the tcg_opt_gen_mov
      function.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433495958-9508-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 5365718a9afeeabde3784d82a542f8ad909b18cf
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:25 2015 +0200

      tcg/optimize: fold temp copies test in tcg_opt_gen_mov

      Each call to tcg_opt_gen_mov is preceeded by a test to check if the
      source and destination temps are copies. Fold that into the
      tcg_opt_gen_mov function.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-4-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8d6a91602ea824ef4435ea38fd475387eecc098c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:24 2015 +0200

      tcg/optimize: remove opc argument from tcg_opt_gen_mov

      We can get the opcode using the TCGOp pointer. It needs to be
      dereferenced, but it's anyway done a few lines below to write
      the new value.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ebd27391b00cdafc81e0541a940686137b3b48df
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:23 2015 +0200

      tcg/optimize: remove opc argument from tcg_opt_gen_movi

      We can get the opcode using the TCGOp pointer. It needs to be
      dereferenced, but it's anyway done a few lines below to write
      the new value.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c19f47bf5e8fe3dbd10206a52d0e6e348f803933
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:47:08 2015 +0200

      tcg: fix dead computation for repeated input arguments

      When the same temp is used twice or more as an input argument to a TCG
      instruction, the dead computation code doesn't recognize the second use
      as a dead temp. This is because the temp is marked as live in the same
      loop where dead inputs are checked.

      The fix is to split the loop in two parts. This avoid emitting a move
      and using a register for the movcond instruction when used as "move if
      true" on x86-64. This might bring more improvements on RISC TCG targets
      which don't have outputs aliased to inputs.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447228-29425-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7e1df267a7e8b39fc0cf1d84d2afc2e88ccbfeac
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:47:07 2015 +0200

      tcg: fix register allocation with two aliased dead inputs

      For TCG ops with two outputs registers (add2, sub2, div2, div2u), when
      the same input temp is used for the two inputs aliased to the two
      outputs, and when these inputs are both dead, the register allocation
      code wrongly assigned the same register to the same output.

      This happens for example with sub2 t1, t2, t3, t3, t4, t5, when t3 is
      not used anymore after the TCG op.  In that case the same register is
      used for t1, t2 and t3.

      The fix is to look for already allocated aliased input when allocating
      a dead aliased input and check that the register is not already
      used.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447228-29425-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 59c4b7e8dfab0cdc41434fedbf2686222f541e57
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jun 1 14:38:56 2015 -0700

      tcg: Handle MO_AMASK in tcg_dump_ops

      Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Tested-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 2b7ec66f025263a5331f37d5ad78a625496fd7bd
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri May 29 09:16:51 2015 -0700

      tcg: Mask TCGMemOp appropriately for indexing

      The addition of MO_AMASK means that places that used inverted masks
      need to be changed to use positive masks, and places that failed to
      mask the intended bits need updating.

      Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Tested-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 44ee94e4862603c2b1b21718effc5f17b39f43bc
  Merge: b781a60 6028ef0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 11:07:41 2015 +0100

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150609' into staging

      s390x/virtio-ccw: migration and virtio for 2.4

      1. Migration fixups
      2. virtio 9pfs

      # gpg: Signature made Tue Jun  9 09:00:05 2015 BST using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150609:
        s390x/migration: add comment about floating point migration
        s390x/kvm: always ignore empty vcpu interrupt state
        virtio-ccw/migration: Migrate config vector for virtio devices
        virtio-ccw: add support for 9pfs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b781a60b1054e06de6733b75dd1489afff9c3276
  Merge: ee09f84 8190483
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 10:05:29 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-06-09' into staging

      Error reporting patches

      # gpg: Signature made Tue Jun  9 06:42:15 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-06-09:
        vhost-user: Improve -netdev/netdev_add/-net/... error reporting
        QemuOpts: Convert qemu_opt_foreach() to Error
        QemuOpts: Drop qemu_opt_foreach() parameter abort_on_failure
        blkdebug: Simplify passing of Error through qemu_opts_foreach()
        QemuOpts: Convert qemu_opts_foreach() to Error
        QemuOpts: Drop qemu_opts_foreach() parameter abort_on_failure
        vl: Fail right after first bad -object
        vl: Print -device help at most once
        vl: Report failure to sandbox at most once

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08d49df0dbaacc220a099dbfb644e1dc0eda57be
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 11:12:15 2015 +0200

      sdl2: fix crash in handle_windowevent() when restoring the screen size

      The Ctrl-Alt-u keyboard shortcut restores the screen to its original
      size. In the SDL2 UI this is done by destroying the window and
      creating a new one. The old window emits SDL_WINDOWEVENT_HIDDEN when
      it's destroyed, but trying to call SDL_GetWindowFromID() from that
      event's window ID returns a null pointer. handle_windowevent() assumes
      that the pointer is never null so it results in a crash.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6028ef075791913228c36f10cb270f1f52e9f076
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Jun 8 12:21:24 2015 +0200

      s390x/migration: add comment about floating point migration

      commit 46c804def4bd ("s390x: move fpu regs into a subsection
      of the vmstate") moved the fprs into a subsection and bumped
      the version number. This will allow to not transfer fprs in
      the future if necessary. Add a comment to mark the return true
      as intentional.

      CC: Juan Quintela <quintela@redhat.com>
      CC: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1433758884-2997-1-git-send-email-borntraeger@de.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>

  commit 8190483196148f765c65785876f7b893d64b6cdd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 14:17:16 2015 +0100

      vhost-user: Improve -netdev/netdev_add/-net/... error reporting

      When -netdev vhost-user fails, it first reports a specific error, then
      one or more generic ones, like this:

          $ qemu-system-x86_64 -netdev vhost-user,id=foo,chardev=xxx
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: chardev "xxx" not found
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: No suitable chardev found
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: Device 'vhost-user' could not be initialized

      With the command line, the messages go to stderr.  In HMP, they go to
      the monitor.  In QMP, the last one becomes the error reply, and the
      others go to stderr.

      Convert net_init_vhost_user() and its helpers to Error.  This
      suppresses the unwanted unspecific error messages, and makes the
      specific error the QMP error reply.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 71df1d833776647fc12f5bbcd6d6fe4c5e931094
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 08:40:25 2015 +0100

      QemuOpts: Convert qemu_opt_foreach() to Error

      Retain the function value for now, to permit selective conversion of
      its callers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1640b200d53e3d981f12a192fe84b7bb7958c065
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 07:45:10 2015 +0100

      QemuOpts: Drop qemu_opt_foreach() parameter abort_on_failure

      When the argument is non-zero, qemu_opt_foreach() stops on callback
      returning non-zero, and returns that value.

      When the argument is zero, it doesn't stop, and returns the callback's
      value from the last iteration.

      The two callers that pass zero could just as well pass one:

      * qemu_spice_init()'s callback add_channel() either returns zero or
        exit()s.

      * config_write_opts()'s callback config_write_opt() always returns
        zero.

      Drop the parameter, and always stop.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8809cfc38e4e93884d664bb00108fc71b423f589
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:38:42 2015 +0100

      blkdebug: Simplify passing of Error through qemu_opts_foreach()

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit 28d0de7a4fb721b06de72970bd163f5183c2188b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:35:14 2015 +0100

      QemuOpts: Convert qemu_opts_foreach() to Error

      Retain the function value for now, to permit selective conversion of
      its callers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit a4c7367f7dd9348f94dc4298571ed515b8160a27
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 11:07:24 2015 +0100

      QemuOpts: Drop qemu_opts_foreach() parameter abort_on_failure

      When the argument is non-zero, qemu_opts_foreach() stops on callback
      returning non-zero, and returns that value.

      When the argument is zero, it doesn't stop, and returns the bit-wise
      inclusive or of all the return values.  Funky :)

      The callers that pass zero could just as well pass one, because their
      callbacks can't return anything but zero:

      * qemu_add_globals()'s callback qdev_add_one_global()

      * qemu_config_write()'s callback config_write_opts()

      * main()'s callbacks default_driver_check(), drive_enable_snapshot(),
        vnc_init_func()

      Drop the parameter, and always stop.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit 8122928a52248e28513c79d9b9929c6d20c866ea
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:08:36 2015 +0100

      vl: Fail right after first bad -object

      Failure to create an object with -object is a fatal error.  However,
      we delay the actual exit until all -object are processed.  On the one
      hand, this permits detection of genuine additional errors.  On the
      other hand, it can muddy the waters with uninteresting additional
      errors, e.g. when a later -object tries to reference a prior one that
      failed.

      We generally stop right on the first bad option, so do that for
      -object as well.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8416abb3b0f42132fc6346c439ec543635075135
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:02:03 2015 +0100

      vl: Print -device help at most once

      We print it once for each -device help.  Not helpful.  Stop after the
      first one.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 092b21aa7edf7962248e731cddaf5350d268e333
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 12:59:43 2015 +0100

      vl: Report failure to sandbox at most once

      It's reported once per -sandbox on.  Stop on the first failure, like
      we do for other options.

      Not fixed: "-sandbox on -sandbox off" should leave the sandbox off.
      It doesn't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 38559979bf0095a586f61bc9e028df36673f21a1
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 8 09:25:26 2015 -0600

      hw/vfio/platform: add irq assignment

      This patch adds the code requested to assign interrupts to
      a guest. The interrupts are mediated through user handled
      eventfds only.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 0ea2730bef0b764ce87f5d6859f9b1eac6069250
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 8 09:25:25 2015 -0600

      hw/vfio/platform: vfio-platform skeleton

      Minimal VFIO platform implementation supporting register space
      user mapping but not IRQ assignment.

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ee09f84e6bf5383a23c9624115c26b72aa1e076c
  Merge: 2e29dd7 24a3142
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 8 15:57:41 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * KVM error improvement from Laurent
      * CONFIG_PARALLEL fix from Mirek
      * Atomic/optimized dirty bitmap access from myself and Stefan
      * BUILD_DIR convenience/bugfix from Peter C
      * Memory leak fix from Shannon
      * SMM improvements (though still TCG only) from myself and Gerd, acked by mst

      # gpg: Signature made Fri Jun  5 18:45:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (62 commits)
        update Linux headers from kvm/next
        atomics: add explicit compiler fence in __atomic memory barriers
        ich9: implement SMI_LOCK
        q35: implement TSEG
        q35: add test for SMRAM.D_LCK
        q35: implement SMRAM.D_LCK
        q35: add config space wmask for SMRAM and ESMRAMC
        q35: fix ESMRAMC default
        q35: implement high SMRAM
        hw/i386: remove smram_update
        target-i386: use memory API to implement SMRAM
        hw/i386: add a separate region that tracks the SMRAME bit
        target-i386: create a separate AddressSpace for each CPU
        vl: run "late" notifiers immediately
        qom: add object_property_add_const_link
        vl: allow full-blown QemuOpts syntax for -global
        pflash_cfi01: add secure property
        pflash_cfi01: change to new-style MMIO accessors
        pflash_cfi01: change big-endian property to BIT type
        target-i386: wake up processors that receive an SMI
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e29dd7c44db30e3d3c108ab2a622cbdac6d16f0
  Merge: 0daba1f 0ba9888
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 8 14:07:32 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Jun  5 20:59:07 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        macio: remove remainder_len DBDMA_io property
        macio: update comment/constants to reflect the new code
        macio: switch pmac_dma_write() over to new offset/len implementation
        macio: switch pmac_dma_read() over to new offset/len implementation
        fdc-test: Test state for existing cases more thoroughly
        fdc: Fix MSR.RQM flag
        fdc: Disentangle phases in fdctrl_read_data()
        fdc: Code cleanup in fdctrl_write_data()
        fdc: Use phase in fdctrl_write_data()
        fdc: Introduce fdctrl->phase
        fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()
        fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0daba1f037ab85be7a9ff7ee37ba6b644c5e7977
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Jun 5 11:05:03 2015 +0200

      machine: Drop use of DEFAULT_RAM_SIZE in help text

      As of commit 076b35b5a (machine: add default_ram_size to machine
      class) we no longer have a global default ram size, but instead
      machine specific defaults.  When invoking qemu --help we don't know
      which machine you selected, so we can't tell the user the default RAM
      size in the help text anymore now.

      Thus I don't see an easy way to expose the default ram size to the
      user in the help text.  The easiest option IMHO is to just drop this
      piece of information.

      Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Acked-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Acked-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Message-id: 1433495103-62084-1-git-send-email-agraf@suse.de
      [PMM: rewrapped long commit message lines]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 779cec4d20907cbccb26fbf5f5c19c6cdee33eff
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 8 10:44:30 2015 +0200

      monitor: Fix QMP ABI breakage around "id"

      Commit 65207c5 accidentally dropped a line of code we need along with
      a comment that became wrong then.  This made QMP reject "id":

          {"execute": "system_reset", "id": "1"}
          {"error": {"class": "GenericError", "desc": "QMP input object member 'id' is unexpected"}}

      Put the lost line right back, so QMP again accepts and returns "id",
      as promised by the ABI:

          {"execute": "system_reset", "id": "1"}
          {"return": {}, "id": "1"}

      Reported-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Tested-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Tested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1433753070-12632-2-git-send-email-armbru@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 24a314269281a175b5540b3b6a8981ed2e8220e1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 4 16:38:29 2015 +0200

      update Linux headers from kvm/next

      This is kvm.git commit 05ff30bb56c6b3d3000519d6e02ed35678ddae3b.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3bbf572345c65813f86a8fc434ea1b23beb08e16
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 3 14:21:20 2015 +0200

      atomics: add explicit compiler fence in __atomic memory barriers

      __atomic_thread_fence does not include a compiler barrier; in the
      C++11 memory model, fences take effect in combination with other
      atomic operations.  GCC implements this by making __atomic_load and
      __atomic_store access memory as if the pointer was volatile, and
      leaves no trace whatsoever of acquire and release fences in the
      compiler's intermediate representation.

      In QEMU, we want memory barriers to act on all memory, but at the same
      time we would like to use __atomic_thread_fence for portability reasons.
      Add compiler barriers manually around the __atomic_thread_fence.

      Message-Id: <1433334080-14912-1-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 11e66a15a084cb0820dba13f4ea3b15b0512fd39
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed May 6 10:58:30 2015 +0200

      ich9: implement SMI_LOCK

      Add write mask for the smi enable register, so we can disable write
      access to certain bits.  Open all bits on reset.  Disable write access
      to GBL_SMI_EN when SMI_LOCK (in ich9 lpc pci config space) is set.
      Write access to SMI_LOCK itself is disabled too.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bafc90bdc594a4d04db846bd8712bdcec59678a8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Apr 20 10:55:09 2015 +0200

      q35: implement TSEG

      TSEG provides larger amounts of SMRAM than the 128 KB available with
      legacy SMRAM and high SMRAM.

      Route access to tseg into nowhere when enabled, for both cpus and
      busmaster dma, and add tseg window to smram region, so cpus can access
      it in smm mode.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66e2ec2417e72edea1df5fb340b210100b0571b7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 15:11:36 2015 +0200

      q35: add test for SMRAM.D_LCK

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      [Fix compilation of the newly introduced test. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 68c77acfb18d28933f17b1c2a842bd936ce7223b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 14:03:22 2015 +0200

      q35: implement SMRAM.D_LCK

      Once the SMRAM.D_LCK bit has been set by the guest several bits in SMRAM
      and ESMRAMC become readonly until the next machine reset.  Implement
      this by updating the wmask accordingly when the guest sets the lock bit.
      As the lock it itself is locked down too we don't need to worry about
      the guest clearing the lock bit.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b66a67d7519cb7f980885af5391b1103c42e9b6d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 15 16:48:12 2015 +0200

      q35: add config space wmask for SMRAM and ESMRAMC

      Not all bits in SMRAM and ESMRAMC can be changed by the guest.
      Add wmask defines accordingly and set them in mch_reset().

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7744752402d11cebe4c1d4079dcd40d3145eb37b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 15 16:43:24 2015 +0200

      q35: fix ESMRAMC default

      The cache bits in ESMRAMC are hardcoded to 1 (=disabled) according to
      the q35 mch specs.  Add and use a define with this default.

      While being at it also update the SMRAM default to use the name (no code
      change, just makes things a bit more readable).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 64130fa4a1514ae7a580b8d46290a11784770600
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 17:13:01 2015 +0200

      q35: implement high SMRAM

      When H_SMRAME is 1, low memory at 0xa0000 is left alone by
      SMM, and instead the chipset maps the 0xa0000-0xbffff window at
      0xfeda0000-0xfedbffff.  This affects both the "non-SMM" view controlled
      by D_OPEN and the SMM view controlled by G_SMRAME, so add two new
      MemoryRegions and toggle the enabled/disabled state of all four
      in mch_update_smram.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3de70c0899db2712a5ae321093aa6173d6f76706
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:14:28 2015 +0200

      hw/i386: remove smram_update

      It's easier to inline it now that most of its work is done by the CPU
      (rather than the chipset) through /machine/smram and the memory API.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f809c605122df291bbb9004dc487bde0969134b5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:12:25 2015 +0200

      target-i386: use memory API to implement SMRAM

      Remove cpu_smm_register and cpu_smm_update.  Instead, each CPU
      address space gets an extra region which is an alias of
      /machine/smram.  This extra region is enabled or disabled
      as the CPU enters/exits SMM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fe6567d5fddfb7501a352c5e080a9eecf7b89177
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:10:22 2015 +0200

      hw/i386: add a separate region that tracks the SMRAME bit

      This region is exported at /machine/smram.  It is "empty" if
      SMRAME=0 and points to SMRAM if SMRAME=1.  The CPU will
      enable/disable it as it enters or exits SMRAM.

      While touching nearby code, the existing memory region setup was
      slightly inconsistent.  The smram_region is *disabled* in order to open
      SMRAM (because the smram_region shows the low VRAM instead of the RAM
      at 0xa0000).  Because SMRAM is closed at startup, the smram_region must
      be enabled when creating the i440fx or q35 devices.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2001d0cd6d55e5efa9956fa8ff8b89034d6a4329
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:11:09 2015 +0200

      target-i386: create a separate AddressSpace for each CPU

      Different CPUs can be in SMM or not at the same time, thus they
      will see different things where the chipset places SMRAM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 71cdd1cb914e24000273bbbfa5fb226cdb8ea265
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:01:06 2015 +0200

      vl: run "late" notifiers immediately

      If a machine_init_done notifier is added late, as part of a hot-plugged
      device, run it immediately.
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb9e7e334b54350e8e3b62bd7892b78f63a9d848
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 18:29:00 2015 +0200

      qom: add object_property_add_const_link

      Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3751d7c43f795b45ffdb9429cfb09c6beea55c68
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 9 14:16:19 2015 +0200

      vl: allow full-blown QemuOpts syntax for -global

      -global does not work for drivers that have a dot in their name, such as
      cfi.pflash01.  This is just a parsing limitation, because such globals
      can be declared easily inside a -readconfig file.

      To allow this usage, support the full QemuOpts key/value syntax for -global
      too, for example "-global driver=cfi.pflash01,property=secure,value=on".
      The two formats do not conflict, because the key/value syntax does not have
      a period before the first equal sign.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f71e42a5c98722d6faa5be84a34fbad90d27dc04
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:09:43 2015 +0200

      pflash_cfi01: add secure property

      When this property is set, MMIO accesses are only allowed with the
      MEMTXATTRS_SECURE attribute.  This is used for secure access to UEFI
      variables stored in flash.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5aa113f0a2c245b0a77865e1dd2445bdd24c3ef8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:00:53 2015 +0200

      pflash_cfi01: change to new-style MMIO accessors

      This is a required step to implement read_with_attrs and write_with_attrs.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e98094221ec336fcfd0c72c66f280f1cabb16c72
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:53:29 2015 +0200

      pflash_cfi01: change big-endian property to BIT type

      Make this consistent with the secure property, added in the next patch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a9bad65d2c1f61af74ce2ff43238d4b20bf81c3a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 19 13:46:47 2015 +0200

      target-i386: wake up processors that receive an SMI

      An SMI should definitely wake up a processor in halted state!
      This lets OVMF boot with SMM on multiprocessor systems, although
      it halts very soon after that with a "CpuIndex != BspIndex"
      assertion failure.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4854f1384176d897747de236f426d020668fa3c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 30 12:02:46 2015 +0200

      target-i386: set G=1 in SMM big real mode selectors

      Because the limit field's bits 31:20 is 1, G should be 1.
      VMX actually enforces this, let's do it for completeness
      in QEMU as well.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9982f74bad70479939491b69522da047a3be5a0d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 11:40:41 2015 +0200

      target-i386: mask NMIs on entry to SMM

      QEMU is not blocking NMIs on entry to SMM.  Implementing this has to
      cover a few corner cases, because:

      - NMIs can then be enabled by an IRET instruction and there
      is no mechanism to _set_ the "NMIs masked" flag on exit from SMM:
      "A special case can occur if an SMI handler nests inside an NMI handler
      and then another NMI occurs. [...] When the processor enters SMM while
      executing an NMI handler, the processor saves the SMRAM state save map
      but does not save the attribute to keep NMI interrupts disabled.

      - However, there is some hidden state, because "If NMIs were blocked
      before the SMI occurred [and no IRET is executed while in SMM], they
      are blocked after execution of RSM."  This is represented by the new
      HF2_SMM_INSIDE_NMI_MASK bit.  If it is zero, NMIs are _unblocked_
      on exit from RSM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3f7d84648607cc0fcb3812bb4b88978e2a7aa24f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:45:53 2015 +0200

      target-i386: Use correct memory attributes for ioport accesses

      In order to do this, stop using the cpu_in*/out* helpers, and instead
      access address_space_io directly.

      cpu_in* and cpu_out* remain for usage in the monitor, in qtest, and
      in Xen.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b216aa6c0fcbaa8ff4128969c14594896a5485a4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:39:37 2015 +0200

      target-i386: Use correct memory attributes for memory accesses

      These include page table walks, SVM accesses and SMM state save accesses.

      The bulk of the patch is obtained with

         sed -i 's/\(\<[a-z_]*_phys\(_notdirty\)\?\>(cs\)->as,/x86_\1,/'

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f794aa4a2fd772a3ec413c4e478cc23857cfee98
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:52:04 2015 +0200

      target-i386: introduce cpu_get_mem_attrs

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d7a0f71d9aac33e58d39fdbe4861d440af44fa8b
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:06 2015 +0200

      icount: print a warning if there is no more deadline in sleep=no mode

      While qemu is running in sleep=no mode, a warning will be printed
      when no timer deadline is set.
      As this mode is intended for getting deterministic virtual time, if no
      timer is set on the virtual clock this determinism is broken.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-4-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f1f4b57e88ff7c9cb20b074ff6106fd8f4397baa
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:05 2015 +0200

      icount: add sleep parameter to the icount option to set icount_sleep mode

      The 'sleep' parameter sets the icount_sleep mode, which is enabled by
      default. To disable it, add the 'sleep=no' parameter (or 'nosleep') to the
      qemu -icount option.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-3-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5045e9d912588a7421ab899ba510025722666fd1
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:04 2015 +0200

      icount: implement a new icount_sleep mode toggleing real-time cpu sleep

      When the icount_sleep mode is disabled, the QEMU_VIRTUAL_CLOCK runs at the
      maximum possible speed by warping the sleep times of the virtual cpu to the
      soonest clock deadline. The virtual clock will be updated only according
      the instruction counter.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-2-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ec05ec26f940564b1e07bf88857035ec27e21dd8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sun Mar 29 09:31:43 2015 +0200

      memory: use mr->ram_addr in "is this RAM?" assertions

      mr->terminates alone doesn't guarantee that we are looking at a RAM region.
      mr->ram_addr also has to be checked, in order to distinguish RAM and I/O
      regions.

      So, do the following:

      1) add a new define RAM_ADDR_INVALID, and test it in the assertions
      instead of mr->terminates

      2) IOMMU regions were not setting mr->ram_addr to a bogus value, initialize
      it in the instance_init function so that the new assertions would fire
      for IOMMU regions as well.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5f2cb94688bd0b2c88e0fc1ac3c4582965b7b106
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:19 2014 +0000

      memory: make cpu_physical_memory_sync_dirty_bitmap() fully atomic

      The fast path of cpu_physical_memory_sync_dirty_bitmap() directly
      manipulates the dirty bitmap.  Use atomic_xchg() to make the
      test-and-clear atomic.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-7-git-send-email-stefanha@redhat.com>
      [Only do xchg on nonzero words. - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03eebc9e3246b9b3f5925aa41f7dfd7c1e467875
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:18 2014 +0000

      memory: replace cpu_physical_memory_reset_dirty() with test-and-clear

      The cpu_physical_memory_reset_dirty() function is sometimes used
      together with cpu_physical_memory_get_dirty().  This is not atomic since
      two separate accesses to the dirty memory bitmap are made.

      Turn cpu_physical_memory_reset_dirty() and
      cpu_physical_memory_clear_dirty_range_type() into the atomic
      cpu_physical_memory_test_and_clear_dirty().

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-6-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 20015f72bda7d2f356c43580a5542a659afedf83
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:17 2014 +0000

      migration: move dirty bitmap sync to ram_addr.h

      The dirty memory bitmap is managed by ram_addr.h and copied to
      migration_bitmap[] periodically during live migration.

      Move the code to sync the bitmap to ram_addr.h where related code lives.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-5-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d114875b9a1c21162f69a12d72f69a22e7bab376
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:16 2014 +0000

      memory: use atomic ops for setting dirty memory bits

      Use set_bit_atomic() and bitmap_set_atomic() so that multiple threads
      can dirty memory without race conditions.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-4-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 36546e5b803f6e363906607307f27c489441fd15
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:15 2014 +0000

      bitmap: add atomic test and clear

      The new bitmap_test_and_clear_atomic() function clears a range and
      returns whether or not the bits were set.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-3-git-send-email-stefanha@redhat.com>
      [Test before xchg; then a full barrier is needed at the end just like
       in the previous patch.  The barrier can be avoided if we did at least
       one xchg.  - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9f02cfc84b85929947b32fe1674fbc6a429f332a
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:14 2014 +0000

      bitmap: add atomic set functions

      Use atomic_or() for atomic bitmaps where several threads may set bits at
      the same time.  This avoids the race condition between threads loading
      an element, bitwise ORing, and then storing the element.

      When setting all bits in a word we can avoid atomic ops and instead just
      use an smp_mb() at the end.

      Most bitmap users don't need atomicity so introduce new functions.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-2-git-send-email-stefanha@redhat.com>
      [Avoid barrier in the single word case, use full barrier instead of write.
       - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9460dee4b2258e3990906fb34099481c8334c267
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:41:32 2015 +0100

      memory: do not touch code dirty bitmap unless TCG is enabled

      cpu_physical_memory_set_dirty_lebitmap unconditionally syncs the
      DIRTY_MEMORY_CODE bitmap.  This however is unused unless TCG is
      enabled.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e87f7778b64d4a6a78e16c288c7fdc6c15317d5f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 15:21:39 2015 +0100

      exec: only check relevant bitmaps for cleanliness

      Most of the time, not all bitmaps have to be marked as dirty;
      do not do anything if the interesting ones are already dirty.
      Previously, any clean bitmap would have cause all the bitmaps to be
      marked dirty.

      In fact, unless running TCG most of the time bitmap operations need
      not be done at all, because memory_region_is_logging returns zero.
      In this case, skip the call to cpu_physical_memory_range_includes_clean
      altogether as well.

      With this patch, cpu_physical_memory_set_dirty_range is called
      unconditionally, so there need not be anymore a separate call to
      xen_modified_memory.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 72b47e79cef36ed6ffc718f10e21001d7ec2a66f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:48:25 2015 +0200

      exec: invert return value of cpu_physical_memory_get_clean, rename

      While it is obvious that cpu_physical_memory_get_dirty returns true even if
      a single page is dirty, the same is not true for cpu_physical_memory_get_clean;
      one would expect that it returns true only if all the pages are clean, but
      it actually looks for even one clean page.  (By contrast, the caller of that
      function, cpu_physical_memory_range_includes_clean, has a good name).

      To clarify, rename the function to cpu_physical_memory_all_dirty and return
      true if _all_ the pages are dirty.  This is the opposite of the previous
      meaning, because "all are 1" is the same as "not (any is 0)", so we have to
      modify cpu_physical_memory_range_includes_clean as well.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 58d2707e8713ef17b89b8b4c9ce586c76655a385
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:56:01 2015 +0100

      exec: pass client mask to cpu_physical_memory_set_dirty_range

      This cuts in half the cost of bitmap operations (which will become more
      expensive when made atomic) during migration on non-VRAM regions.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc377bcf617a48233a99a9fe0a26247c38b5cb76
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:20:35 2015 +0200

      translate-all: make less of tb_invalidate_phys_page_range depend on is_cpu_write_access

      is_cpu_write_access is only set if tb_invalidate_phys_page_range is called
      from tb_invalidate_phys_page_fast, and hence from notdirty_mem_write.
      However:

      - the code bitmap can be built directly in tb_invalidate_phys_page_fast
        (unconditionally, since is_cpu_write_access would always be passed as 1);

      - the virtual address is not needed to mark the page as "not containing
        code" (dirty code bitmap = 1), so we can also remove that use of
        is_cpu_write_access.  For calls of tb_invalidate_phys_page_range
        that do not come from notdirty_mem_write, the next call to
        notdirty_mem_write will notice that the page does not contain code
        anymore, and will fix up the TLB entry.

      The parameter needs to remain in order to guard accesses to cpu->mem_io_pc.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9564f52da7eb061326956ed9a468935e3352512d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:24:54 2015 +0200

      cputlb: remove useless arguments to tlb_unprotect_code_phys, rename

      These days modification of the TLB is done in notdirty_mem_write,
      so the virtual address and env pointer as unnecessary.

      The new name of the function, tlb_unprotect_code, is consistent with
      tlb_protect_code.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 358653391b0c0beaa0e3f9e28304e1918cd223b3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:20:35 2015 +0200

      translate-all: remove unnecessary argument to tb_invalidate_phys_range

      The is_cpu_write_access argument is always 0, remove it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1652b974766401743879d78f796f44b8929b0787
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:15:48 2015 +0200

      exec: move functions to translate-all.h

      Remove them from the sundry exec-all.h header, since they are only used by
      the TCG runtime in exec.c and user-exec.c.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 845b6214a309fa58a4405050bf8313e19fde5c91
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:45:53 2015 +0100

      exec: use memory_region_get_dirty_log_mask to optimize dirty tracking

      The memory API can now return the exact set of bitmaps that have to
      be tracked.  Use it instead of the in_migration variable.

      In the next patches, we will also use it to set only DIRTY_MEMORY_VGA
      or DIRTY_MEMORY_MIGRATION if necessary.  This can make a difference
      for dataplane, especially after the dirty bitmap is changed to use
      more expensive atomic operations.

      Of some interest is the change to stl_phys_notdirty.  When migration
      was introduced, stl_phys_notdirty was changed to effectively behave
      as stl_phys during migration.  In fact, if one looks at the function as it
      was in the beginning (commit 8df1cd0, physical memory access functions,
      2005-01-28), at the time the dirty bitmap was the equivalent of
      DIRTY_MEMORY_CODE nowadays; hence, the function simply should not touch
      the dirty code bits.  This patch changes it to do the intended thing.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 49dfcec40349245ad365964468b67e132c3cedc7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:35:19 2015 +0100

      ram_addr: tweaks to xen_modified_memory

      Invoke xen_modified_memory from cpu_physical_memory_set_dirty_range_nocode;
      it is akin to DIRTY_MEMORY_MIGRATION, so set it together with that bitmap.
      The remaining call from invalidate_and_set_dirty's "else" branch will go
      away soon.

      Second, fix the second argument to the function in the
      cpu_physical_memory_set_dirty_lebitmap call site.  That function is only used
      by KVM, but it is better to be clean anyway.

      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1bfbac4ee16e2ea95d087e0926727d9a113b483e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:57:21 2015 +0100

      kvm: remove special handling of DIRTY_MEMORY_MIGRATION in the dirty log mask

      One recent example is commit 4cc856f (kvm-all: Sync dirty-bitmap from
      kvm before kvm destroy the corresponding dirty_bitmap, 2015-04-02).
      Another performance problem is that KVM keeps tracking dirty pages
      after a failed live migration, which causes bad performance due to
      disallowing huge page mapping.

      Thanks to the previous patch, KVM can now stop hooking into
      log_global_start/stop.  This simplifies the KVM code noticeably.

      Reported-by: Wanpeng Li <wanpeng.li@linux.intel.com>
      Reported-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f6a5ef3e429f92f987678ea8c396aab4dc6aa19
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:57:21 2015 +0100

      memory: include DIRTY_MEMORY_MIGRATION in the dirty log mask

      The separate handling of DIRTY_MEMORY_MIGRATION, which does not
      call log_start/log_stop callbacks when it changes in a region's
      dirty logging mask, has caused several bugs.

      One recent example is commit 4cc856f (kvm-all: Sync dirty-bitmap from
      kvm before kvm destroy the corresponding dirty_bitmap, 2015-04-02).
      Another performance problem is that KVM keeps tracking dirty pages
      after a failed live migration, which causes bad performance due to
      disallowing huge page mapping.

      This patch removes the root cause of the problem by reporting
      DIRTY_MEMORY_MIGRATION changes via log_start and log_stop.
      Note that we now have to rebuild the FlatView when global dirty
      logging is enabled or disabled; this ensures that log_start and
      log_stop callbacks are invoked.

      This will also be used to make the setting of bitmaps conditional.
      In general, this patch lets users of the memory API ignore the
      global state of dirty logging if they handle dirty logging
      generically per region.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ea8cb1a8d98f5e3822a23a7cecdb4add0f29178b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 27 14:51:31 2015 +0200

      kvm: accept non-mapped memory in kvm_dirty_pages_log_change

      It is okay if memory is not mapped into the guest but has dirty logging
      enabled.  When this happens, KVM will not do anything and only accesses
      from the host will be logged.

      This can be triggered by iofuzz.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 677e7805cf95f3b2bca8baf0888d1ebed7f0c606
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:53:21 2015 +0100

      memory: track DIRTY_MEMORY_CODE in mr->dirty_log_mask

      DIRTY_MEMORY_CODE is only needed for TCG.  By adding it directly to
      mr->dirty_log_mask, we avoid testing for TCG everywhere a region is
      checked for the enabled/disabled state of dirty logging.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 42af3e3a02f6d0c38c46465b7f0311eabf532f77
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:30:19 2015 +0200

      ui/console: remove dpy_gfx_update_dirty

      dpy_gfx_update_dirty expects DIRTY_MEMORY_VGA logging to be always on,
      but that will not be the case soon.  Because it computes the memory
      region on the fly for every update (with memory_region_find), it cannot
      enable/disable logging by itself.

      We could always treat updates as invalidations if dirty logging is
      not enabled, assuming that the board will enable logging on the
      RAM region that includes the framebuffer.

      However, the function is unused, so just drop it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d55d42078bfb507743747b761673507b95a76620
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:46:52 2015 +0100

      framebuffer: check memory_region_is_logging

      framebuffer.c expects DIRTY_MEMORY_VGA logging to be always on, but that
      will not be the case soon.  Because framebuffer.c computes the memory
      region on the fly for every update (with memory_region_find), it cannot
      enable/disable logging by itself.

      Instead, always treat updates as invalidations if dirty logging is
      not enabled, assuming that the board will enable logging on the
      RAM region that includes the framebuffer.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b2dfd71c4843a762f2befe702adb249cf55baf66
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Apr 25 14:38:30 2015 +0200

      memory: prepare for multiple bits in the dirty log mask

      When the dirty log mask will also cover other bits than DIRTY_MEMORY_VGA,
      some listeners may be interested in the overall zero/non-zero value of
      the dirty log mask; others may be interested in the value of single bits.

      For this reason, always call log_start/log_stop if bits have respectively
      appeared or disappeared, and pass the old and new values of the dirty log
      mask so that listeners can distinguish the kinds of change.

      For example, KVM checks if dirty logging used to be completely disabled
      (in log_start) or is now completely disabled (in log_stop).  On the
      other hand, Xen has to check manually if DIRTY_MEMORY_VGA changed,
      since that is the only bit it cares about.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2d1a35bef0ed96b3f23535e459c552414ccdbafd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:50:57 2015 +0100

      memory: differentiate memory_region_is_logging and memory_region_get_dirty_log_mask

      For now memory regions only track DIRTY_MEMORY_VGA individually, but
      this will change soon.  To support this, split memory_region_is_logging
      in two functions: one that returns a given bit from dirty_log_mask,
      and one that returns the entire mask.  memory_region_is_logging gets an
      extra parameter so that the compiler flags misuse.

      While VGA-specific users (including the Xen listener!) will want to keep
      checking that bit, KVM and vhost check for "any bit except migration"
      (because migration is handled via the global start/stop listener
      callbacks).

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5299c0f2cf951c23ec681ff87e455d1cf4ec537b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:12:40 2015 +0200

      display: add memory_region_sync_dirty_bitmap calls

      These are strictly speaking only needed for KVM and Xen, but it's still
      nice to be consistent.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 74259ae55b15bff4ef7b26faa6431a3ff16d7c9d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:47:45 2015 +0100

      display: enable DIRTY_MEMORY_VGA tracking explicitly

      This will be required soon by the memory core.

      Tested-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 086f90e890fb25e7f12fbe72fe5a8078792398aa
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 12:43:24 2015 +0200

      g364fb: remove pointless call to memory_region_set_coalescing

      Coalescing work on MMIO, not RAM, thus this call has no effect.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dbddac6da01a13c9d5d162994a0a265173acecab
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:31:53 2015 +0100

      memory: the only dirty memory flag for users is DIRTY_MEMORY_VGA

      DIRTY_MEMORY_MIGRATION is triggered by memory_global_dirty_log_start
      and memory_global_dirty_log_stop, so it cannot be used with
      memory_region_set_log.

      Specify this in the documentation and assert it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6b4ad3b28d4a70ad93f287b50200b04766aeb0de
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon May 25 22:38:06 2015 -0700

      Makefile.target: set master BUILD_DIR

      make can be invoked in the individual build dirs to build an individual
      target or just a single file of a target. e.g.

      touch translate-all.c
      make -C microblazeel-softmmu translate-all.o

      There is however a small bug when using the pixman submodule.
      config-host.mak will ref BUILD_DIR for the pixman -I CFLAGS:

      grep BUILD_DIR config-host.mak
      QEMU_CFLAGS=-I$(SRC_PATH)/pixman/pixman -I$(BUILD_DIR)/pixman/pixman ...

      This causes a build failure as -I/pixman/pixman (BUILD_DIR=="") will
      not be found.

      BUILD_DIR is usually set by the top level Makefile. Just lazy-set it in
      Makefile.target to the parent directory.

      Granted, this will not work if the pixman submodule is not prebuilt,
      but it at least means you can do incremental partial builds once you
      have done your initial full build (or attempt) from the top level.

      The next step would be refactor make infrastructure to rebuild pixman
      on a submake like the one above.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <1432618686-16077-1-git-send-email-crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit db94604b20278c1dc227a04e4c564d80230e6c3f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 21 15:12:29 2015 +0200

      exec: optimize phys_page_set_level

      phys_page_set_level is writing zeroes to a struct that has just been
      filled in by phys_map_node_alloc.  Instead, tell phys_map_node_alloc
      whether to fill in the page "as a leaf" or "as a non-leaf".

      memcpy is faster than struct assignment, which copies each bitfield
      individually.  A compiler bug (https://gcc.gnu.org/PR66391), and
      small memcpys like this one are special-cased anyway, and optimized
      to a register move, so just use the memcpy.

      This cuts the cost of phys_page_set_level from 25% to 5% when
      booting qboot.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e4afbf4fb4d026510700cb40bb72dea9aef14e3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 19 10:50:59 2015 +0000

      qemu-nbd: Switch to qemu_set_fd_handler

      Achieved by:

      - Remembering the server fd with a global variable, in order to access
        it from nbd_client_closed.

      - Checking nbd_can_accept() and updating server_fd handler whenever
        client connects or disconnects.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1432032670-15124-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dae02ba55a66cb3194a2410c7725734e5bc6166f
  Author: Laurent Vivier <lvivier@redhat.com>
  Date:   Mon May 18 21:06:47 2015 +0200

      ppc: add helpful message when KVM fails to start VCPU

      On POWER8 systems, KVM checks if VCPU is running on primary threads,
      and that secondary threads are offline. If this is not the case,
      ioctl() fails with errno set to EBUSY.

      QEMU aborts with a non explicit error message:
      $ ./qemu-system-ppc64 --nographic -machine pseries,accel=kvm
      error: kvm run failed Device or resource busy

      To help user to diagnose the problem, this patch adds an informative
      error message.

      There is no easy way to check if SMT is enabled before starting the VCPU,
      and as this case is the only one setting errno to EBUSY, we just check
      the errno value to display a message.

      Signed-off-by: Laurent Vivier <lvivier@redhat.com>
      Message-Id: <1431976007-20503-1-git-send-email-lvivier@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9157eee1b1c076ff3316361b760e891dda13e9bf
  Author: Miroslav Rezanina <mrezanin@redhat.com>
  Date:   Wed May 13 11:39:30 2015 +0200

      Move parallel_hds_isa_init to hw/isa/isa-bus.c

      Disabling CONFIG_PARALLEL cause removing parallel_hds_isa_init defined in
      parallel.c. This function is called during initialization of some boards so
      disabling CONFIG_PARALLEL cause build failure.

      This patch moves parallel_hds_isa_init to hw/isa/isa-bus.c so it is included
      in case of disabled CONFIG_PARALLEL. Build is successful but qemu will abort
      with "Unknown device" error when function is called.

      Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
      Message-Id: <1431509970-32154-1-git-send-email-mrezanin@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 00967f4e0bab246679d0ddc32fd31a7179345baf
  Merge: d6688ba 9814fed
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 5 12:04:41 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-06-05

      This time there are a lot of s390x TCG emulation bug fixes - almost all
      of them from Aurelien, who returned from nirvana :).

      # gpg: Signature made Fri Jun  5 00:39:27 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream: (34 commits)
        target-s390x: Only access allocated storage keys
        target-s390x: fix MVC instruction when areas overlap
        target-s390x: use softmmu functions for mvcp/mvcs
        target-s390x: support non current ASC in s390_cpu_handle_mmu_fault
        target-s390x: add a cpu_mmu_idx_to_asc function
        target-s390x: implement high-word facility
        target-s390x: implement load-and-trap facility
        target-s390x: implement miscellaneous-instruction-extensions facility
        target-s390x: implement LPDFR and LNDFR instructions
        target-s390x: implement TRANSLATE EXTENDED instruction
        target-s390x: implement TRANSLATE AND TEST instruction
        target-s390x: implement LOAD FP INTEGER instructions
        target-s390x: move SET DFP ROUNDING MODE to the correct facility
        target-s390x: move STORE CLOCK FAST to the correct facility
        target-s390x: change CHRL and CGHRL format to RIL-b
        target-s390x: fix CLGIT instruction
        target-s390x: fix exception for invalid operation code
        target-s390x: implement LAY and LAEY instructions
        target-s390x: move a few instructions to the correct facility
        target-s390x: detect tininess before rounding for FP operations
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ba98885a0e965a17df214ab12b819ef630d8a14
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:37 2015 +0100

      macio: remove remainder_len DBDMA_io property

      Since the block alignment code is now effectively independent of the DMA
      implementation, this variable is no longer required and can be removed.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-5-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit b01d44cd0623dec66e583d6cd2438451443261df
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:36 2015 +0100

      macio: update comment/constants to reflect the new code

      With the offset/len functions taking care of all of the alignment mapping
      in isolation from the DMA tranasaction, many comments are now unnecessary.
      Remove these and tidy up a few constants at the same time.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-4-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit ac58fe7b2c67a9be142beacd4c6ee51f3264d90f
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:35 2015 +0100

      macio: switch pmac_dma_write() over to new offset/len implementation

      In particular, this fixes a bug whereby chains of overlapping head/tail chains
      would incorrectly write over each other's remainder cache. This is the access
      pattern used by OS X/Darwin and fixes an issue with a corrupt Darwin
      installation in my local tests.

      While we are here, rename the DBDMA_io struct property remainder to
      head_remainder for clarification.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-3-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 0389b8f8c7688fe512e16bdc00c5f35d2d8df12c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:34 2015 +0100

      macio: switch pmac_dma_read() over to new offset/len implementation

      For better handling of unaligned block device accesses.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-2-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 9814fed0afa73f5c37f04e02ec17c915a5d59303
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jun 4 00:52:44 2015 +0200

      target-s390x: Only access allocated storage keys

      We allocate ram_size / PAGE_SIZE storage keys, so we need to make sure that
      we only access that many. Unfortunately the code can overrun this array by
      one, potentially overwriting unrelated memory.

      Fix it by limiting storage keys to their scope.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 068593deea6cc61b06243a33c7fcfadb1650b654
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:56 2015 +0200

      target-s390x: fix MVC instruction when areas overlap

      The MVC instruction and the memmove C funtion do not have the same
      semantic when memory areas overlap:

      MVC: When the operands overlap, the result is obtained as if the
      operands were processed one byte at a time and each result byte were
      stored immediately after fetching the necessary operand byte.

      memmove: Copying takes place as though the bytes in src are first copied
      into a temporary array that does not overlap src or dest, and the bytes
      are then copied from the temporary array to dest.

      The behaviour is therefore the same when the destination is at a lower
      address than the source, but not in the other case. This is actually a
      trick for propagating a value to an area. While the current code detects
      that and call memset in that case, it only does for 1-byte value. This
      trick can and is used for propagating two or more bytes to an area.

      In the softmmu case, the call to mvc_fast_memmove is correct as the
      above tests verify that source and destination are each within a page,
      and both in a different page. The part doing the move 8 bytes by 8 bytes
      is wrong and we need to check that if the source and destination
      overlap, they do with a distance of minimum 8 bytes before copying 8
      bytes at a time.

      In the user code, we should check check that the destination is at a
      lower address than source or than the end of the source is at a lower
      address than the destination before calling memmove. In the opposite
      case we fallback to the same code as the softmmu one. Note that l
      represents (length - 1).

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a3084e8055067b3fe8ed653a609021d2ab368564
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:55 2015 +0200

      target-s390x: use softmmu functions for mvcp/mvcs

      mvcp and mvcs helper get access to the physical memory by a call to
      mmu_translate for the virtual to real conversion and then using ldb_phys
      and stb_phys to physically access the data. In practice this is quite
      slow because it bypasses the QEMU softmmu TLB and because stb_phys calls
      try to invalidate the corresponding memory for each access.

      Instead use cpu_ldb_{primary,secondary} for the loads and
      cpu_stb_{primary,secondary} for the stores. Ideally this should be
      further optimized by a call to memcpy, but that already improves the
      boot time of a guest by a factor 1.8.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c255ac601231e8c53007e10d640722ac58eb77cc
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:54 2015 +0200

      target-s390x: support non current ASC in s390_cpu_handle_mmu_fault

      s390_cpu_handle_mmu_fault currently looks at the current ASC mode
      defined in PSW mask instead of the MMU index. This prevent emulating
      easily instructions using a specific ASC mode. Fix that by using the
      MMU index converted back to ASC using the just added cpu_mmu_idx_to_asc
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4decd76d71d6972a59bf0a16d0dea0c83490d001
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:53 2015 +0200

      target-s390x: add a cpu_mmu_idx_to_asc function

      Use constants to define the MMU indexes, and add a function to do
      the reverse conversion of cpu_mmu_index.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1f12d855b6ec79a640fa6a74d12884f1646ecfe
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:52 2015 +0200

      target-s390x: implement high-word facility

      Besides RISBHG and RISBLG, all high-word instructions are not
      implemented. Fix that.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 782a8479522f8e4a596f968e4acad5c10b77e061
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:51 2015 +0200

      target-s390x: implement load-and-trap facility

      At the same time move the trap code from op_ct into gen_trap and use it
      for all new functions. The value needs to be stored back to register
      before the exception, but also before the brcond (as we don't use
      temp locals). That's why we can't use wout helper.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 375ee58bedcda359011fe7fa99e0647f66f9ffa0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:50 2015 +0200

      target-s390x: implement miscellaneous-instruction-extensions facility

      RISBGN is the same as RISBG, but without setting the condition code.
      CLT and CLGT are the same as CLRT and CLGRT, but using memory for the
      second operand.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit df46283ce7be962002a30140a91ffbb56832cc2d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:49 2015 +0200

      target-s390x: implement LPDFR and LNDFR instructions

      This complete the floating point support sign handling facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3f4de6756cd87b508b37c7ffa93f7b827832c4eb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:48 2015 +0200

      target-s390x: implement TRANSLATE EXTENDED instruction

      It is part of the basic zArchitecture instructions.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 54f007750978ffbb98ce933077e0d1741e0202b0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:47 2015 +0200

      target-s390x: implement TRANSLATE AND TEST instruction

      It is part of the basic zArchitecture instructions. Allow it to be call
      from EXECUTE.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ed0bcecec105137567f461e5b57834e72c851855
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:46 2015 +0200

      target-s390x: implement LOAD FP INTEGER instructions

      This is needed to pass the gcc.c-torture/execute/ieee/20010114-2.c test
      in the gcc testsuite.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9182886d797a20925d801a3378ca5330c0d91dfb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:45 2015 +0200

      target-s390x: move SET DFP ROUNDING MODE to the correct facility

      It belongs to the DFP rounding facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f7c2114067cc32eb8d8f79b7374a641ec5f4eb72
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:44 2015 +0200

      target-s390x: move STORE CLOCK FAST to the correct facility

      STORE CLOCK FAST should be in the SCF facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 74266b4a5837b46477034a39acc2be3a3afba431
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:43 2015 +0200

      target-s390x: change CHRL and CGHRL format to RIL-b

      Change to match the PoP. In practice both format RIL-a and RIL-b have
      the same fields. They differ on the way we decode the fields, and it's
      done correctly in QEMU.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1dedb9b76f061c8da730002f6c21a1fa2b76b106
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:42 2015 +0200

      target-s390x: fix CLGIT instruction

      The COMPARE LOGICAL IMMEDIATE AND TRAP instruction should compare the
      numbers as unsigned, as its name implies.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 111d7f4a69751d333bac32526cd252add6b071d3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:41 2015 +0200

      target-s390x: fix exception for invalid operation code

      When an operation code is not recognized (ie invalid instruction) an
      operation exception should be generated instead of a specification
      exception. The latter is for valid opcode, with invalid operands or
      modifiers.

      This give a very basic GDB support in the guest, as it uses the invalid
      opcode 0x0001 to generate a trap.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1c7610a68795d66249c25166220324d4d0b9289
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:31 2015 +0200

      target-s390x: implement LAY and LAEY instructions

      This complete the general-instructions-extension facility, enable it.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      [agraf: remove facility bit]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 92892330e78ffca7bebf03f4f7161c5bbd6602d2
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:30 2015 +0200

      target-s390x: move a few instructions to the correct facility

      LY is part of the long-displacement facility.
      RISBHG and RISBLG are part of the high-word facility.
      STCMH is part of the z/Architecture.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4a33565f9f46145d8cc701ab623b18bf423c469e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:26 2015 +0200

      target-s390x: detect tininess before rounding for FP operations

      The s390x floating point unit detects tininess before rounding, so set
      the softfloat fp_status up appropriately.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f821135cdd4df09b1362666ddfbdfd162b905b1f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:25 2015 +0200

      target-s390x: silence NaNs for LOAD LENGTHENED and LOAD ROUNDED

      LOAD LENGTHENED and LOAD ROUNDED are considered as FP operations and
      thus need to convert input sNaN into corresponding qNaN.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2daea9c16ffe61377b6e5426d9c52014bf538df3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:24 2015 +0200

      target-s390x: define default NaN values

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1f65958d9c21fd3b461f6b645e7884866313c1f3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:23 2015 +0200

      target-s390x: fix MMU index computation

      The cpu_mmu_index function wrongly looks at PSW P bit to determine the
      MMU index, while this bit actually only control the use of priviledge
      instructions. The addressing mode is detected by looking at the PSW ASC
      bits instead.

      This used to work more or less correctly up to kernel 3.6 as the kernel
      was running in primary space and userland in secondary space. Since
      kernel 3.7 the default is to run the kernel in home space and userland
      in primary space. While the current QEMU code seems to work it open some
      security issues, like accessing the lowcore memory in R/W mode from a
      userspace process once it has been accessed by the kernel (it is then
      cached by the QEMU TLB).

      At the same time change the MMU_USER_IDX value so that it matches the
      value used in recent kernels.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9bebf9863bd16cc824231ad71959a338dc1819ac
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:22 2015 +0200

      target-s390x: fix PSW value on dynamical exception from helpers

      runtime_exception computes the psw.addr value using the actual exception
      address and the instruction length computed by calling the get_ilen
      function. However as explained above the get_ilen code, it returns the
      actual instruction length, and not the ILC. Therefore there is no need to
      multiply the value by 2.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aa752a4afc2a4b7ede58a960a9d553b3fd9e6882
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue May 26 11:09:44 2015 +0200

      target-s390x: fix LOAD MULTIPLE instruction on page boundary

      When consecutive memory locations are on page boundary a page fault
      might occur when using the LOAD MULTIPLE instruction. In that case real
      hardware doesn't load any register.

      This is an important detail in case the base register is in the list
      of registers to be loaded. If a page fault occurs this register might be
      overwritten and when the instruction is later restarted the wrong
      base register value is useD.

      Fix this by first loading the first and last value from memory, hence
      triggering all possible page faults, and then the remaining registers.

      This fixes random segmentation faults seen in the guest.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b8ae94bd398ff772f40fb232887ecbcbd244c3d4
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:29 2015 +0200

      target-s390x: implement STPT helper

      Save the timer target value in the SPT helper, so that the STPT helper
      can compute the remaining time.

      This allow the Linux kernel to correctly do time accounting.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aa9e14e684506e8ddf02bd5cff720520827bf244
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:28 2015 +0200

      target-s390x: implement STCKC helper

      The STCKC instruction just returns the last written clock comparator
      value and KVM already provides the corresponding variable.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d9d55f1108f45c866098731d95fef88409ff1e94
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:27 2015 +0200

      target-s390x: streamline STCK helper

      Now that clock_value is only used in one place, we can inline it in
      the STCK helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c941f07485e56e4b2653048e166b720428307acb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:26 2015 +0200

      target-s390x: simplify SCKC helper

      The clock comparator and the QEMU timer work the same way, triggering
      at a given time, they just differ by the origin and the scale. It is
      therefore possible to go from one to another without using the current
      clock value. This spares two calls to qemu_clock_get_ns, which probably
      return slightly different values, possibly reducing the accuracy.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9cb32c442e11d16b747fa07e29dd29b5d8227b57
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:25 2015 +0200

      target-s390x: add a tod2time function

      Add a tod2time function similar to the time2tod one, instead of open
      coding the conversion.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a91a1b20a23424412a3e7bb184422ec30ae64453
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:40:00 2015 +0200

      target-s390x: remove unused helpers

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d30107814c8d02f1896bd57249aef1b5aaed38c9
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:39:59 2015 +0200

      target-s390x: optimize (negative-) abs computation

      Now that movcond exists, it's easy to write (negative-) absolute value
      using TCG code instead of an helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2aaa1940684a3bf2b381fd2a8ff26c287a05109d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:39:58 2015 +0200

      target-s390x: fix CC computation for LOAD POSITIVE instructions

      LOAD POSITIVE instructions (LPR, LPGR and LPGFR) set the following
      condition code:
        0: Result zero; no overflow
        1: --
        2: Result greater than zero; no overflow
        3: Overflow

      The current code wrongly returns 1 instead of 2 in case of a result
      greater than 0. This patches fixes that. This fixes the marshalling of
      the value '0L' in Python.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee0d0be16819896cc6c8018cbe171a632b61489c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun May 17 01:28:03 2015 +0200

      target-s390x: fix CC computation for EX instruction

      Commit 7a6c7067f optimized CC computation by only saving cc_op before
      calling helpers as they either don't touch the CC or generate a new
      static value. This however doesn't work for the EX instruction as the
      helper changes or not the CC value depending on the actual executed
      instruction (e.g. MVC vs CLC).

      This patches force a CC computation before calling the helper. This
      fixes random memory corruption occuring in guests.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      [agraf: remove set_cc_static in op_ex as suggested by rth]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d6688ba17b934f20f5e8953dbaafc9408d8799c5
  Merge: 3b730f5 309750f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 18:32:44 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, acpi, virtio, tpm

      This includes pxb support by Marcel, as well as multiple enhancements all over
      the place.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu Jun  4 11:51:02 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (28 commits)
        vhost: logs sharing
        hw/acpi: piix4_pm_init(): take fw_cfg object no more
        hw/acpi: move "etc/system-states" fw_cfg file from PIIX4 to core
        hw/acpi: acpi_pm1_cnt_init(): take "disable_s3" and "disable_s4"
        pc-dimm: don't assert if pc-dimm alignment != hotpluggable mem range size
        docs: Add PXB documentation
        apci: fix PXB behaviour if used with unsupported BIOS
        hw/pxb: add numa_node parameter
        hw/pci: add support for NUMA nodes
        hw/pxb: add map_irq func
        hw/pci: inform bios if the system has extra pci root buses
        hw/pci: introduce PCI Expander Bridge (PXB)
        hw/pci: removed 'rootbus nr is 0' assumption from qmp_pci_query
        hw/acpi: remove from root bus 0 the crs resources used by other buses.
        hw/acpi: add _CRS method for extra root busses
        hw/apci: add _PRT method for extra PCI root busses
        hw/acpi: add support for i440fx 'snooping' root busses
        hw/pci: extend PCI config access to support devices behind PXB
        hw/i386: query only for q35/pc when looking for pci host bridge
        hw/pci: made pci_bus_num a PCIBusClass method
        ...

      Conflicts:
      	hw/i386/pc_piix.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3b730f570c5872ceea2137848f1d4554d4847441
  Merge: 2700a97 1de29ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 14:04:14 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-06-03

      Highlights this time around:

        - sPAPR: endian fixes, speedups, bug fixes, hotplug basics
        - add default ram size capability for machines (sPAPR defaults to 512MB now)

      # gpg: Signature made Wed Jun  3 22:59:09 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (40 commits)
        softmmu: support up to 12 MMU modes
        tcg: add TCG_TARGET_TLB_DISPLACEMENT_BITS
        tci: do not use CPUArchState in tcg-target.h
        Add David Gibson for sPAPR in MAINTAINERS file
        pseries: Enable in-kernel H_LOGICAL_CI_{LOAD, STORE} implementations
        spapr: override default ram size to 512MB
        machine: add default_ram_size to machine class
        spapr_pci: emit hotplug add/remove events during hotplug
        spapr_pci: enable basic hotplug operations
        pci: make pci_bar useable outside pci.c
        spapr_pci: create DRConnectors for each PCI slot during PHB realize
        spapr_pci: add dynamic-reconfiguration option for spapr-pci-host-bridge
        spapr_drc: add spapr_drc_populate_dt()
        spapr_events: event-scan RTAS interface
        spapr_events: re-use EPOW event infrastructure for hotplug events
        spapr_rtas: add ibm, configure-connector RTAS interface
        spapr: add rtas_st_buffer_direct() helper
        spapr_rtas: add get-sensor-state RTAS interface
        spapr_rtas: add set-indicator RTAS interface
        spapr_rtas: add get/set-power-level RTAS interfaces
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2700a976dba6b107365aa9af7fd927ffb3dd3b21
  Merge: 6fa6b31 de38528
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 12:49:15 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-06-03' into staging

      trivial patches for 2015-06-03

      # gpg: Signature made Wed Jun  3 14:07:47 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-06-03: (30 commits)
        configure: postfix --extra-cflags to QEMU_CFLAGS
        cadence_gem: Fix Rx buffer size field mask
        slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
        translate-all: delete prototype for non-existent function
        Add -incoming help text
        hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irq
        hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irq
        hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irq
        hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irq
        hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irq
        hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irq
        hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irq
        hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irq
        hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irq
        hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irq
        hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irq
        hw/i386/pc: Fix misusing qemu_allocate_irqs for single irq
        hw/intc/exynos4210_gic.c: Fix memory leak by adjusting order
        hw/arm/omap_sx1.c: Fix memory leak spotted by valgrind
        hw/ppc/e500.c: Fix memory leak
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 309750fad51f17d1ec6195c5d8ad7d741596ddb6
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 05:28:46 2015 -0400

      vhost: logs sharing

      Currently we allocate one vhost log per vhost device. This is sub
      optimal when:

      - Guest has several device with vhost as backend
      - Guest has multiqueue devices

      In the above cases, we can avoid the memory allocation by sharing a
      single vhost log among all the vhost devices. This is done through:

      - Introducing a new vhost_log structure with refcnt inside.
      - Using a global pointer to vhost_log structure that will be used. And
        introduce helper to get the log with expected log size and helper to
      - drop the refcnt to the old log.
      - Each vhost device still keep track of a pointer to the log that was
        used.

      With above, if no resize happens, all vhost device will share a single
      vhost log. During resize, a new vhost_log structure will be allocated
      and made for the global pointer. And each vhost devices will drop the
      refcnt to the old log.

      Tested by doing scp during migration for a 2 queues virtio-net-pci.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6fa6b312765f698dc81b2c30e7eeb9683804a05b
  Merge: d2ceeb1 1b93c9a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 11:44:32 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue 2015-06-02

      # gpg: Signature made Tue Jun  2 20:21:17 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        arch_init: Drop target-x86_64.conf
        target-i386: Register QOM properties for feature flags
        apic: convert ->busdev.qdev casts to C casts
        target-i386: Fix signedness of MSR_IA32_APICBASE_BASE
        pc: Ensure non-zero CPU ref count after attaching to ICC bus

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6e7d82497dc8da7d420c8fa6632d759e08a18bc3
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:16 2015 +0200

      hw/acpi: piix4_pm_init(): take fw_cfg object no more

      This PIIX4 init function has no more reason to receive a pointer to the
      FwCfg object. Remove the parameter from the prototype, and update callers.

      As a result, the pc_init1() function no longer needs to save the return
      value of pc_memory_init() and xen_load_linux(), which makes it more
      similar to pc_q35_init().

      The return type & value of pc_memory_init() and xen_load_linux() are not
      changed themselves; maybe we'll need their return values sometime later.

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit e3845e7c47cc3eaf35305c9c0f9d55ca3840b49b
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:15 2015 +0200

      hw/acpi: move "etc/system-states" fw_cfg file from PIIX4 to core

      The acpi_pm1_cnt_init() core function is responsible for setting up the
      register block that will ultimately react to S3 and S4 requests (see
      acpi_pm1_cnt_write()). It makes sense to advertise this configuration to
      the guest firmware via an easy to parse fw_cfg file (ACPI is too complex
      for firmware to parse), and indeed PIIX4 does that. However, since
      acpi_pm1_cnt_init() is not specific to PIIX4, neither should be the fw_cfg
      file.

      This patch makes "etc/system-states" appear on all chipsets modified in
      the previous patch, not just PIIX4 (assuming they have fw_cfg at all).

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit 9a10bbb4e83b184faef6fa744396a6775283c0aa
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:14 2015 +0200

      hw/acpi: acpi_pm1_cnt_init(): take "disable_s3" and "disable_s4"

      This patch only modifies the function prototype and updates all chipset
      code that calls acpi_pm1_cnt_init() to pass in their own disable_s3 and
      disable_s4 settings. vt82c686 is assumed to be fixed "S3 and S4 enabled".

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit d2ceeb1d68ed8b005892408fcdb533f578aae081
  Merge: a67bfbb 94edf02
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 10:21:52 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150602' into staging

      target-arm queue:
       * more EL2 preparation patches
       * revert a no-longer-necessary workaround for old glib versions
       * add GICv2m support to virt board (MSI support)
       * pl061: fix wrong calculation of GPIOMIS register
       * support MSI via irqfd
       * remove a confusing v8_ prefix from some variable names
       * add dynamic sysbus device support to the virt board

      # gpg: Signature made Tue Jun  2 17:30:38 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150602: (22 commits)
        hw/arm/virt: change indentation in a15memmap
        hw/arm/virt: add dynamic sysbus device support
        hw/arm/boot: arm_load_kernel implemented as a machine init done notifier
        hw/arm/sysbus-fdt: helpers for platform bus nodes addition
        target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays
        arm_gicv2m: set kvm_gsi_direct_mapping and kvm_msi_via_irqfd_allowed
        kvm: introduce kvm_arch_msi_data_to_gsi
        pl061: fix wrong calculation of GPIOMIS register
        target-arm: Add the GICv2m to the virt board
        target-arm: Extend the gic node properties
        arm_gicv2m: Add GICv2m widget to support MSIs
        target-arm: Add GIC phandle to VirtBoardInfo
        Revert "target-arm: Avoid g_hash_table_get_keys()"
        target-arm: Add TLBI_VAE2{IS}
        target-arm: Add TLBI_ALLE2
        target-arm: Add TLBI_ALLE1{IS}
        target-arm: Add TTBR0_EL2
        target-arm: Add TPIDR_EL2
        target-arm: Add SCTLR_EL2
        target-arm: Add TCR_EL2
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b5d3b039221f056befb3715471fee1f68214815c
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Jun 3 17:10:43 2015 +0200

      pc-dimm: don't assert if pc-dimm alignment != hotpluggable mem range size

      Drop superfluous pc-dimm alignment on hot-pluggable mem
      range size assert, since it causes QEMU crash during hotplug
      when hotplugging pc-dimm with alignment bigger than
      an alignment of hot-pluggable mem range size.

      Instead allow pc_dimm_get_free_addr() find free address
      and bail out gracefully later in that function during
      checking if pc-dimm will fit in hot-pluggable mem range.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1de29aef17a7d70dbc04a7fe51e18942e3ebe313
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 09:18:23 2015 +0200

      softmmu: support up to 12 MMU modes

      At 8k per TLB (for 64-bit host or target), 8 or more modes
      make the TLBs bigger than 64k, and some RISC TCG backends do
      not like that.  On the affected hosts, cut the TLB size in
      half---there is still a measurable speedup on PPC with the
      next patch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1424436345-37924-3-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 006f8638c62bca2b0caf609485f47fa5e14d8a3c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 09:18:22 2015 +0200

      tcg: add TCG_TARGET_TLB_DISPLACEMENT_BITS

      This will be used to size the TLB when more than 8 MMU modes are
      used by the target.  Limitations come from the limited size of
      the immediate fields (which sometimes, as in the case of Aarch64,
      extend to instructions that shift the immediate).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1424436345-37924-2-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5a58e884d1d9905a835de2889c8cd73327fe2a94
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 19 09:59:34 2015 +0200

      tci: do not use CPUArchState in tcg-target.h

      tcg-target.h does not use any QEMU-specific symbols, save for tci's usage
      of CPUArchState.  Pull that up to tcg/tcg.h.

      This will make it possible to include tcg-target.h in cpu-defs.h.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 085eb217dfb3ee12e7985c11f71f8a038394735a
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri May 8 10:11:00 2015 +1000

      Add David Gibson for sPAPR in MAINTAINERS file

      At Alex Graf's request I'm now acting as sub-maintainer for the sPAPR
      (-machine pseries) code.  This updates MAINTAINERS accordingly.

      While we're at it, change the label to mention pseries since that's the
      actual name of the machine type, even if most of the C files use the sPAPR
      name.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 026bfd89cb896c8a3460cc551cc4836219bd7ff9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu May 7 15:33:59 2015 +1000

      pseries: Enable in-kernel H_LOGICAL_CI_{LOAD, STORE} implementations

      qemu currently implements the hypercalls H_LOGICAL_CI_LOAD and
      H_LOGICAL_CI_STORE as PAPR extensions.  These are used by the SLOF firmware
      for IO, because performing cache inhibited MMIO accesses with the MMU off
      (real mode) is very awkward on POWER.

      This approach breaks when SLOF needs to access IO devices implemented
      within KVM instead of in qemu.  The simplest example would be virtio-blk
      using an iothread, because the iothread / dataplane mechanism relies on
      an in-kernel implementation of the virtio queue notification MMIO.

      To fix this, an in-kernel implementation of these hypercalls has been made,
      (kernel commit 99342cf "kvmppc: Implement H_LOGICAL_CI_{LOAD,STORE} in KVM"
      however, the hypercalls still need to be enabled from qemu.  This performs
      the necessary calls to do so.

      It would be nice to provide some warning if we encounter a problematic
      device with a kernel which doesn't support the new calls.  Unfortunately,
      I can't see a way to detect this case which won't either warn in far too
      many cases that will probably work, or which is horribly invasive.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a34944fe2e2457309bde74c1ffe3a1c60c6da018
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:58 2015 +1000

      spapr: override default ram size to 512MB

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Acked-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 076b35b5a56bca57c4aa41044ed304fe9c45d6c5
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:57 2015 +1000

      machine: add default_ram_size to machine class

      Machines types can have different requirement for default ram
      size. Introduce a member in the machine class and set the current
      default_ram_size to 128MB.

      For QEMUMachine types override the value during the registration of
      the machine and for MachineClass introduce the generic class init
      setting the default_ram_size.

      Add helpers [K,M,G,T,P,E]_BYTE for better readability and easy usage

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c5bc152bc399ae7ec8ac5227762e4320d0fd2d1c
  Author: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:56 2015 +1000

      spapr_pci: emit hotplug add/remove events during hotplug

      This uses extension of existing EPOW interrupt/event mechanism
      to notify userspace tools like librtas/drmgr to handle
      in-guest configuration/cleanup operations in response to
      device_add/device_del.

      Userspace tools that don't implement this extension will need
      to be run manually in response/advance of device_add/device_del,
      respectively.

      Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7454c7af91bdd60216e2b6eead827c012bb4d0d0
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:55 2015 +1000

      spapr_pci: enable basic hotplug operations

      This enables hotplug of PCI devices to a PHB. Upon hotplug we
      generate the OF-nodes required by PAPR specification and
      IEEE 1275-1994 "PCI Bus Binding to Open Firmware" for the
      device.

      We associate the corresponding FDT for these nodes with the DRC
      corresponding to the slot, which will be fetched via
      ibm,configure-connector RTAS calls by the guest as described by PAPR
      specification.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cf8c704d5a06e7b8327c65d19d0c342dc23fff84
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:54 2015 +1000

      pci: make pci_bar useable outside pci.c

      We need to work with PCI BARs to generate OF properties
      during PCI hotplug for sPAPR guests.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 62083979b0471ac07da6d94944bf12a9b18baa1f
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:53 2015 +1000

      spapr_pci: create DRConnectors for each PCI slot during PHB realize

      These will be used to support hotplug/unplug of PCI devices to the PCI
      bus associated with a particular PHB.

      We also set up device-tree properties in each PHBs initial FDT to
      describe the DRCs associated with them. This advertises to guests that
      each PHB is DR-capable device with physical hotpluggable slots, each
      managed by the corresponding DRC. This is necessary for allowing
      hotplugging of devices to it later via bus rescan or guest rpaphp
      hotplug module.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7619c7b00c90a39243f1229facde8c53a8fba921
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:52 2015 +1000

      spapr_pci: add dynamic-reconfiguration option for spapr-pci-host-bridge

      This option enables/disables PCI hotplug for a particular PHB.

      Also add machine compatibility code to disable it by default for machine
      types prior to pseries-2.4.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      [agraf: move commas for compat fields]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e4b798bb53447ba4608fc7e6ed91927bdb1c3d5d
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:51 2015 +1000

      spapr_drc: add spapr_drc_populate_dt()

      This function handles generation of ibm,drc-* array device tree
      properties to describe DRC topology to guests. This will by used
      by the guest to direct RTAS calls to manage any dynamic resources
      we associate with a particular DR Connector as part of
      hotplug/unplug.

      Since general management of boot-time device trees are handled
      outside of sPAPRDRConnector, we insert these values blindly given
      an FDT and offset. A mask of sPAPRDRConnector types is given to
      instruct us on what types of connectors entries should be generated
      for, since descriptions for different connectors may live in
      different parts of the device tree.

      Based on code originally written by Nathan Fontenot.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 79853e18d904b0a4bcef62701d48559688007c93
  Author: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:50 2015 +1000

      spapr_events: event-scan RTAS interface

      We don't actually rely on this interface to surface hotplug events, and
      instead rely on the similar-but-interrupt-driven check-exception RTAS
      interface used for EPOW events. However, the existence of this interface
      is needed to ensure guest kernels initialize the event-reporting
      interfaces which will in turn be used by userspace tools to handle these
      events, so we implement this interface here.

      Since events surfaced by this call are mutually exclusive to those
      surfaced via check-exception, we also update the RTAS event queue code
      to accept a boolean to mark/filter for events accordingly.

      Events of this sort are not currently generated by QEMU, but the interface
      has been tested by surfacing hotplug events via event-scan in place
      of check-exception.

      Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 31fe14d15d08d613ff38abb249911e98c7966b86
  Author: Nathan Fontenot <nfont@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:49 2015 +1000

      spapr_events: re-use EPOW event infrastructure for hotplug events

      This extends the data structures currently used to report EPOW events to
      guests via the check-exception RTAS interfaces to also include event types
      for hotplug/unplug events.

      This is currently undocumented and being finalized for inclusion in PAPR
      specification, but we implement this here as an extension for guest
      userspace tools to implement (existing guest kernels simply log these
      events via a sysfs interface that's read by rtas_errd, and current
      versions of rtas_errd/powerpc-utils already support the use of this
      mechanism for initiating hotplug operations).

      We also add support for queues of pending RTAS events, since in the
      case of hotplug there's chance for multiple events being in-flight
      at any point in time.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46503c2bc047bfe8c26440e17298fcbc59d7bbbe
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:48 2015 +1000

      spapr_rtas: add ibm, configure-connector RTAS interface

      This interface is used to fetch an OF device-tree nodes that describes a
      newly-attached device to guest. It is called multiple times to walk the
      device-tree node and fetch individual properties into a 'workarea'/buffer
      provided by the guest.

      The device-tree is generated by QEMU and passed to an sPAPRDRConnector during
      the initial hotplug operation, and the state of these RTAS calls is tracked by
      the sPAPRDRConnector. When the last of these properties is successfully
      fetched, we report as special return value to the guest and transition
      the device to a 'configured' state on the QEMU/DRC side.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ab316865db8ee97c53cd70c91b1b160c474102f8
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:47 2015 +1000

      spapr: add rtas_st_buffer_direct() helper

      This is similar to the existing rtas_st_buffer(), but for cases
      where the guest is not expecting a length-encoded byte array.
      Namely, for calls where a "work area" buffer is used to pass
      around arbitrary fields/data.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 886445a6ee808ee06533f9ecdf0f169c9ea83fbb
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu May 7 15:33:46 2015 +1000

      spapr_rtas: add get-sensor-state RTAS interface

      This interface allows a guest to read various platform/device sensors.
      initially, we only implement support necessary to support hotplug:
      reading of the dr-entity-sense sensor, which communicates the state of
      a hotplugged resource/device to the guest (EMPTY/PRESENT/UNUSABLE).

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8c8639df32f19d5ca9bf6a823ac83e298a188fd1
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu May 7 15:33:45 2015 +1000

      spapr_rtas: add set-indicator RTAS interface

      This interface allows a guest to control various platform/device
      sensors. Initially, we only implement support necessary to control
      sensors that are required for hotplug: DR connector indicators/LEDs,
      resource allocation state, and resource isolation state.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 094d20585ecdcd31959b1b88a390b4d2c4cfeab7
  Author: Nathan Fontenot <nfont@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:44 2015 +1000

      spapr_rtas: add get/set-power-level RTAS interfaces

      These interfaces manage the power domains that guest devices are
      assigned to and are used to power on/off devices. Currently we
      only utilize 1 power domain, the 'live-insertion' domain, which
      automates power management of plugged/unplugged devices, essentially
      making these calls no-ops, but the RTAS interfaces are still required
      by guest hotplug code and PAPR+.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      these interfaces.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bbf5c878ab76a74f6277f99082c77bbdb1ad4c5b
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:43 2015 +1000

      spapr_drc: initial implementation of sPAPRDRConnector device

      This device emulates a firmware abstraction used by pSeries guests to
      manage hotplug/dynamic-reconfiguration of host-bridges, PCI devices,
      memory, and CPUs. It is conceptually similar to an SHPC device,
      complete with LED indicators to identify individual slots to physical
      physical users and indicate when it is safe to remove a device. In
      some cases it is also used to manage virtualized resources, such a
      memory, CPUs, and physical-host bridges, which in the case of pSeries
      guests are virtualized resources where the physical components are
      managed by the host.

      Guests communicate with these DR Connectors using RTAS calls,
      generally by addressing the unique DRC index associated with a
      particular connector for a particular resource. For introspection
      purposes we expose this state initially as QOM properties, and
      in subsequent patches will introduce the RTAS calls that make use of
      it. This constitutes to the 'guest' interface.

      On the QEMU side we provide an attach/detach interface to associate
      or cleanup a DeviceState with a particular sPAPRDRConnector in
      response to hotplug/unplug, respectively. This constitutes the
      'physical' interface to the DR Connector.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 11eec063f29733395846ba756ecd544876ef6839
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:42 2015 +1000

      docs: add sPAPR hotplug/dynamic-reconfiguration documentation

      This adds a general overview of hotplug/dynamic-reconfiguration
      for sPAPR/pSeries guest.

      As specified in PAPR+ v2.7.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 730fce593bbaa9240a0be860616ac4366113194d
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:41 2015 +1000

      hw/ppc/spapr: Use error_report() instead of hw_error()

      hw_error() is designed for printing CPU-related error messages
      (e.g. it also prints a full CPU register dump). For error messages
      that are not directly related to CPU problems, a function like
      error_report() should be used instead.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 68fea5a0d7bac17fd74f0608ceed1d914eb0718e
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:40 2015 +1000

      hw/ppc/spapr: Fix error message when firmware could not be loaded

      When specifying a non-existing file with the "-bios" parameter, QEMU
      complained that it "could not find LPAR rtas". That's obviously a
      copy-n-paste bug from the code which loads the spapr-rtas.bin, it
      should complain about a missing firmware file instead.
      Additionally the error message was printed with hw_error() - which
      also dumps the whole CPU state. However, this does not make much
      sense here since the CPU is not running yet and thus the registers
      only contain zeroes. So let's use error_report() here instead.
      And while we're at it, let's also bail out if the firmware file
      had zero length.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1a45612433edb0eb65c468f7ed579cd92358818
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu May 7 15:33:39 2015 +1000

      pseries: Add pseries-2.4 machine type

      Now that 2.4 development has opened, create a new pseries machine type
      variant.  For now it is identical to the pseries-2.3 machine type, but
      a number of new features are coming that will need to set backwards
      compatibility options.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f9ce8e0aa3fb55ae7a8ea34d3169e73e87feb337
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:38 2015 +1000

      hw/ppc/spapr_iommu: Fix the check for invalid upper bits in liobn

      The check "liobn & 0xFFFFFFFF00000000ULL" in spapr_tce_find_by_liobn()
      is completely useless since liobn is only declared as an uint32_t
      parameter. Fix this by using target_ulong instead (this is what most
      of the callers of this function are using, too).

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit dea1b3ce756d7242d4212c22b7d6e6a896495154
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:37 2015 +1000

      spapr_iommu: Give unique QOM name to TCE table

      Useful for debugging.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ccf9ff8527a87ee485fbb6a0a73d28641cab5f60
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:36 2015 +1000

      spapr_pci: Rework device-tree rendering

      This replaces object_child_foreach() and callback with existing
      SPAPR_PCI_LIOBN() and spapr_tce_find_by_liobn() to make the code easier
      to read.

      This is a mechanical patch so no behaviour change is expected.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fae807a2b182a613798fe619f9069bd0bbe3dc6a
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:35 2015 +1000

      spapr_iommu: Make spapr_tce_find_by_liobn() public

      At the moment spapr_tce_find_by_liobn() is used by H_PUT_TCE/...
      handlers to find an IOMMU by LIOBN.

      We are going to implement Dynamic DMA windows (DDW), new code
      will go to a new file and we will use spapr_tce_find_by_liobn()
      there too so let's make it public.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46c5874e9cd752ed8ded31af03472edd8fc3efc1
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:34 2015 +1000

      spapr_pci: Make find_phb()/find_dev() public

      This makes find_phb()/find_dev() public and changed its names
      to spapr_pci_find_phb()/spapr_pci_find_dev() as they are going to
      be used from other parts of QEMU such as VFIO DDW (dynamic DMA window)
      or VFIO PCI error injection or VFIO EEH handling - in all these
      cases there are RTAS calls which are addressed to BUID+config_addr
      in IEEE1275 format.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d9d96a3cc7267880fbccb6bc4018fc31909fc930
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:33 2015 +1000

      spapr_iommu: Add separate trace points for PCI DMA operations

      This is to reduce VIO noise while debugging PCI DMA.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e1a01cb554412e8a9c25573126356596dc0c50f
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:32 2015 +1000

      spapr_pci: Define default DMA window size as a macro

      This gets rid of a magic constant describing the default DMA window size
      for an emulated PHB.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4290ca49eed5e239695ce85c925a770e4a7317a6
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:31 2015 +1000

      spapr_vio: Introduce a liobn number generating macros

      This introduces a macro which makes up a LIOBN from fixed prefix and
      VIO device address (@reg property).

      This is to keep LIOBN macros rendering consistent - the same macro for
      PCI has been added by the previous patch.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c8545818b331e9a32e5dd47f0aefbcf2b93e41da
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:30 2015 +1000

      spapr_pci: Introduce a liobn number generating macros

      We are going to have multiple DMA windows per PHB and we want them to
      migrate so we need a predictable way of assigning LIOBNs.

      This introduces a macro which makes up a LIOBN from fixed prefix,
      PHB index (unique PHB id) and window number.

      This introduces a SPAPR_PCI_DMA_WINDOW_NUM() to know the window number
      from LIOBN. It is used to distinguish the default 32bit windows from
      dynamic windows and avoid picking default DMA window properties from
      a wrong TCE table.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f1215ea702e6e6cb3876221cf1f7f60133e08c30
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:29 2015 +1000

      spapr_iommu: Make H_PUT_TCE_INDIRECT endian-safe

      PAPR is defined as big endian so TCEs need an adjustment so
      does this patch.

      This changes code to have ldq_be_phys() in one place.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 12fd28535891572be7aaf862a03019257dafa425
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:28 2015 +1000

      spapr_iommu: Disable in-kernel IOMMU tables for >4GB windows

      The existing KVM_CREATE_SPAPR_TCE ioctl only support 4G windows max as
      the window size parameter to the kernel ioctl() is 32-bit so
      there's no way of expressing a TCE window > 4GB.

      We are going to add huge DMA windows support so this will create small
      window and unexpectedly fail later.

      This disables KVM_CREATE_SPAPR_TCE for windows bigger that 4GB.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 421b1b27f6e9135ac8f01db219e0d8c0cefd7e71
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Mar 19 15:14:18 2015 +1100

      spapr_pci: Fix unsafe signed/unsigned comparisons

      spapr_pci.c contains a number of expressions of the form (uval == -1) or
      (uval != -1), where 'uval' is an unsigned value.

      This mostly works in practice, because as long as the width of uval is
      greater or equal than that of (int), the -1 will be promoted to the
      unsigned type, which is the expected outcome.

      However, at least for the cases where uval is uint32_t, this would break
      on platforms where sizeof(int) > 4 (and a few such do exist), because then
      the uint32_t value would be promoted to the larger int type, and never be
      equal to -1.

      This patch fixes these errors.  The fixes for the (uint32_t) cases are
      necessary as described above.  I've made similar fixes to (uint64_t) and
      (hwaddr) cases.  Those are strictly theoretical, since I don't know of any
      platforms where sizeof(int) > 8, but hey, it's not that hard so we might
      as well be strictly C standard compliant.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 31ce0adb79655003465070fa90d7d20a5b8c2ff5
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon May 18 12:59:49 2015 +0200

      configure: Check for libfdt version 1.4.0

      Some recent patches require a function from libfdt version 1.4.0,
      so we should check for this version during the configure step
      already. Unfortunately, there does not seem to be a proper #define
      for the version number in the libfdt headers. So alternatively,
      we check for the availability of the required function
      fdt_get_property_by_offset() instead instead.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28f490b24af83a007937daacb9ea8bf7537f9084
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon May 18 12:59:48 2015 +0200

      dtc: Update dtc / libfdt submodule to version 1.4.0

      Since some recent patches require libfdt version 1.4.0,
      let's update the dtc submodule to this version.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 62e9cd771cc368a8fd0f152832b78c43557897a9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 08:46:15 2015 +0100

      macio: Convert to realize()

      Convert device models "macio-oldworld" and "macio-newworld".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 814550d73a94dcf9f2c9f8d2ee280226f1145388
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:12 2015 +0300

      docs: Add PXB documentation

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0f6dd8e1d514b8c24689499ed72ea89fd0d967f3
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:11 2015 +0300

      apci: fix PXB behaviour if used with unsupported BIOS

      PXB does not work with unsupported bioses, but should
      not interfere with normal OS operation.
      We don't ship them anymore, but it's reasonable
      to keep the work-around until we update the bios in qemu.

      Fix this by not adding PXB mem/IO chunks to _CRS
      if they weren't configured by BIOS.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0e79e51a7dcbd4fde5738d713b60f0fb0321f1af
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:10 2015 +0300

      hw/pxb: add numa_node parameter

      The pxb can be attach to and existing numa node by specifying
      numa_node option that equals the desired numa nodeid.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 6a3042b23bbb1fa92c00ea9267c830e7f2e99313
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:09 2015 +0300

      hw/pci: add support for NUMA nodes

      PCI root buses can be attached to a specific NUMA node.
      PCI buses are not attached by default to a NUMA node.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0639b00d055b313930c23c4d6c9ebfb4af61c00c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:08 2015 +0300

      hw/pxb: add map_irq func

      The bios does not index the pxb slot number when
      it computes the IRQ because it resides on bus 0
      and not on the current bus.
      However Qemu routes the irq through bus 0 and adds
      the pxb slot to the IRQ computation of the PXB device.

      Synchronize between bios and Qemu by canceling
      pxb's effect.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 2118196bb3795a43bf708c37bdcf4b3c33778ccb
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:07 2015 +0300

      hw/pci: inform bios if the system has extra pci root buses

      The bios looks for 'etc/extra-pci-roots' to decide if
      is going to scan further buses after bus 0 tree.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 40d14bef8012087ade60f254487d31db822a1a44
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:06 2015 +0300

      hw/pci: introduce PCI Expander Bridge (PXB)

      PXB is a "light-weight" host bridge whose purpose is to enable
      the main host bridge to support multiple PCI root buses
      for pc machines.

      As oposed to PCI-2-PCI bridge's secondary bus, PXB's bus
      is a primary bus and can be associated with a NUMA node
      (different from the main host bridge) allowing the guest OS
      to recognize the proximity of a pass-through device to
      other resources as RAM and CPUs.

      The PXB is composed from:
       - A primary PCI bus (can be associated with a NUMA node)
         Acts like a normal pci bus and from the functionality point
         of view is an "expansion" of the bus behind the
         main host bridge.
       - A pci-2-pci bridge behind the primary PCI bus where the actual
         devices will be attached.
       - A host-bridge PCI device
         Situated on the bus behind the main host bridge, allows
         the BIOS to configure the bus number and IO/mem resources.
         It does not have its own config/data register for configuration
         cycles, this being handled by the main host bridge.
      -  A host-bridge sysbus to comply with QEMU current design.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit cb2ed8b3c66284f226c523231e2c09e60bbb34bb
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:05 2015 +0300

      hw/pci: removed 'rootbus nr is 0' assumption from qmp_pci_query

      Use the newer pci_bus_num to correctly get the root bus number.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit dcdca29655f774568f30a82b7fe0190b4bd38802
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:04 2015 +0300

      hw/acpi: remove from root bus 0 the crs resources used by other buses.

      If multiple root buses are used, root bus 0 cannot use all the
      pci holes ranges. Remove the IO/mem ranges used by the other
      primary buses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit a43c6e276231e8040203940cb07be00387686e87
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:03 2015 +0300

      hw/acpi: add _CRS method for extra root busses

      Save the IO/mem/bus numbers ranges assigned to the extra root busses
      to be removed from the root bus 0 range.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0d8935e3370e07f57651e43d2de9011d75c2a066
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:02 2015 +0300

      hw/apci: add _PRT method for extra PCI root busses

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit a4894206e3672f8a5e5443d72b705495e022b638
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:01 2015 +0300

      hw/acpi: add support for i440fx 'snooping' root busses

      If the machine has extra root busses that are snooping to
      the i440fx host bridge, we need to add them to
      acpi in order to be properly detected by guests.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 09e5b81922179b6c52b42fd27587e64b474036c7
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:00 2015 +0300

      hw/pci: extend PCI config access to support devices behind PXB

      PXB buses are assumed to be children of bus 0. Look for them
      while scanning the buses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ca6c18556c5e9c4aac12489b960c3e4601e183bf
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:22:59 2015 +0300

      hw/i386: query only for q35/pc when looking for pci host bridge

      Because of the PXB hosts we cannot simply query TYPE_PCI_HOST_BRIDGE anymore.
      On i386 arch we only have two pci hosts, so we can look only for them.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 602141d9974d726063907851528c89d617730156
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:22:58 2015 +0300

      hw/pci: made pci_bus_num a PCIBusClass method

      Refactoring it as a method of PCIBusClass will allow
      different implementations for subclasses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ce6a28ee057da3e4a587dada369e33a8486b0066
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:22:57 2015 +0300

      hw/pci: made pci_bus_is_root a PCIBusClass method

      Refactoring it as a method of PCIBusClass will allow
      different implementations for subclasses.

      Removed the assumption that the root bus does not
      have a parent device because is specific only
      to the default class implementation.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 32d9ca15bac63e8a7bad6dc1a4ab624e6d6d3b0f
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:22:56 2015 +0300

      acpi: add implementation of aml_while() term

      Commit 68e6b0af7 (acpi: add aml_while() term) added
      the definition of aml_while without the actual implementation.
      Implement the term.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ca9b46bcecc0f06882eec1b152b71f93a066da79
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Wed May 13 17:21:36 2015 +0800

      acpi: add acpi_send_gpe_event() to rise sci for hotplug

      Add a new API named acpi_send_gpe_event() to send hotplug SCI.
      This API can be used by pci, cpu and memory hotplug.

      This patch is rebased on master.

      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit d5aaa1b0456033fc9ff723ac881ebe1b61360cca
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 3 14:47:19 2015 +0200

      virtio: 64bit features fixups.

      Commit "019a3ed virtio: make features 64bit wide" missed a few changes,
      as I've noticed while trying to rebase the virtio-1 branch to latest
      master.  This patch adds them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 977ad992f14b29a7d4f18eaba42a705004545a64
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Jun 2 15:47:20 2015 +0200

      TPM: fix build with tpm disabled

      Failure was included on commit

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6652d0811c9463fbfb2d2d1cb2ec03f388145c5f
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Wed May 27 16:26:07 2015 +0800

      virtio-pci: don't try to mask or unmask vqs without notifiers

      We should validate the vq index against nvqs_with_notifiers. Otherwise we may
      try to mask or unmask vector for vqs without notifiers (e.g control vq). This
      will lead qemu abort on kvm_irqchip_commit_routes() when trying to boot win8.1
      guest.

      Fixes 851c2a75a6e80c8aa5e713864d98cfb512e7229b ("virtio-pci: speedup MSI-X
      masking and unmasking")

      Reported-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 557772f26b361ade84acecb366fe6fdd2d55a6d9
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon Jun 1 17:09:12 2015 +0300

      hw/q35: fix floppy controller definition in ich9

      In DSDT FDC0 declares the IO region as IO(Decode16, 0x03F2, 0x03F2, 0x00, 0x04).
      Use the same in lpc_ich9 initialization code.
      Now the floppy drive is detected correctly on Windows.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cb3d37a93cc59da400d27361fcda024d49210abd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 1 21:03:59 2015 +0200

      acpi: add missing ssdt

      commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
          TPM2 ACPI table support

      was missing a file, so build with iasl fails
      (build without iasl works since it uses the generated
       hex files).

      Reported-by: "Daniel P. Berrange" <berrange@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b853d4cbf2062813e84f9bb880feff8daf467e05
  Author: Sascha Silbe <silbe@linux.vnet.ibm.com>
  Date:   Tue Jun 2 18:51:00 2015 +0200

      s390x/kvm: always ignore empty vcpu interrupt state

      kvm_s390_vcpu_interrupt_pre_save() and
      kvm_s390_vcpu_interrupt_post_load() are essentially no-ops on hosts
      without KVM_CAP_S390_IRQ_STATE. Move the capability check after the
      check for saved IRQ state in kvm_s390_vcpu_interrupt_post_load() so that
      migration between hosts without KVM_CAP_S390_IRQ_STATE (including save /
      restore on the same host) continues to work.

      Fixes: 3cda44f7bae5 ("s390x/kvm: migrate vcpu interrupt state")
      Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 2a72ea5f66b3b87a975475bdc1cabacbbb402937
  Author: Jason J. Herne <jjherne@linux.vnet.ibm.com>
  Date:   Wed Jun 3 11:04:03 2015 -0400

      virtio-ccw/migration: Migrate config vector for virtio devices

      virtio_ccw_{save|load}_config are missing code to save and restore a vdev's
      config_vector value. This causes some virtio devices to become disabled
      following a migration.

      This patch fixes a bug whereby the qmp/hmp balloon command (virsh setmem)
      silently fails to update the guest's available memory because the device was not
      properly migrated.

      This will break compatibility, but vmstate_s390_cpu was bumped from
      version 2 to version 4 between v2.3.0 and v2.4.0 without a compat
      handler. Furthermore, there is no production environment yet so
      migration is fenced anyway between any relevant version of 2.3 and 2.4.

      Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Message-Id: <1433343843-803-1-git-send-email-jjherne@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit de6a92185e3ac25ba7d37f03e579b1fc72e70162
  Author: Pierre Morel <pmorel@linux.vnet.ibm.com>
  Date:   Wed May 27 13:11:59 2015 +0200

      virtio-ccw: add support for 9pfs

      This patch adds 9pfs support for virtio-ccw
      by registering the virtio_ccw_9p_info type
      and adding associated callbacks.

      Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit de3852877f1e452321352fdb7e678f079876a41b
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Jun 3 09:56:37 2015 +0100

      configure: postfix --extra-cflags to QEMU_CFLAGS

      It makes sense that extra-cflags should be appended after the normal
      CFLAGS so they don't get overridden by default behaviour. This way if
      you specify something like:

        ./configure --extra-cflags="-O0"

      You will see the requested behaviour.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2801339f2fb2534ccf01561d274398328bdd446d
  Author: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
  Date:   Fri May 29 11:52:35 2015 +0530

      cadence_gem: Fix Rx buffer size field mask

      This patch corrects the Rx buffer size field mask to mask bits 23 to 16
      to match Xilinx UG585 documentation.

      Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu May 28 14:12:26 2015 +0300

      slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)

      In this version I used mkdtemp(3) which is:

              _BSD_SOURCE
              || /* Since glibc 2.10: */
                  (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)

      (POSIX.1-2008), so should be available on systems we care about.

      While at it, reset the resulting directory name within smb structure
      on error so cleanup function wont try to remove directory which we
      failed to create.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit b6b099541d6cf3c50b0fb5af916fff0db6508805
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jun 1 09:53:55 2015 +0200

      translate-all: delete prototype for non-existent function

      Missed in commit 3a808cc40

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1597051b84b816c9608e1ee0947f8e6dc9876b56
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri May 29 19:52:52 2015 +0100

      Add -incoming help text

      The help/man text for

      -incoming defer

      didn't make it through the merge of the code that implemented it.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 26c8acb3f326166bf9dc60c3e8184f4b862e8451
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:11 2015 +0800

      hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 294972ce546107f2215b3b162994b47f08aab7a4
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:10 2015 +0800

      hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5429273615e7b412402a7b22738737c09ab9f488
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:09 2015 +0800

      hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c85fad022a5c23b835d7c78b653763ae1e3f6eb
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:08 2015 +0800

      hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a9c8a0d8d4217754648decc5921e4b0fcd00ce7f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:07 2015 +0800

      hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d4ef00af2598fef06affbd42608e570237a7b276
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:06 2015 +0800

      hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aaaee0b273082ee2836dcc2f61a878ee291a8d9b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:05 2015 +0800

      hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ca43b97b5f6fa57e79adc7f167b12d3e0545c7e1
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:04 2015 +0800

      hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b64127244d669c33a4ffdcc47e076559497785af
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:02 2015 +0800

      hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5105505e65ba6bc3e1dc549bcd0d1d33f3546e60
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:01 2015 +0800

      hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aff0d5e57a71260885d54c07cef5f4a486c8336b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:00 2015 +0800

      hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irq

      Since ich9_lpc_pm_init only requests one irq, so let it just call
      qemu_allocate_irq.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0b0cc076b78976b30360dd7c6ed994f864424779
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:26:59 2015 +0800

      hw/i386/pc: Fix misusing qemu_allocate_irqs for single irq

      Since pc_allocate_cpu_irq only requests one irq, so let it just call
      qemu_allocate_irq.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9ff7f5bddbe5814bafe5e798d2cf1087b58dc7b6
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:03 2015 +0800

      hw/intc/exynos4210_gic.c: Fix memory leak by adjusting order

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9f9b026dc60398224fb035eb27ae0ed083d2d66f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:38:34 2015 +0800

      hw/arm/omap_sx1.c: Fix memory leak spotted by valgrind

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f19377bf234a3359b0a03844822e97de80ad4f30
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 20:39:43 2015 +0800

      hw/ppc/e500.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c18f855697ab6b64a895f37cf47fd7061ce9e798
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 20:39:42 2015 +0800

      hw/alpha/dp264.c: Fix memory leak spotted by valgrind

      valgrind complains about:
      ==7055== 58 bytes in 1 blocks are definitely lost in loss record 1,471 of 2,192
      ==7055==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==7055==    by 0x24410F: malloc_and_trace (vl.c:2556)
      ==7055==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DEFD7: g_strndup (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x650181A: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DF0CC: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DF188: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x242F81: qemu_find_file (vl.c:2121)
      ==7055==    by 0x217A32: clipper_init (dp264.c:105)
      ==7055==    by 0x2484DA: main (vl.c:4249)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bd4baf6eebff75c7e0c67a729d1bdb5b0b36fe72
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 25 14:47:25 2015 +0800

      vl: fix memory leak spotted by valgrind

      valgrind complains about:
      ==9276== 13 bytes in 1 blocks are definitely lost in loss record 1,046 of 3,673
      ==9276==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==9276==    by 0x2EAFBB: malloc_and_trace (vl.c:2556)
      ==9276==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==9276==    by 0x4A28BD: addr_to_string (vnc.c:123)
      ==9276==    by 0x4A29AD: vnc_socket_local_addr (vnc.c:139)
      ==9276==    by 0x4A9AFE: vnc_display_local_addr (vnc.c:3240)
      ==9276==    by 0x2EF4FE: main (vl.c:4321)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7df057bac3734ee3c2c052fd0807479602ab5583
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 13:20:14 2015 -0700

      device-tree: Make a common-obj

      There is no reason for device tree API to be built per-target.
      common-obj it. There is an extraneous inclusion of config.h that
      needs to be removed.

      Cc: Alexander Graf <agraf@suse.de>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d370dfa9f3703cf0af07d96d50ed567413e8ec65
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:07 2015 +0800

      hw/i386/acpi-build: decref after use

      valgrind complains about:
      ==16447== 48 bytes in 2 blocks are definitely lost in loss record 2,033 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x53EC3F: qint_from_int (qint.c:33)
      ==16447==    by 0x53B426: qmp_output_type_int (qmp-output-visitor.c:162)
      ==16447==    by 0x539257: visit_type_uint32 (qapi-visit-core.c:147)
      ==16447==    by 0x471D07: property_get_uint32_ptr (object.c:1651)
      ==16447==    by 0x47000C: object_property_get (object.c:822)
      ==16447==    by 0x472428: object_property_get_qobject (qom-qobject.c:37)
      ==16447==    by 0x25701A: build_append_pci_bus_devices (acpi-build.c:520)
      ==16447==    by 0x25902E: build_ssdt (acpi-build.c:1004)
      ==16447==    by 0x25A0A8: acpi_build (acpi-build.c:1420)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6e38a4ba7889083b65729db2144cdbcefbaa303a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:06 2015 +0800

      hw/ide/pci: Fix memory leak

      valgrind complains about:
      ==16447== 16 bytes in 2 blocks are definitely lost in loss record 1,304 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x3B4B44: bmdma_init (pci.c:464)
      ==16447==    by 0x3B547B: pci_piix_init_ports (piix.c:144)
      ==16447==    by 0x3B55D2: pci_piix_ide_realize (piix.c:164)
      ==16447==    by 0x3EAEC6: pci_qdev_realize (pci.c:1790)
      ==16447==    by 0x36C685: device_set_realized (qdev.c:1058)
      ==16447==    by 0x47179E: property_set_bool (object.c:1514)
      ==16447==    by 0x470098: object_property_set (object.c:837)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ba154cf4eb8636cdd3aa90f392ca9e77206ca39
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:05 2015 +0800

      hw/i386/pc_piix: Fix memory leak

      valgrind complains about:
      ==16447== 8 bytes in 1 blocks are definitely lost in loss record 552 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x24E622: pc_init1 (pc_piix.c:287)
      ==16447==    by 0x24E76A: pc_init_pci (pc_piix.c:310)
      ==16447==    by 0x2E9360: main (vl.c:4226)

      ==16447== 128 bytes in 1 blocks are definitely lost in loss record 2,569 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x25BEB2: kvm_i8259_init (i8259.c:133)
      ==16447==    by 0x24E1F1: pc_init1 (pc_piix.c:219)
      ==16447==    by 0x24E76A: pc_init_pci (pc_piix.c:310)
      ==16447==    by 0x2E9360: main (vl.c:4226)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5708b2b736ebec6e3af04b9b249faadf896791cd
  Author: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
  Date:   Tue May 26 05:25:41 2015 -0400

      docs/writing-qmp-commands: fix a typo

      s/interation/iteration

      Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b8981dc9aae25fa79e5f35609e63f50f078a572d
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Fri May 15 11:31:43 2015 +0200

      util: socket: Add missing localaddr and localport option for DGRAM socket

      The 'socket_optslist' structure does not contain the 'localaddr' and
      'localport' options that are parsed in case you are creating a
      'connect' type UDP character device.

      I've noticed it happening after commit f43e47dbf6de24db20ec9b588bb6cc762
      made qemu abort() after seeing the invalid option.

      A minimal reproducer for the case is:
      $ qemu-system-x86_64 -chardev udp,id=charrng0,host=127.0.0.1,port=1234,localaddr=,localport=1234
      qemu-system-x86_64: -chardev udp,id=charrng0,host=127.0.0.1,port=1234,localaddr=,localport=1234: Invalid parameter 'localaddr'
      Aborted (core dumped)

      Prior to the commit mentioned above the error would be printed but the
      value for localaddr and localport was simply ignored. I did not go
      through the code to find out when it was broken.

      Add the two fields so that the options can again be parsed correctly and
      qemu doesn't abort().

      Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1220252

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a2f533da00f7278788afcf10f325f636805077dc
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu May 14 22:33:39 2015 -0700

      microblaze: cpu: Delete MMAP_SHIFT definition

      Just fallback on the default of 12 like other architectures. This
      allows changing the system-mode-affecting definition of
      TARGET_PAGE_BITS without affecting microblaze linux-user.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 44f192f364b71683379e104157b15b0685d24394
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:15:28 2015 +0000

      iscsi: Remove pointless runtime check of macro value

      raw_bsd already has QEMU_BUILD_BUG_ON(BDRV_SECTOR_SIZE != 512), so iscsi
      should relax.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1b93c9a1040b3c12320cf55c6284882a2e6e8ff3
  Author: Ikey Doherty <michael.i.doherty@intel.com>
  Date:   Tue May 26 13:54:06 2015 +0100

      arch_init: Drop target-x86_64.conf

      The target-x86_64.conf sysconfig file has been empty and essentially ignored
      now for several years. This change removes the unused file to enable moving
      towards a stateless configuration.

      Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 38e5c119c2925812bd441450ab9e5e00fc79e662
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Mar 23 17:29:32 2015 -0300

      target-i386: Register QOM properties for feature flags

      This uses the feature name arrays to register QOM properties for feature
      flags. This simply adds properties that can be configured using -global,
      but doesn't change x86_cpu_parse_featurestr() to use them yet.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit be9f8a08727e46c790adb8caa8a4525a1e8e9e73
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Wed May 20 10:40:47 2015 +0800

      apic: convert ->busdev.qdev casts to C casts

      Use C casts to avoid accessing ICCDevice's qdev field
      directly.

      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 458cf469f4a1cb520b07092f5537c5a6d2389d23
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 29 16:31:12 2015 -0300

      target-i386: Fix signedness of MSR_IA32_APICBASE_BASE

      Existing definition triggers the following when using clang
      -fsanitize=undefined:

          hw/intc/apic_common.c:314:55: runtime error: left shift of 1048575 by 12
              places cannot be represented in type 'int'

      Fix it so we won't try to shift a 1 to the sign bit of a signed integer.

      Suggested-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0e3bd56294230ad0ee20fce587879c29a83a0d8b
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 17 17:46:36 2015 +0100

      pc: Ensure non-zero CPU ref count after attaching to ICC bus

      Setting the parent bus of a device increases its ref count, which we
      ultimately want to level out. However it is only safe to do so after the
      last reference to the device in local code, as qom-set or similar operations
      might decrease the ref count.

      Therefore move the object_unref() from pc_new_cpu() into its callers.

      The APIC operations on the last CPU in pc_cpus_init() are still potentially
      insecure, but that is beyond the scope of this code movement.

      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 4964e18e490f3ecad35c9e4cc9b613316a98755e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:38 2015 +0200

      fdc-test: Test state for existing cases more thoroughly

      This just adds a few additional checks of the MSR and interrupt pin to
      the already existing test cases.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-9-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 6cc8a11c84ddc18c64fc88d54c8e9dca24ada489
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:37 2015 +0200

      fdc: Fix MSR.RQM flag

      The RQM bit in MSR should be set whenever the guest is supposed to
      access the FIFO, and it should be cleared in all other cases. This is
      important so the guest can't continue writing/reading the FIFO beyond
      the length that it's suppossed to access (see CVE-2015-3456).

      Commit e9077462 fixed the CVE by adding code that avoids the buffer
      overflow; however it doesn't correct the wrong behaviour of the floppy
      controller which should already have cleared RQM.

      Currently, RQM stays set all the time and during all phases while a
      command is being processed. This is error-prone because the command has
      to explicitly clear the flag if it doesn't need data (and indeed, the
      two buggy commands that are the culprits for the CVE just forgot to do
      that).

      This patch clears RQM immediately as soon as all bytes that are expected
      have been received. If the the FIFO is used in the next phase, the flag
      has to be set explicitly there.

      It also clear RQM after receiving all bytes even if the phase transition
      immediately sets it again. While it's technically not necessary at the
      moment because the state between clearing and setting RQM is not
      observable by the guest, this is more explicit and matches how real
      hardware works. It will actually become necessary in qemu once
      asynchronous code paths are introduced.

      This alone should have been enough to fix the CVE, but now we have two
      lines of defense - even better.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit f6c2d1d8425fd0ca450d515b06821e2224d4b43c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:36 2015 +0200

      fdc: Disentangle phases in fdctrl_read_data()

      This commit makes similar improvements as have already been made to the
      write function: Instead of relying on a flag in the MSR to distinguish
      controller phases, use the explicit phase that we store now. Assertions
      of the right MSR flags are added.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit d275b33d76c8ed9d5a3dca22ea0fdec8d5a5c8e6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:35 2015 +0200

      fdc: Code cleanup in fdctrl_write_data()

      Factor out a few common lines of code, reformat, improve comments.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 5b0a25e8d2f15f89255c745c71d297b5b24d138c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:34 2015 +0200

      fdc: Use phase in fdctrl_write_data()

      Instead of relying on a flag in the MSR to distinguish controller phases,
      use the explicit phase that we store now. Assertions of the right MSR
      flags are added.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 85d291a08c91c07927bbbd29f72a27d3ad7478f3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:33 2015 +0200

      fdc: Introduce fdctrl->phase

      The floppy controller spec describes three different controller phases,
      which are currently not explicitly modelled in our emulation. Instead,
      each phase is represented by a combination of flags in registers.

      This patch makes explicit in which phase the controller currently is.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 83a260135f13db8b5d7df72090864a5ebcef2845
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:32 2015 +0200

      fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()

      What callers really do with this function is to switch from execution
      phase (including data transfers) to result phase where the guest can
      read out one or more status bytes from the FIFO (the number depends on
      the command).

      Rename the function accordingly.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 07e415f2398d9cfb21cdd5ef902445032ba54556
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:31 2015 +0200

      fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()

      What all callers of fdctrl_reset_fifo() really want to do is to start
      the command phase, where writes to the data port initiate a new command.

      The function doesn't only clear the FIFO, but also sets up the state so
      that a new command can be received. Rename it to reflect this.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-2-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit a67bfbb9e41e089caec61384c625e8a61a5f270f
  Merge: 42d58e7 489653b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 18:23:28 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-02' into staging

      Monitor patches

      # gpg: Signature made Tue Jun  2 09:16:07 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-06-02: (21 commits)
        monitor: Change return type of monitor_cur_is_qmp() to bool
        monitor: Rename monitor_ctrl_mode() to monitor_is_qmp()
        monitor: Turn int command_mode into bool in_command_mode
        monitor: Drop do_qmp_capabilities()'s superfluous QMP check
        monitor: Unbox Monitor member mc and rename to qmp
        monitor: Rename monitor_control_read(), monitor_control_event()
        monitor: Rename handle_user_command() to handle_hmp_command()
        monitor: Limit QError use to command handlers
        monitor: Inline monitor_has_error() into its only caller
        monitor: Wean monitor_protocol_emitter() off mon->error
        monitor: Propagate errors through invalid_qmp_mode()
        monitor: Propagate errors through qmp_check_input_obj()
        monitor: Propagate errors through qmp_check_client_args()
        monitor: Drop unused "new" HMP command interface
        monitor: Use trad. command interface for HMP pcie_aer_inject_error
        monitor: Use traditional command interface for HMP device_add
        monitor: Use traditional command interface for HMP drive_del
        monitor: Convert client_migrate_info to QAPI
        monitor: Improve and document client_migrate_info protocol error
        monitor: Clean up after previous commit
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 42d58e7c6760cb9c55627c28ae538e27dcf2f144
  Merge: 3fc827d c25bbf1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 16:47:31 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-15-06-02-tag' into staging

      XSA 128 129 130 131

      # gpg: Signature made Tue Jun  2 16:46:38 2015 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-15-06-02-tag:
        xen/pt: unknown PCI config space fields should be read-only
        xen/pt: add a few PCI config space field descriptions
        xen/pt: mark reserved bits in PCI config space fields
        xen/pt: mark all PCIe capability bits read-only
        xen/pt: split out calculation of throughable mask in PCI config space handling
        xen/pt: correctly handle PM status bit
        xen/pt: consolidate PM capability emu_mask
        xen/MSI: don't open-code pass-through of enable bit modifications
        xen/MSI-X: limit error messages
        xen: don't allow guest to control MSI mask register
        xen: properly gate host writes of modified PCI CFG contents

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 94edf02c4c94781fa777c459fe86b52131b83cb6
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:14 2015 +0100

      hw/arm/virt: change indentation in a15memmap

      Re-indent in a15memmap after VIRT_PLATFORM_BUS introduction

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1433244554-12898-5-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f7a5a0edc4a2f65293658eb540290ddf9a1988a
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:13 2015 +0100

      hw/arm/virt: add dynamic sysbus device support

      Allows sysbus devices to be instantiated from command line by
      using -device option. Machvirt creates a platform bus at init.
      The dynamic sysbus devices are attached to this platform bus device.

      The platform bus device registers a machine init done notifier
      whose role will be to bind the dynamic sysbus devices. Indeed
      dynamic sysbus devices are created after machine init.

      machvirt also registers a notifier that will build the device
      tree nodes for the platform bus and its children dynamic sysbus
      devices.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-4-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac9d32e39664e060cd1b538ff190980d57ad69e4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:12 2015 +0100

      hw/arm/boot: arm_load_kernel implemented as a machine init done notifier

      Device tree nodes for the platform bus and its children dynamic sysbus
      devices are added in a machine init done notifier. To load the dtb once,
      after those latter nodes are built and before ROM freeze, the actual
      arm_load_kernel existing code is moved into a notifier notify function,
      arm_load_kernel_notify. arm_load_kernel now only registers the
      corresponding notifier.

      Machine files that do not support platform bus stay unchanged. Machine
      files willing to support dynamic sysbus devices must call arm_load_kernel
      before sysbus-fdt arm_register_platform_bus_fdt_creator to make sure
      dynamic sysbus device nodes are integrated in the dtb.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-3-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c25bbf1545a53ac051f9e51d4140e397660c10ae
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: unknown PCI config space fields should be read-only

      ... by default. Add a per-device "permissive" mode similar to pciback's
      to allow restoring previous behavior (and hence break security again,
      i.e. should be used only for trusted guests).

      This is part of XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>)

  commit a88a3f887181605f4487a22bdfb7d87ffafde5d9
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: add a few PCI config space field descriptions

      Since the next patch will turn all not explicitly described fields
      read-only by default, those fields that have guest writable bits need
      to be given explicit descriptors.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 0ad3393ad032f76e88b4dbd04d36ad84dff75dd6
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: mark reserved bits in PCI config space fields

      The adjustments are solely to make the subsequent patches work right
      (and hence make the patch set consistent), namely if permissive mode
      (introduced by the last patch) gets used (as both reserved registers
      and reserved fields must be similarly protected from guest access in
      default mode, but the guest should be allowed access to them in
      permissive mode).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 45ebe3916ab16f859ed930e92fbd52d84d5dcdaf
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: mark all PCIe capability bits read-only

      xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read-
      only to avoid unintended write-back (just a precaution, the field ought
      to be read-only in hardware).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 0e7ef22136955169a0fd03c4e41af95662352733
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: split out calculation of throughable mask in PCI config space handling

      This is just to avoid having to adjust that calculation later in
      multiple places.

      Note that including ->ro_mask in get_throughable_mask()'s calculation
      is only an apparent (i.e. benign) behavioral change: For r/o fields it
      doesn't matter > whether they get passed through - either the same flag
      is also set in emu_mask (then there's no change at all) or the field is
      r/o in hardware (and hence a write won't change it anyway).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>

  commit c4ff1e68c621928abc680266cad0a451686c403b
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: correctly handle PM status bit

      xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C
      nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit d61bb2482dc0c7426f451f23ba7e2748ae2cc06d
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: consolidate PM capability emu_mask

      There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing
      PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local
      emu_mask variable - we can have the same effect by setting the field
      descriptor's emu_mask member suitably right away. Note that
      xen_pt_pmcsr_reg_write() is being retained in order to allow later
      patches to be less intrusive.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Ian Campbell <ian.campbell@citrix.com>

  commit d1d35cf4ffb6a60a356193397919e83306d0bb74
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/MSI: don't open-code pass-through of enable bit modifications

      Without this the actual XSA-131 fix would cause the enable bit to not
      get set anymore (due to the write back getting suppressed there based
      on the OR of emu_mask, ro_mask, and res_mask).

      Note that the fiddling with the enable bit shouldn't really be done by
      qemu, but making this work right (via libxc and the hypervisor) will
      require more extensive changes, which can be postponed until after the
      security issue got addressed.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit b38ec5ee7a581776bbce0bdaecb397632c3c4791
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen/MSI-X: limit error messages

      Limit error messages resulting from bad guest behavior to avoid allowing
      the guest to cause the control domain's disk to fill.

      The first message in pci_msix_write() can simply be deleted, as this
      is indeed bad guest behavior, but such out of bounds writes don't
      really need to be logged.

      The second one is more problematic, as there guest behavior may only
      appear to be wrong: For one, the old logic didn't take the mask-all bit
      into account. And then this shouldn't depend on host device state (i.e.
      the host may have masked the entry without the guest having done so).
      Plus these writes shouldn't be dropped even when an entry is unmasked.
      Instead, if they can't be made take effect right away, they should take
      effect on the next unmasking or enabling operation - the specification
      explicitly describes such caching behavior. Until we can validly drop
      the message (implementing such caching/latching behavior), issue the
      message just once per MSI-X table entry.

      Note that the log message in pci_msix_read() similar to the one being
      removed here is not an issue: "addr" being of unsigned type, and the
      maximum size of the MSI-X table being 32k, entry_nr simply can't be
      negative and hence the conditonal guarding issuing of the message will
      never be true.

      This is XSA-130.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 7611dae8a69f0f1775ba1a9a942961c2aa10d88e
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen: don't allow guest to control MSI mask register

      It's being used by the hypervisor. For now simply mimic a device not
      capable of masking, and fully emulate any accesses a guest may issue
      nevertheless as simple reads/writes without side effects.

      This is XSA-129.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 5c83b2f5b4b956e91dd6e5711f14df7ab800aefb
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen: properly gate host writes of modified PCI CFG contents

      The old logic didn't work as intended when an access spanned multiple
      fields (for example a 32-bit access to the location of the MSI Message
      Data field with the high 16 bits not being covered by any known field).
      Remove it and derive which fields not to write to from the accessed
      fields' emulation masks: When they're all ones, there's no point in
      doing any host write.

      This fixes a secondary issue at once: We obviously shouldn't make any
      host write attempt when already the host read failed.

      This is XSA-128.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 11d306b9df172faeeb3409deba4083dbe479b23c
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:11 2015 +0100

      hw/arm/sysbus-fdt: helpers for platform bus nodes addition

      This new C module will be used by ARM machine files to generate
      platform bus node and their dynamic sysbus device tree nodes.

      Dynamic sysbus device node addition is done in a machine init
      done notifier. arm_register_platform_bus_fdt_creator does the
      registration of this latter and is supposed to be called by
      ARM machine files that support platform bus and their dynamic
      sysbus. Addition of dynamic sysbus nodes is done only if the
      user did not provide any dtb.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-2-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4771cd01daaccb2a8929fa04c88c608e378cf814
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 19:18:36 2015 +0100

      target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays

      The ARMCPRegInfo arrays v8_el3_no_el2_cp_reginfo and v8_el2_cp_reginfo
      are actually used on non-v8 CPUs as well. Remove the incorrect v8_
      prefix from their names.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1433182716-6400-1-git-send-email-peter.maydell@linaro.org

  commit 9718e4ae362d2f221ec028cdacefafc593ef1357
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      arm_gicv2m: set kvm_gsi_direct_mapping and kvm_msi_via_irqfd_allowed

      After introduction of kvm_arch_msi_data_to_gsi, kvm_gsi_direct_mapping
      now can be set on ARM. Also kvm_msi_via_irqfd_allowed can be set,
      depending on kernel irqfd support, hence enabling VIRTIO-PCI with
      vhost back-end.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1850b6b7d027bb4b45010a7d1da919267fff2cd4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      kvm: introduce kvm_arch_msi_data_to_gsi

      On ARM the MSI data corresponds to the shared peripheral interrupt (SPI)
      ID. This latter equals to the SPI index + 32. to retrieve the SPI index,
      matching the gsi, an architecture specific function is introduced.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b2ff2ceb8a45cbe51ca13a1a32fc5bdeec71815
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      pl061: fix wrong calculation of GPIOMIS register

      The masked interrupt status register should be the state of the interrupt
      after masking.
      There should be a logical AND instead of a logical OR between the
      interrupt status and the interrupt mask.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1433154824-6927-1-git-send-email-victor.clement@openwide.fr
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bd204e63a7ce9d1b5c5903c9033863b179194989
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      target-arm: Add the GICv2m to the virt board

      Add a GICv2m device to the virt board to enable MSIs on the generic PCI
      host controller.  We allocate 64 SPIs in the IRQ space for now (this can
      be increased/decreased later) and map the GICv2m right after the GIC in
      the memory map.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-5-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfd90a87155882d92a3efa6da9afc773fd8c6796
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      target-arm: Extend the gic node properties

      In preparation for adding the GICv2m which requires address specifiers
      and is a subnode of the gic, we extend the gic DT definition to specify
      the #address-cells and #size-cells properties and add an empty ranges
      property properties of the DT node, since this is required to add the
      v2m node as a child of the gic node.

      Note that we must also expand the irq-map to reference the gic with the
      right address-cells as a consequence of this change.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-4-git-send-email-christoffer.dall@linaro.org
      Suggested-by: Shanker Donthineni <shankerd@codeaurora.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 770c58f8d10b61e80a211d87df83670711631530
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      arm_gicv2m: Add GICv2m widget to support MSIs

      The ARM GICv2m widget is a little device that handles MSI interrupt
      writes to a trigger register and ties them to a range of interrupt lines
      wires to the GIC.  It has a few status/id registers and the interrupt wires,
      and that's about it.

      A board instantiates the device by setting the base SPI number and
      number SPIs for the frame.  The base-spi parameter is indexed in the SPI
      number space only, so base-spi == 0, means IRQ number 32.  When a device
      (the PCI host controller) writes to the trigger register, the payload is
      the GIC IRQ number, so we have to subtract 32 from that and then index
      into our frame of SPIs.

      When instantiating a GICv2m device, tell PCI that we have instantiated
      something that can deal with MSIs.  We rely on the board actually wiring
      up the GICv2m to the PCI host controller.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-3-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 747d009dcac37ce7372b58b21c168f0ad66cf7be
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add GIC phandle to VirtBoardInfo

      Instead of passing the GIC phandle around between functions, add it to
      the VirtBoardInfo just like we do for the clock_phandle.  We are about
      to add the v2m phandle as well, and it's easier not having to pass
      around a bunch of phandles, return multiple values from functions, etc.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-2-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57b6d95eb480d66c5bfa4e416d1fbcad0f84fdd2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      Revert "target-arm: Avoid g_hash_table_get_keys()"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_hash_table_get_keys() anymore.

      This reverts commit 82a3a11897308b606120f7235001e87809708f85.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1432749090-4698-1-git-send-email-armbru@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8742d49d6f2278d353a1623dfa8a5e237dbfd906
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_VAE2{IS}

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-11-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51da90140bba4333eeb9c1d8d8d8afc2ca790628
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_ALLE2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-10-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bdb9e2d66afbe0571dce48a9430c35ae4d6bbd32
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_ALLE1{IS}

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-9-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a57633c08fa861807a0713505785bd4d441d7df8
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TTBR0_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-8-git-send-email-edgar.iglesias@gmail.com
      [PMM: Switch to preferred opc1/crm order for 64-bit AArch32 cpregs;
       drop unneeded use of vmsa_ttbr_writefn]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff05f37babe7874f28dcead6e9e4f1904d35a13a
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TPIDR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-7-git-send-email-edgar.iglesias@gmail.com
      [PMM: reordered fields into preferred opc0/opc1/crn/crm/opc2 order]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b9cb5323bb671a0f2bfecc36168d3a3763e90261
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add SCTLR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-6-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06ec4c8c9f9e21b7671c79296f3a47ab63d50067
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TCR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-5-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 95f949ac3dc7d4a6ebee512a9d122db18210df64
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add MAIR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-4-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a903c449b41f105aadd5f762a7aede531b4950f0
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Break down TLB_LOCKDOWN

      Break down the overly broad wildcard definition of TLB_LOCKDOWN
      down to v7 level.

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-3-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3fc827d591679f3e262b9d1f8b34528eabfca8c0
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Fri May 29 16:43:13 2015 +1000

      target-arm: Correct check for non-EL3

      This fixes a compile warning from clang 3.5 (the assertion
      could never fire).

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-2-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: John Snow <jsnow@redhat.com>
      [PMM: added note in commit message that this is fixing a build warning]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25611aa12b4155937d076dbe7445daed62ee6043
  Merge: ef99b3e e63d114
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 11:25:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150602-1' into staging

      virtio-input: two small fixups

      # gpg: Signature made Tue Jun  2 09:32:51 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150602-1:
        virtio-input: make virtio devices follow usual naming convention
        virtio-input: const_le16 and const_le32 not build time constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ef99b3ee065d5c817fa0a50d95293e569bfb47fb
  Merge: b821cbe 9e47226
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 10:20:03 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc build fix

      My last pull breaks build on systems with iasl.
      Fix this up.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jun  1 20:41:08 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        acpi: add missing ssdt

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e63d114b8a81e22ff9295674ba64b21255d589ee
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 2 10:31:29 2015 +0200

      virtio-input: make virtio devices follow usual naming convention

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 16c9d46d32b39b147774ddd948dd2f9ad9049d02
  Author: Michael Mueller <mimu@linux.vnet.ibm.com>
  Date:   Mon Jun 1 15:51:56 2015 +0200

      virtio-input: const_le16 and const_le32 not build time constant

      As the implementation of const_le16 and const_le32 is not build time constant
      on big endian systems this need to be fixed.

        CC    hw/input/virtio-input-hid.o
      hw/input/virtio-input-hid.c:340:13: error: initializer element is not constant
      hw/input/virtio-input-hid.c:340:13: error: (near initialization for ‘virtio_keyboard_config[1].u.ids.bustype’)
      ...

      Signed-off-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 489653b5db17679fd61b740dd289c798bb25d7b9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 20:01:05 2015 +0100

      monitor: Change return type of monitor_cur_is_qmp() to bool

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9f3982f2dcd96753d57d0ac64bd1ae3b37a90eb3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:56:38 2015 +0100

      monitor: Rename monitor_ctrl_mode() to monitor_is_qmp()

      ... and change return type to bool.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f994b2587f081693b017ebd03b362d162d3108b3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:51:51 2015 +0100

      monitor: Turn int command_mode into bool in_command_mode

      While there, inline the pointless qmp_cmd_mode() wrapper.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6a50636f35ba677c747f2f6127b0dba994b039ca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:49:41 2015 +0100

      monitor: Drop do_qmp_capabilities()'s superfluous QMP check

      Superfluous since commit 30f5041 removed it from HMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 74358f2a1647b239d87340ea0024f9d2efa266ca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:35:59 2015 +0100

      monitor: Unbox Monitor member mc and rename to qmp

      While there, rename its type as well, from MonitorControl to
      MonitorQMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c83fe23b58199a6d4a938305cb0fc45fe7729b61
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:20:51 2015 +0100

      monitor: Rename monitor_control_read(), monitor_control_event()

      ... to monitor_qmp_read(), monitor_qmp_event().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 7ef6cf6341c453021939c909adf2d62d9dc25fd5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:12:36 2015 +0100

      monitor: Rename handle_user_command() to handle_hmp_command()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 710aec915d208246891b68e2ba61b54951edc508
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 11:28:00 2015 +0100

      monitor: Limit QError use to command handlers

      The previous commits narrowed use of QError to handle_qmp_command()
      and its helpers monitor_protocol_emitter(), build_qmp_error_dict().
      Narrow it further to just the command handler call: instead of
      converting Error to QError throughout handle_qmp_command(), convert
      the QError gotten from the command handler to Error, and switch the
      helpers from QError to Error.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 452e0300a3521f13b6c4ba0b99a8cea3a29209f1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:11:13 2015 +0100

      monitor: Inline monitor_has_error() into its only caller

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 70ea0c58991ae44b5a1e67d9c189d79029168cb1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:47:08 2015 +0100

      monitor: Wean monitor_protocol_emitter() off mon->error

      Move mon->error handling to its caller handle_qmp_command().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4086182fcd9b106345b5cc535d78bcc6d13a7683
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 29 10:27:16 2015 +0200

      monitor: Propagate errors through invalid_qmp_mode()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit ba0510aad43148e5284cb52fcc7a0103b5e0af4d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 2 18:41:43 2015 +0100

      monitor: Propagate errors through qmp_check_input_obj()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 326283aa5d4d51d576185af4cbbdc29f648cd766
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 2 18:39:09 2015 +0100

      monitor: Propagate errors through qmp_check_client_args()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 8a4f501c09bcb8b5a220699e378aa8fb7ec178e4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 18:50:05 2015 +0100

      monitor: Drop unused "new" HMP command interface

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 04e00c92ef75629a241ebc50537f75de0867928d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:48:49 2015 +0100

      monitor: Use trad. command interface for HMP pcie_aer_inject_error

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      pcie_aer_inject_error's implementation is split into the
      hmp_pcie_aer_inject_error() and pcie_aer_inject_error_print().  The
      former is a peculiar crossbreed between HMP and QMP handler.  On
      success, it works like a QMP handler: store QDict through ret_data
      parameter, return 0.  Printing the QDict is left to
      pcie_aer_inject_error_print().  On failure, it works more like an HMP
      handler: print error to monitor, return negative number.

      To convert to the traditional interface, turn
      pcie_aer_inject_error_print() into a command handler wrapping around
      hmp_pcie_aer_inject_error().  By convention, this command handler
      should be called hmp_pcie_aer_inject_error(), so rename the existing
      hmp_pcie_aer_inject_error() to do_pcie_aer_inject_error().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 318660f84a0a26451750aee68ab7dcf88731637d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:24:48 2015 +0100

      monitor: Use traditional command interface for HMP device_add

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      For device_add, that's easy: just wrap the obvious hmp_device_add()
      around do_device_add().

      monitor_user_noop() is now unused, drop it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 072ebe6b0351060b33287454fdef625fe79c858f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:00:56 2015 +0100

      monitor: Use traditional command interface for HMP drive_del

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      For drive_del, that's easy: hmp_drive_del() sheds its unused last
      parameter, and its return value, which the caller ignored anyway.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit b8a185bc9a8ecbdc74fd64672e4abdd09a558e1c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:29:02 2015 +0100

      monitor: Convert client_migrate_info to QAPI

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 13cadefbda71e119db79fe0b7a4efd26a6d005bd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 19:16:58 2015 +0100

      monitor: Improve and document client_migrate_info protocol error

      Protocol must be spice, vnc isn't implemented.  Fix up documentation.

      Attempts to use vnc or any other unknown protocol yield the misleading
      error message "Invalid parameter 'protocol'".  Improve it to
      "Parameter 'protocol' expects spice".

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by. Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 84add864ebd2e6f3c645948ab595d8454165ebc5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 16:45:15 2015 +0100

      monitor: Clean up after previous commit

      Inline qmp_call_cmd() along with its helper handler_audit() into its
      only caller handle_qmp_command(), and simplify the result.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 65207c59d99f2260c5f1d3b9c491146616a522aa
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 14:35:26 2015 +0100

      monitor: Drop broken, unused asynchronous command interface

      The asynchronous monitor command interface goes back to commit 940cc30
      (Jan 2010).  Added a third case to command execution.  The hope back
      then according to the commit message was that all commands get
      converted to the asynchronous interface, killing off the other two
      cases.  Didn't happen.

      The initial asynchronous commands balloon and info balloon were
      converted back to synchronous long ago (commit 96637bc and d72f32),
      with commit messages calling the asynchronous interface "not fully
      working" and "deprecated".  The only other user went away in commit
      3b5704b.

      New code generally uses synchronous commands and asynchronous events.

      What exactly is still "not fully working" with asynchronous commands?
      Well, here's a bug that defeats actual asynchronous use pretty
      reliably: the reply's ID is wrong (and has always been wrong) unless
      you use the command synchronously!  To reproduce, we need an
      asynchronous command, so we have to go back before commit 3b5704b.
      Run QEMU with spice:

          $ qemu-system-x86_64 -nodefaults -S -spice port=5900,disable-ticketing -qmp stdio
          {"QMP": {"version": {"qemu": {"micro": 94, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}

      Connect a spice client in another terminal:

          $ remote-viewer spice://localhost:5900

      Set up a migration destination dummy in a third terminal:

          $ socat TCP-LISTEN:12345 STDIO

      Now paste the following into the QMP monitor:

          { "execute": "qmp_capabilities", "id": "i0" }
          { "execute": "client_migrate_info", "id": "i1", "arguments": { "protocol": "spice", "hostname": "localhost", "port": 12345 } }
          { "execute": "query-kvm", "id": "i2" }

      Produces two replies immediately, one to qmp_capabilities, and one to
      query-kvm:

          {"return": {}, "id": "i0"}
          {"return": {"enabled": false, "present": true}, "id": "i2"}

      Both are correct.  Two lines of debug output from libspice-server not
      shown.

      Now EOF socat's standard input to make it close the connection.  This
      makes the asynchronous client_migrate_info complete.  It replies:

          {"return": {}}

      Bug: "id": "i1" is missing.  Two lines of debug output from
      libspice-server not shown.  Cherry on top: storage for the missing ID
      is leaked.

      Get rid of this stuff before somebody hurts himself with it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9e472263b07d53cb3401ee49ef1b45ef195ddb84
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 1 21:03:59 2015 +0200

      acpi: add missing ssdt

      commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
          TPM2 ACPI table support

      was missing a file, so build with iasl fails
      (build without iasl works since it uses the generated
       hex files).

      Reported-by: "Daniel P. Berrange" <berrange@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b821cbe274c5a5cacf1a7b28360d869ae1e6e0c3
  Merge: 9657caf 830d70d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 15:22:46 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, pci, tpm, virtio, vhost enhancements and fixes

      A bunch of cleanups and fixes all over the place,
      enhancements in TPM, virtio and vhost.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jun  1 13:19:48 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (60 commits)
        vhost-user: add multi queue support
        virtio: make features 64bit wide
        qdev: add 64bit properties
        virtio-mmio: ioeventfd support
        hw/acpi/aml-build: Fix memory leak
        acpi: add aml_while() term
        acpi: add aml_increment() term
        acpi: add aml_shiftright() term
        acpi: add aml_shiftleft() term
        acpi: add aml_index() term
        acpi: add aml_lless() term
        acpi: add aml_add() term
        TPM2 ACPI table support
        tpm: Probe for connected TPM 1.2 or TPM 2
        Extend TPM TIS interface to support TPM 2
        Add stream ID to MSI write
        acpi: Simplify printing to dynamic string
        i386: drop FDC in pc-q35-2.4+ if neither it nor floppy drives are wanted
        i386/pc_q35: don't insist on board FDC if there's no default floppy
        i386/pc: '-drive if=floppy' should imply a board-default FDC
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 830d70db692e374b55555f4407f96a1ceefdcc97
  Author: Ouyang Changchun <changchun.ouyang@intel.com>
  Date:   Thu May 28 09:23:06 2015 +0800

      vhost-user: add multi queue support

      Based on patch by Nikolay Nikolaev:
      Vhost-user will implement the multi queue support in a similar way
      to what vhost already has - a separate thread for each queue.
      To enable the multi queue functionality - a new command line parameter
      "queues" is introduced for the vhost-user netdev.

      Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com>
      Signed-off-by: Changchun Ouyang <changchun.ouyang@intel.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 019a3edbb25f1571e876f8af1ce4c55412939e5d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Jun 1 10:45:40 2015 +0200

      virtio: make features 64bit wide

      Make features 64bit wide everywhere.

      On migration a full 64bit guest_features field is sent if one of the
      high bits is set, in addition to the lower 32bit guest_features field
      which must stay for compatibility reasons.  That way we send the lower
      32 feature bits twice, but the code is simpler because we don't have
      to split and compose the 64bit features into two 32bit fields.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fdba6d967e00864edd21275a6ee1d23a383510e8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Jun 1 10:45:39 2015 +0200

      qdev: add 64bit properties

      Needed for virtio features which go from 32bit to 64bit with virtio 1.0

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 434027badb421863b85ffdb4769966533c001cfa
  Author: Ying-Shiuan Pan <yingshiuan.pan@gmail.com>
  Date:   Tue May 12 11:10:50 2015 +0300

      virtio-mmio: ioeventfd support

      set_host_notifier and set_guest_notifiers supported by virtio-mmio now.
      Most code copied from virtio-pci.

      This makes it possible to use vhost-net with virtio-mmio,
      improving performance by about 30%.

      The kvm-arm does not yet support irqfd, need to fix the hard-coded part after
      kvm-arm gets irqfd support.

      Signed-off-by: Ying-Shiuan Pan <yingshiuan.pan@gmail.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit afcf905cff7971324c2706600ead35a1f41f417a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 25 15:14:37 2015 +0800

      hw/acpi/aml-build: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 68e6b0af784dda4efd9d4e2e9d3b03a31ca1408c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:46 2015 +0300

      acpi: add aml_while() term

      Add encoding for ACPI DefWhile Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af39d5363f373e6c1168a0e84658d6e4ef57fa8c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:45 2015 +0300

      acpi: add aml_increment() term

      Add encoding for ACPI DefIncrement Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f7bd7b8eb6573ed22bfc51e148455a1c0a1e36d0
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:44 2015 +0300

      acpi: add aml_shiftright() term

      Add encoding for ACPI DefShiftRight Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit a57dddddd2f93b87852fac2ed41a31c45e6d192a
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:43 2015 +0300

      acpi: add aml_shiftleft() term

      Add encoding for ACPI DefShiftLeft Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 928b8996576875f9364f77c5a41f12cd55c7b9f7
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:42 2015 +0300

      acpi: add aml_index() term

      Add encoding for ACPI DefIndex Opcode.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 96396e2858fd8a0b4ee218c9894b5a67d22d97d9
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:41 2015 +0300

      acpi: add aml_lless() term

      Add encoding for ACPI DefLLess Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c08cf0704247aa55e9b0bb14cf34d845629e0e3e
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:40 2015 +0300

      acpi: add aml_add() term

      Add encoding for ACPI DefAdd Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:07 2015 -0400

      TPM2 ACPI table support

      Add a TPM2 ACPI table if a TPM 2 is used in the backend.
      Also add an SSDT for the TPM 2.

      Rename tpm_find() to tpm_get_version() and have this function
      return the version of the TPM found, TPMVersion_Unspec if
      no TPM is found. Use the version number to build version
      specific ACPI tables.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9657cafceb90accedd574a3accb3d344def8e764
  Merge: 97af820 07e1548
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 11:29:37 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150530' into staging

      TriCore bugfixes

      # gpg: Signature made Sat May 30 15:50:49 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150530:
        target-tricore: fix BOL_ST_H_LONGOFF using ld
        target-tricore: fix msub32_q producing the wrong overflow bit
        target-tricore: fix OPC2_32_RR_DVINIT_HU having write before use on the result

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 56a3c24ffc11955ddc7bb21362ca8069a3fc8c55
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:06 2015 -0400

      tpm: Probe for connected TPM 1.2 or TPM 2

      In the TPM passthrough backend driver, modify the probing code so
      that we can check whether a TPM 1.2 or TPM 2 is being used
      and adapt the behavior of the TPM TIS accordingly.

      Move the code that tested for a TPM 1.2 into tpm_utils.c
      and extend it with test for probing for TPM 2. Have the
      function return the version of TPM found.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 116694c34aa794a994051fce55bfee418fe1521d
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:05 2015 -0400

      Extend TPM TIS interface to support TPM 2

      Following the recent upgrade to version 1.3, extend the TPM TIS
      interface with capabilities introduced for support of a TPM 2.

      TPM TIS for TPM 2 introduced the following extensions beyond the
      TPM TIS 1.3 (used for TPM 1.2):

      - A new 32bit interface Id register was introduced.
      - New flags for the status (STS) register were defined.
      - New flags for the capability flags were defined.

      Support the above if a TPM TIS 1.3 for TPM 2 is used with a TPM 2
      on the backend side. Support the old TPM TIS 1.3 configuration if a
      TPM 1.2 is being used. A subsequent patch will then determine which
      TPM version is being used in the backend.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 38d40ff10f71657ea913a63d1f8477be368b92c1
  Author: Pavel Fedin <p.fedin@samsung.com>
  Date:   Wed May 27 15:59:59 2015 +0300

      Add stream ID to MSI write

      GICv3 ITS distinguishes between devices by using hardwired device IDs passed on the bus.
      This patch implements passing these IDs in qemu.
      SMMU is also known to use stream IDs, therefore this addition can also be useful for
      implementing platforms with SMMU.

      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

       Changes from v1:
      - Added bus number to the stream ID
      - Added stream ID not only to MSI-X, but also to plain MSI. Some common code was made into
      msi_send_message() function.
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c3bdc56c183f6ca6baa502bd7861583ca98b333b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 27 19:55:55 2015 +0200

      acpi: Simplify printing to dynamic string

      build_append_namestringv() and aml_string() first calculate the
      resulting string's length with vsnprintf(NULL, ...), then allocate,
      then print for real.  Simply use g_strdup_vprintf() or g_vasprintf()
      instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit ea96bc629cbd52be98b2967a4b4f72e91dfc3ee4
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:11 2015 +0200

      i386: drop FDC in pc-q35-2.4+ if neither it nor floppy drives are wanted

      It is Very annoying to carry forward an outdatEd coNtroller with a mOdern
      Machine type.

      Hence, let us not instantiate the FDC when all of the following apply:
      - the machine type is pc-q35-2.4 or later,
      - "-device isa-fdc" is not passed on the command line (nor in the config
        file),
      - no "-drive if=floppy,..." is requested.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 6cd2234ccbacf2825372142a2658bf318ce2f848
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:10 2015 +0200

      i386/pc_q35: don't insist on board FDC if there's no default floppy

      The "no_floppy = 1" machine class setting causes "default_floppy" in
      main() to become zero. Consequently, default_drive() will not call
      drive_add() and drive_new() for IF_FLOPPY, index=0, meaning that no
      default floppy drive will be created for the virtual machine. In that
      case, board code should also not insist on the creation of the
      board-default FDC.

      The board-default FDC will still be created if the user requests a floppy
      drive with "-drive if=floppy".

      Additionally, separate FDCs can be specified manually with "-device
      isa-fdc". They allow the

        -device isa-fdc,driveA=...

      syntax that is more flexible than the one required by the board-default
      FDC:

        -global isa-fdc.driveA=...

      This patch doesn't change the behavior observably, as all Q35 machine
      types have "no_floppy = 0".

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 936a7c1cf7410a3bab97c98301054921d47a8918
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:09 2015 +0200

      i386/pc: '-drive if=floppy' should imply a board-default FDC

      Even if board code decides not to request the creation of the FDC (keyed
      off board-level factors, to be determined later), we should create the FDC
      nevertheless if the user passes '-drive if=floppy' on the command line.

      Otherwise '-drive if=floppy' would break without explicit '-device
      isa-fdc' on such boards.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit fd53c87cf6651b0dfe9f5107cfe77d2f697bd4f6
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:08 2015 +0200

      i386/pc: pc_basic_device_init(): delegate FDC creation request

      This patch introduces no observable change, but it allows the callers of
      pc_basic_device_init(), ie. pc_init1() and pc_q35_init(), to request (or
      not request) the creation of the FDC explicitly.

      At the moment both callers pass constant create_fdctrl=true (hence no
      observable change).

      Assuming a board passes create_fdctrl=false, "floppy" will be NULL on
      output, and (beyond the FDC not being created) that NULL will be passed on
      to pc_cmos_init(). Luckily, pc_cmos_init() already handles that case.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit b829c2a98f1f67308eb02fcddb52d8fa67775f18
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:32 2015 +0800

      virtio: increase the queue limit to 1024

      Increase the queue limit to 1024. But virtio-ccw and s390-virtio won't
      support this, this is done through failing device_plugged() for those
      two transports if the number of virtqueues is greater than 64.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 87b3bd1c858e6cacac4d403da9109ec3a04fe9d0
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:31 2015 +0800

      virtio: rename VIRTIO_PCI_QUEUE_MAX to VIRTIO_QUEUE_MAX

      VIRTIO_PCI_QUEUE_MAX is not only used for pci, so rename it be generic.

      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d820331a0b47cbbdc409b435545aea25e19b57ad
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:30 2015 +0800

      virtio-s390: introduce virtio_s390_device_plugged()

      This patch introduce a virtio-s390 specific device_plugged() function
      and doing the number of virtqueue validation inside.

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 74c85296dc880568005b8e7572e08a39d66bcdca
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:29 2015 +0800

      virtio-s390: introduce virito s390 queue limit

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 10ceaa1e8f9f74c917df1fe5db856817a8b26fe7
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:28 2015 +0800

      virtio-ccw: validate the number of queues against bus limitation

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8dfbaa6ac450c4ec2646b1ca08a4017052a90c1d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:27 2015 +0800

      virtio-ccw: introduce ccw specific queue limit

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ad176aaed24535f535e0fdb03c538c23017535d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:26 2015 +0800

      virtio: introduce virtio_get_num_queues()

      This patch introduces virtio_get_num_queues() which iterates the vqs
      array and return the number of virtqueues used by device.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e83980455c8c7eb066405de512be7c4bace3ac4d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:25 2015 +0800

      virtio: device_plugged() can fail

      This patch passes error pointer to transport specific device_plugged()
      callback. Through this way, device_plugged() can do some transport
      specific check and fail. This will be uesd by following patches that
      check the number of virtqueues against the transport limitation.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit da51a335aa61ec0e45879d80f3c5e2ee4f87cd2f
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:24 2015 +0800

      virtio-net: adding all queues in .realize()

      Instead of adding queues for multiqueue during feature set. This patch
      did this in .realize(), this will help the following patches that
      count the number of virtqueues used in .device_plugged() callback.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cf34f533a161f8ced7322321d70ca00414d47473
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri May 29 11:29:40 2015 +0200

      virtio: move VIRTIO_F_NOTIFY_ON_EMPTY into core

      Nearly all transports have been offering VIRTIO_F_NOTIFY_ON_EMPTY,
      s390-virtio being the exception. There's no reason why it shouldn't
      offer it as well, though (handling is done in core anyway), so let's
      move it to the common virtio features.

      While we're changing it anyway, fix the indentation for the
      DEFINE_VIRTIO_COMMON_FEATURES macro.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 13644819c5bf322ae4c2a415aca77d5dbde95fe8
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri May 29 11:29:39 2015 +0200

      virtio-ccw: Don't advertise VIRTIO_F_BAD_FEATURE

      This was copied from virtio-pci, but it doesn't make much sense for
      ccw, as it doesn't have to handle the broken implementations this bit
      is supposed to deal with. Remove it.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6b8f1020540c27246277377aa2c3331ad2bfb160
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue May 26 16:34:47 2015 +0200

      virtio: move host_features

      Move host_features from the individual transport proxies into
      the virtio device. Transports may continue to add feature bits
      during device plugging.

      This should it make easier to offer different sets of host features
      for virtio-1/transitional support.

      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2332333c9738b442fbbd5b83a1eaa6be656ab9b5
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri May 29 21:57:32 2015 +0200

      pc: acpi: fix pvpanic for buggy guests

      In the old times, we always had pvpanic in ACPI and a _STA method told
      the guest not to use it.  Automatic generation dropped the _STA method
      as the specification says that missing _STA means enabled and working.
      Some guests (Linux) had buggy drivers and this change made them unable
      to utilize pvpanic.

      A Linux patch is posted as well, but I think it's worth to make pvpanic
      useable on old guests at the price of three lines and few bytes of SSDT.

      The old _STA method was
        Method (_STA, 0, NotSerialized) {
            Store (PEST, Local0)
            If (LEqual (Local0, Zero)) {
                Return (Zero) }
            Else {
                Return (0x0F) }}

      Igor pointed out that we don't need to use a method to return a constant
      and that 0xB (don't show in UI) is the common definition now.

      Also, the device used to be PEVT.  (PEVT as in "panic event"?)

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 99fbeafee8b568e796863980365080abdb8d675e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:19:01 2015 -0300

      pc: Generate init functions with a macro

      All pc-i440fx and pc-q35 init functions simply call the corresponding
      compat function and then call the main init function. Use a macro to
      generate that code.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 211b5b1d0a31f2f7593d6858a0b10487fb7b7fac
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:19:00 2015 -0300

      piix: Eliminate pc_init_pci()

      The function is not needed anymore, we can simply call pc_init1()
      directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72d164aa73b7c8d22a63b8ee789f97e4a8d2aa5c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:59 2015 -0300

      piix: Add kvmclock_enabled, pci_enabled globals

      This looks like a step backwards, but it will allow pc-0.1[0123] and
      isapc to follow the same compat+init pattern used by the other
      machine-types, allowing us to generate all init function using the same
      macro later.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d48f4fa69eb3efb03a2efe2e4606a97a17cf222f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:58 2015 -0300

      machine: Remove unused fields from QEMUMachine

      This removes the following fields from QEMUMachine: family, alias,
      reset, hot_add_cpu, units_per_default_bus, no_serial, no_parallel,
      use_virtcon, use_sclp, no_floppy, no_cdrom, default_display,
      compat_props, and hw_version.

      The only users of those fields were already converted to use QOM and
      MachineClass directly, so they are not needed anymore.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d644b11657ae047d50d8ea9ce285ecd6dae04ca2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:57 2015 -0300

      pc: Remove qemu_register_pc_machine() function

      The helper is not needed anymore, as the PC machine classes are
      registered using QOM directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 865906f7fdadd2732441ab158787f81f6a212bfe
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:56 2015 -0300

      pc: Don't use QEMUMachine anymore

      Now that we have a DEFINE_PC_MACHINE helper macro that just requires an
      initialization function, it is trivial to convert them to register a QOM
      machine class directly, instead of using QEMUMachine.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 25519b062c70f2afe2d2f0c262f3838a41e8bc7c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:55 2015 -0300

      pc: Move compat_props setting inside *_machine_options() functions

      This will simplify the DEFINE_PC_MACHINE macro, and will help us to
      implement reuse of PC_COMPAT_* macros through class_init function reuse,
      in the future.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fddd179ab962f6f78a8493742e1068d6a620e059
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:54 2015 -0300

      pc: Convert *_MACHINE_OPTIONS macros into functions

      By now the new functions will get QEMUMachine as argument, but they will
      be later converted to initialize a MachineClass struct directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 61f219dfb093c0df91926928c780299cdf429619
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:53 2015 -0300

      pc: Define machines using a DEFINE_PC_MACHINE macro

      This will automatically generate the existing QEMUMachine structs based
      on the *_MACHINE_OPTIONS macros, and automatically add registration code
      for them.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6b5c8e492ae7b71a16fe702b7409bff0feebfa7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:52 2015 -0300

      pc: Define MACHINE_OPTIONS macros consistently for all machines

      Define a MACHINE_OPTIONS macro for each PC machine, and move every field
      inside the QEMUMachine structs to the macros, except for name, init, and
      compat_props.

      This also ensures that all MACHINE_OPTIONS inherit the fields from the
      next version, so their definitions carry only the changes that exist
      between one version and the next one.

      Comments about specific cases:

      pc-*-2.1:

        Existing PC_*_2_1_MACHINE_OPTIONS macros were defined as:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin"

        PC_*_2_2_MACHINE_OPTIONS is:
            PC_*_2_3_MACHINE_OPTIONS
        which is expanded to:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin",
            .default_display = "std"

        The only difference between 2_1 and 2_2 is .default_display, that's why
        we didn't reuse PC_*_2_2_MACHINE_OPTIONS. The good news is that having
        multiple initializers for a field is allowed by C99, and the last
        initializer overrides the previous ones.

        So we can reuse the 2_2 macro in 2_1 and define PC_*_2_1_MACHINE_OPTIONS
        as:
            PC_*_2_2_MACHINE_OPTIONS,
            .default_display = NULL

      pc-*-1.7:

        PC_*_1_7_MACHINE_OPTIONS was defined as:
            PC_*_MACHINE_OPTIONS

        PC_*_2_0_MACHINE_OPTIONS is defined as:
            PC_*_2_1_MACHINE_OPTIONS
        which is expanded to:
            PC_*_2_2_MACHINE_OPTIONS,
            .default_display = NULL
        which is expanded to:
            PC_*_2_3_MACHINE_OPTIONS,
            .default_display = NULL
        which is expanded to:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin",
            .default_display = "std",
            .default_display = NULL  /* overrides the previous line */

        So, the only difference between PC_*_1_7_MACHINE_OPTIONS and
        PC_*_2_0_MACHINE_OPTIONS is .default_machine_opts (as .default_display
        is not explicitly set by PC_*_MACHINE_OPTIONS so it is NULL).

        So we can keep the macro reuse pattern and define
        PC_*_2_0_MACHINE_OPTIONS as:
            PC_*_2_0_MACHINE_OPTIONS,
            .default_machine_opts = NULL

      pc-*-2.4 (alias and is_default fields):

        Set alias and is_default fields inside the 2.4 MACHINE_OPTIONS macro,
        and clear it in the 2.3 macro (that reuses the 2.4 macro).

      hw_machine:

        As all the machines older than v1.0 set hw_version explicitly, we can
        safely move the field to the MACHINE_OPTIONS macros without affecting
        the other versions that reuse them.

      init function:

        Some machines had the init function set inside the MACHINE_OPTIONS
        macro. Move it to the QEMUMachine declaration, to keep it consistent
        with the other machines.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f6d5a0bad276ea97fac4e0efb0f41f54a3f1ac84
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:10 2015 -0300

      piix: Define PC_COMPAT_0_10

      Move compat_props from pc-0.10 to the macro, to make it consistent with
      the other machines.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit faf7e4254fa33a13805a34a1ffeeb9dcc0a36a5e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:09 2015 -0300

      piix: Move pc-0.1[23] rombar compat props to PC_COMPAT_0_13

      The VGA and vmware-svga rombar compat properties were added by commit
      281a26b15b4adcecb8604216738975abd754bea8, but only to pc-0.13 and
      pc-0.12. This breaks the PC_COMPAT_* nesting pattern we currently
      follow.

      The new variables will now be inherited by pc-0.11 and older, but
      pc-0.11 and pc-0.10 already have PCI.rombar=0 on compat_props, so they
      shouldn't be affected at all.

      Cc: Stefan Weil <sw@weilnetz.de>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d765519bef48bd95f2139314a5354144387523eb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:08 2015 -0300

      piix: Move pc-0.13 virtio-9p-pci compat to PC_COMPAT_0_13

      The compat property was added by commit
      9dbcca5aa13cb9ab40788ac4c56bc227d94ca920, and the pc-0.12 and older
      machine-types were not changed because virtio-9p-pci was introduced on QEMU
      0.13 (commit 9f10751365b26b13b8a9b67e0e90536ae3d282df). The only problem is
      that this breaks the PC_COMPAT_* nesting pattern we currently use.

      So, move the property to PC_COMPAT_0_13. This make pc-0.12 and older inherit
      it, but that shouldn't be an issue as QEMU 0.12 didn't have virtio-9p-pci.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d5303df71073da70e0ad29a6dfb304ec7b747f5c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:07 2015 -0300

      piix: Move pc-0.11 drive version compat props to PC_COMPAT_0_11

      The current code setting ide-drive.ver and scsi-disk.ver on pc-0.11
      breaks the PC_COMPAT_* nesting pattern we currently use.

      As those variables are overwritten in pc-0.10 too, they can be inherited
      by pc-0.10 with no side-effects at all.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit bb08d8829b5bec6af619e4532a397ef12727516c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:06 2015 -0300

      piix: Move pc-0.14 qxl compat properties to PC_COMPAT_0_14

      Those properties were introduced by commit
      3827cdb1c3aa17a792d1658161195b9d7173c26b. They were not duplicated into
      pc-0.13 and older because 0.14 was the first QEMU version supporting
      qxl. The only problem is that this breaks the PC_COMPAT_* nesting
      pattern we currently use.

      So, move the properties to PC_COMPAT_0_14. This makes pc-0.13 and older
      inherit them, but that shouldn't be an issue as QEMU 0.13 didn't support
      qxl.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 38ff32c6e6fd966c5adb9cde4d393a8cca9ef093
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:05 2015 -0300

      spapr: define SPAPR_COMPAT_2_3

      Don't add the pseries-2.3 machine yet, but define the corresponding
      SPAPR_COMPAT macro to make sure both pseries-2.2 and pseries-2.1 will
      inherit HW_COMPAT_2_3.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4dfd8eaa19c90087f19b56da5d04d9c468109a65
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:04 2015 -0300

      spapr: Use HW_COMPAT_* inside SPAPR_COMPAT_* macros

      SPAPR_COMPAT_2_1 will need to include both HW_COMPAT_2_2 and
      HW_COMPAT_2_1, so include HW_COMPAT_2_1 inside SPAPR_COMPAT_2_1 and
      HW_COMPAT_2_2 inside SPAPR_COMPAT_2_2.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 42134ac9d74799cf2f70257798b72a2988b75d31
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:03 2015 -0300

      pc: Define PC_COMPAT_2_[123] macros

      Once we start adding compat code for pc-2.3, the usage of HW_COMPAT_2_1
      in pc-*-2.2 won't be enough, as it also has to include PC_COMPAT_2_3
      inside it. To ensure that, define PC_COMPAT_2_3, PC_COMPAT_2_2, and
      PC_COMPAT_2_1 macros.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1edbde82b809f80b973978886d8232fbf280cb03
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:02 2015 -0300

      hw: Define empty HW_COMPAT_2_[23] macros

      Now we can make everything consistent and define the macros even if they
      are still empty.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit dd754baf46b6479a02521f671a0b58ffc799810e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:01 2015 -0300

      spapr: Move commas inside SPAPR_COMPAT_* macros

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a7cde24dc2f104c8e5861df0e2938e79264e9d58
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:00 2015 -0300

      pc: Move commas inside PC_COMPAT_* macros

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f27086a731bbd0141646702c95f6dc5fce3e8575
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:52:59 2015 -0300

      hw: Move commas inside HW_COMPAT_2_1 macro

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4974920ab8fc8cf05687f1f764650dbc7c821004
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:52:58 2015 -0300

      pc: Replace tab with spaces

      Coding style change only.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ecfa60e37439c870d08a90a845b061a53aa26f74
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:07 2015 +0800

      hw/s390x/virtio-ccw: use alias property for virtio-balloon-ccw

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 39b87c7b9f8bf3618e0357699d29615e521264d8
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:06 2015 +0800

      hw/virtio/virtio-pci: use alias property for virtio-balloon-pci

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1190044ea5a1c9a871664c4e2013072e51e56d5a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:05 2015 +0800

      hw/virtio/virtio-balloon: move adding property to virtio_balloon_instance_init

      This is in preparation for using alias property in virtio-balloon-pci
      and virtio-balloon-ccw.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 07e15486faf353260431f10e85185372c5036baa
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:58 2015 +0200

      target-tricore: fix BOL_ST_H_LONGOFF using ld

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-4-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 9bbd4843c052a0a467c7a3363046b0c95c0e5fc0
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:57 2015 +0200

      target-tricore: fix msub32_q producing the wrong overflow bit

      The inversion of the overflow bit as a special case, which was needed for the
      madd32_q instructions, does not apply for msub32_q instructions. So remove it.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-3-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 05b6ca9bbcaede74120050aa8e6684300c09257c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:56 2015 +0200

      target-tricore: fix OPC2_32_RR_DVINIT_HU having write before use on the result

      If the argument r1 was the same as the extended result register r3+1, we would
      overwrite r1 and then use it.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-2-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 97af820f539efe80b87615a04f9de11ea585f725
  Merge: 2cc3bdb 3960c33
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 17:10:57 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150529' into staging

      target-arm:
       * Support ACPI for ARMv8 systems using the 'virt' board
         (and a UEFI boot image, typically)
       * avoid buffer overrun in some UNPREDICTABLE ldrd/strd cases
       * further work preparing for 64-bit EL2/EL3 support

      # gpg: Signature made Fri May 29 12:14:06 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150529: (39 commits)
        target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd
        hw/arm/virt: Enable dynamic generation of ACPI v5.1 tables
        ACPI: split CONFIG_ACPI into 4 pieces
        hw/arm/virt-acpi-build: Add PCIe controller in ACPI DSDT table
        hw/acpi/aml-build: Add Unicode macro
        hw/acpi/aml-build: Add aml_dword_io() term
        hw/acpi/aml-build: Add aml_create_dword_field() term
        hw/acpi/aml-build: Add aml_else() term
        hw/acpi/aml-build: Add aml_lnot() term
        hw/acpi/aml-build: Add aml_or() term
        hw/acpi/aml-build: Add ToUUID macro
        hw/acpi/aml-build: Make aml_buffer() definition consistent with the spec
        hw/arm/virt-acpi-build: Generate MCFG table
        hw/arm/virt-acpi-build: Generate RSDP table
        hw/arm/virt-acpi-build: Generate RSDT table
        hw/arm/virt-acpi-build: Generate GTDT table
        hw/arm/virt-acpi-build: Generate MADT table
        hw/arm/virt-acpi-build: Generate FADT table and update ACPI headers
        hw/arm/virt-acpi-build: Generation of DSDT table for virt devices
        hw/acpi/aml-build: Add aml_interrupt() term
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2cc3bdbe2d3908f7a813d1c2d774cc2bf07746cd
  Merge: 2a90c45 9abe3bd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 15:32:15 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-block-2015-05-29' into staging

      Block QAPI, monitor, command line patches

      # gpg: Signature made Fri May 29 12:02:32 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-block-2015-05-29:
        qapi: add dirty bitmap status

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a90c454a1b90ace56ed908cd064f2fd483d1231
  Merge: 9441aa2 63c67b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 14:24:35 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150529-1' into staging

      gtk: add opengl rendering support.
      small bugfixes for gtk and opengl ui code.

      # gpg: Signature made Fri May 29 10:44:54 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150529-1:
        gtk: Replace gdk_cursor_new()
        gtk: add opengl support, using egl
        ui: add egl-helpers
        ui: shader.h protect against double inclusion
        ui: use libexpoxy

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9abe3bdc45ced367fe034c0fdd7c686212389767
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue May 12 15:53:01 2015 -0400

      qapi: add dirty bitmap status

      Bitmaps can be in a handful of different states with potentially
      more to come as we tool around with migration and persistence patches.

      Management applications may need to know why certain bitmaps are
      unavailable for various commands, e.g. busy in another operation,
      busy being migrated, etc.

      Right now, all we offer is BlockDirtyInfo's boolean member 'frozen'.
      Instead of adding more booleans, replace it by an enumeration member
      'status' with values 'active' and 'frozen'.  Then add new value
      'disabled'.

      Incompatible change.  Fine because the changed part hasn't been
      released so far.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      [Commit message tweaked]
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3960c336ad96c2183549c8bf32bbff93ecda7ea4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:29:00 2015 +0100

      target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd

      A LDRD or STRD where rd is not an even number is UNPREDICTABLE.
      We were letting this fall through, which is OK unless rd is 15,
      in which case we would attempt to do a load_reg or store_reg
      to a nonexistent r16 for the second half of the double-word.
      Catch the odd-numbered-rd cases and UNDEF them instead.

      To do this we rearrange the structure of the code a little
      so we can put the UNDEF catches at the top before we've
      allocated TCG temporaries.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431348973-21315-1-git-send-email-peter.maydell@linaro.org

  commit d7c2e2db28eb7e8f2ed7467fa2f2c59026b206d1
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/arm/virt: Enable dynamic generation of ACPI v5.1 tables

      Initialize VirtGuestInfoState and register a machine_init_done notify to
      call virt_acpi_build().

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-25-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 135a67a692bedb952ea720351026247104da8645
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      ACPI: split CONFIG_ACPI into 4 pieces

      As core.c, piix4.c, ich9.c and pcihp.c are for x86, add CONFIG_ACPI_X86
      to make it only for x86. ARM doesn't support cpu and memory hotplug, add
      CONFIG_ACPI_CPU_HOTPLUG and CONFIG_ACPI_MEMORY_HOTPLUG to exclude them
      for target-arm.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-24-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4e5de1ae02f6b47eb088531d3d4d047b4db6cfa
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/arm/virt-acpi-build: Add PCIe controller in ACPI DSDT table

      Add PCIe controller in ACPI DSDT table, so the guest can detect
      the PCIe.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-23-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e1f776c434f8f18079b82d8121c166fb53a63451
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/acpi/aml-build: Add Unicode macro

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-22-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 616ef329adbb671be783a1dba96d881b9218ff80
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_dword_io() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-21-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ed8176a37a8f227e61daddbcf92dc5d1cad45818
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_create_dword_field() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-20-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 467b07dfae6087381d0993ab910253a6c1850457
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_else() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-19-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea7df04a0217fe6314a1520dde1883c45fefcaaa
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_lnot() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-18-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 922cc8823e484733021a7be5b0e876eba2218623
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_or() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-17-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b930fb9db4aa07abb8f3871eb7379242edbdf2a5
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/acpi/aml-build: Add ToUUID macro

      Add ToUUID macro, this is useful for generating PCIe ACPI table.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-16-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ed8b5847e46c24d6e9c286892a00a34bee9b0835
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/acpi/aml-build: Make aml_buffer() definition consistent with the spec

      According to ACPI spec, DefBuffer can take two parameters: BufferSize
      and ByteList. Make it consistent with the spec. Uninitialized buffer
      could be requested by passing ByteList as NULL to reserve space.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-15-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8434488400971c6793893b8c9547bc6b97e076ce
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/arm/virt-acpi-build: Generate MCFG table

      Generate MCFG table for PCIe controller.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-14-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4bec5d876b694f7f13ad3fcfe510ff46e9748d0
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate RSDP table

      RSDP points to RSDT which in turn points to other tables.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-13-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 243bdb79fb0b2eda176cdef37700f29068a71d43
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate RSDT table

      RSDT points to other tables FADT, MADT, GTDT. This code is shared with x86.

      Here we still use RSDT as UEFI puts ACPI tables below 4G address space,
      and UEFI ignore the RSDT or XSDT.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-12-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ee246400c1ceef2014e120b718388d5f4aea8a2a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate GTDT table

      ACPI v5.1 defines GTDT for ARM devices as a place to describe timer
      related information in the system. The Arch Timer interrupts must
      be provided for GTDT.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-11-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 982d06c561a62cf7d2a8d31e8a8c107fb3477419
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate MADT table

      MADT describes GIC enabled ARM platforms. The GICC and GICD
      subtables are used to define the GIC regions.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-10-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c2f7c0c306dcd56725b506d3743eed421e6d0994
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/arm/virt-acpi-build: Generate FADT table and update ACPI headers

      In the case of mach virt, it is used to set the Hardware Reduced bit
      and enable PSCI SMP booting through HVC. So ignore FACS and FADT
      points to DSDT.

      Update the header definitions for FADT taking into account the new
      additions of ACPI v5.1 in `include/hw/acpi/acpi-defs.h`

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-9-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfccd8cfd7c5d1b6740463821d84106bbaced44c
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/arm/virt-acpi-build: Generation of DSDT table for virt devices

      DSDT consists of the usual common table header plus a definition
      block in AML encoding which describes all devices in the platform.

      After initializing DSDT with header information the namespace is
      created which is followed by the device encodings. The devices are
      described using the Resource Template for the 32-Bit Fixed Memory
      Range and the Extended Interrupt Descriptors.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-8-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 205d1d1c04033b1be4c925e687b6865d1fc1b26b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/acpi/aml-build: Add aml_interrupt() term

      Add aml_interrupt() for describing device interrupt in resource template.
      These can be used to generating DSDT table for ACPI on ARM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-7-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dc17ab1de53d37ddcca81b16dfeae839322fbe5a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/acpi/aml-build: Add aml_memory32_fixed() term

      Add aml_memory32_fixed() for describing device mmio region in resource
      template. These can be used to generating DSDT table for ACPI on ARM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-6-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f5d8c8cd792b3712f85a1f9a3a9a719015691975
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt-acpi-build: Basic framework for building ACPI tables on ARM

      Introduce a preliminary framework in virt-acpi-build.c with the main
      ACPI build functions. It exposes the generated ACPI contents to
      guest over fw_cfg.

      The required ACPI v5.1 tables for ARM are:
      - RSDP: Initial table that points to XSDT
      - RSDT: Points to FADT GTDT MADT tables
      - FADT: Generic information about the machine
      - GTDT: Generic timer description table
      - MADT: Multiple APIC description table
      - DSDT: Holds all information about system devices/peripherals, pointed by FADT

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-5-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a1f001be3ea7478cac803d03149cfcfc1fa2094
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt: Record PCIe ranges in MemMapEntry array

      To generate ACPI table for PCIe controller, we need the base and size of
      the PCIe ranges. Record these ranges in MemMapEntry array, then we could
      share and use them for generating ACPI table.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-4-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit afe0b3803f1a5fffe618af5a483d4c9567b5c5b7
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt: Move common definitions to virt.h

      Move some common definitions to virt.h. These will be used by
      generating ACPI tables.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-3-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff80dc7fa8045e2b2531888d965424d2b0e1d1b6
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/acpi/aml-build: Make enum values to be upper case to match coding style

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-2-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1eced713d9913a5c58ba9daa795f10e4c856c49
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Add WFx instruction trap support

      Add support for trapping WFI and WFE instructions to the proper EL when
      SCTLR/SCR/HCR settings apply.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: removed unnecessary tweaking of syn_wfx() prototype;
       use raise_exception();
       don't trap on WFE (and add comment explaining why not);
       remove unnecessary ARM_FEATURE checks;
       trap to EL3, not EL1, if in S-EL0 and SCTLR check fires]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 84549b6dcf9147559ec08b066de673587be6b763
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Don't halt on WFI unless we don't have any work

      Just NOP the WFI instruction if we have work to do.
      This doesn't make much difference currently (though it does avoid
      jumping out to the top level loop and immediately restarting),
      but the distinction between "halt" and "don't halt" will become
      more important when the decision to halt requires us to trap
      to a higher exception level instead.

      Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 647f767ba3b37fb229275086187e96242248a4ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Move TB flags down to fill gap

      Deleting the now-unused ARM_TBFLAG_CPACR_FPEN left a gap in the
      bit usage; move the following ARM_TBFLAG_XSCALE_CPAR and
      ARM_TBFLAG_NS_SHIFT down 3 bits to fill the gap.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 9dbbc748d671c70599101836cd1c2719d92f3017
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Extend FP checks to use an EL

      Extend the ARM disassemble context to take a target exception EL instead of a
      boolean enable. This change reverses the polarity of the check making a value
      of 0 indicate floating point enabled (no exception).

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: Use a common TB flag field for AArch32 and AArch64;
       CPTR_EL2 exists in v7; CPTR_EL2 should trap for EL2 accesses;
       CPTR_EL2 should not trap for secure accesses; CPTR_EL3
       should trap for EL3 accesses; CPACR traps for secure
       accesses should trap to EL3 if EL3 is AArch32]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 3cf6a0fcedd429693d439556543400d5f0e31e1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Make singlestate TB flags common between AArch32/64

      Currently we keep the TB flags PSTATE_SS and SS_ACTIVE in different
      bit positions for AArch64 and AArch32. Replace these separate
      definitions with a single common flag in the upper part of the
      flags word.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit c6f191642a4027909813b4e6e288411f8371e951
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Add AArch64 CPTR registers

      Adds CPTR_EL2/3 system registers definitions and access function.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: merge CPTR_EL2 and HCPTR definitions into a single
       def using STATE_BOTH;
       don't use readfn/writefn to implement RAZ/WI registers;
       don't use accessfn for the no-EL2 CPTR_EL2;
       fix cpacr_access logic to catch EL2 accesses to CPACR being
       trapped to EL3;
       use new CP_ACCESS_TRAP_EL[23] rather than setting
       exception.target_el directly]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 38836a2cd47c20daaaa84873e3d6020f19e4bfca
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Allow cp access functions to indicate traps to EL2 or EL3

      Some coprocessor access functions will need to indicate that the
      instruction should trap to EL2 or EL3 rather than the default
      target exception level; add corresponding CPAccessResult enum
      entries and handling code.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 012a906b19e99b126403ff4a257617dab9b34163
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Update interrupt handling to use target EL

      Updated the interrupt handling to utilize and report through the target EL
      exception field.  This includes consolidating and cleaning up code where
      needed. Target EL is now calculated once in arm_cpu_exec_interrupt() and
      do_interrupt was updated to use the target_el exception field.  The
      necessary code from arm_excp_target_el() was merged in where needed and the
      function removed.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c63285991b371c031147ad620dd7671662a90303
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Make raise_exception() take syndrome and target EL

      Rather than making every caller of raise_exception set the
      syndrome and target EL by hand, make these arguments to
      raise_exception() and have that do the job.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 863b6589d738d0b4c8b283297b0ff228f3d3fb14
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Set exception target EL in tlb_fill

      Set the exception target EL for MMU faults in tlb_fill.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Move setting of exception info into tlb_fill

      Move the code which sets exception information out of
      arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill
      is the only caller which wants to raise_exception()
      so it makes more sense for it to handle the whole of
      the exception setup.

      As part of this cleanup, move the user-mode-only
      implementation function for the handle_mmu_fault CPU
      method into cpu.c so we don't need to make it globally
      visible, and rename the softmmu-only utility function
      arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear
      that it's not the same thing.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f2932df777dace044719dc2f394f5a5a8aa1b1cd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Set correct syndrome for faults on MSR DAIF*, imm

      If the SCTLR.UMA trap bit is set then attempts by EL0 to update
      the PSTATE DAIF bits via "MSR DAIFSet, imm" and "MSR DAIFClr, imm"
      instructions will raise an exception. We were failing to set
      the syndrome information for this exception, which meant that
      it would be reported as a repeat of whatever the previous
      exception was. Set the correct syndrome information.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit e3b1d480995f6e2e86ef062038e618c1234dbcf1
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Extend helpers to route exceptions

      Updated the various helper routines to set the target EL as needed using a
      dedicated function.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-3-git-send-email-greg.bellows@linaro.org
      [PMM: Also set target_el in fault cases in access_check_cp_reg()]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 737103619869600668cc7e8700e4f6eab3943896
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Add exception target el infrastructure

      Add a CPU state exception target EL field that will be used for communicating
      the EL to which an exception should be routed.

      Add a disassembly context field for tracking the EL3 architecture needed for
      determining the target exception EL.

      Add a target EL argument to the generic exception helper for callers to specify
      the EL to which the exception should be routed.  Extended the helper to set
      the newly added CPU state exception target el.

      Added a function for setting the target exception EL and updated calls to helpers
      to call it.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9441aa282bc3213ef0530cab86f318b877bac25c
  Merge: ba7c388 55a1d80
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:23:07 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150529-1' into staging

      kbd: add support for brazilian keyboard (two extra keys).
      input: add virtio-input devices.

      # gpg: Signature made Fri May 29 10:09:02 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150529-1:
        virtio-input: emulated devices [device]
        virtio-input: core code & base class [device]
        virtio-input: add linux/input.h
        kbd: add brazil kbd keys to x11 evdev map
        kbd: add brazil kbd keys to qemu

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 63c67b6d4462b6589b371d55e3740e9f0dba3281
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed May 20 15:35:31 2015 +0200

      gtk: Replace gdk_cursor_new()

      gdk_cursor_new() has been deprecated in GTK 3.16, it is recommended to
      use gdk_cursor_new_for_display() instead, so do that.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 97edf3bd5eab8952d475de66ede77307c12b8c48
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jan 20 12:43:28 2015 +0100

      gtk: add opengl support, using egl

      This adds opengl rendering support to the gtk ui, using egl.
      It's off by default for now, use 'qemu -display gtk,gl=on'
      to play with this.

      Note that gtk got native opengl support with release 3.16.
      There most likely will be a separate implementation for 3.16+,
      using the native gtk opengl support.  This patch covers older
      versions (and for the time being 3.16 too, hopefully without
      rendering quirks).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ba7c388963e099c0d2cedb7f048e30747ffff25d
  Merge: ce0274f f7a8beb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 10:17:48 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150529-1' into staging

      spice: misc fixes.

      # gpg: Signature made Fri May 29 09:16:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150529-1:
        spice: fix spice_chr_add_watch() pre-condition
        spice: don't update mm_time when spice-server is stopped.
        spice-char: notify the server when chardev is writable
        virtio-console: notify chardev when writable

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ced9e9f6da2257224591b91727cfeee4f3977fb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jan 6 15:40:00 2015 +0100

      ui: add egl-helpers

      Add helper functions to initialize OpenGL using egl.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 896e1a050a0d333b1f0ec0768cc64e26c5d0d104
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon May 11 12:25:23 2015 +0200

      ui: shader.h protect against double inclusion

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit dcf30025c3e3d43140a687240433de1920adf8b0
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon May 11 12:24:43 2015 +0200

      ui: use libexpoxy

      libepoxy does the opengl extension handling for us.

      It also is helpful for trouble-shooting as it prints nice error messages
      instead of silently failing or segfaulting in case we do something
      wrong, like using gl commands not supported by the current context.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 55a1d80a41032d6133adec041c0096820beaa1b7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 1 10:06:29 2014 +0200

      virtio-input: emulated devices [device]

      This patch adds the virtio-input-hid base class and
      virtio-{keyboard,mouse,tablet} subclasses building on the base class.
      They are hooked up to the qemu input core and deliver input events
      to the guest like all other hid devices (ps/2 kbd, usb tablet, ...).

      Using them is as simple as adding "-device virtio-tablet-device" to
      your command line, for use all transports except pci.  virtio-pci
      support comes as separate patch, once virtio-pci got virtio 1.0
      support.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f73ddbad397f98c1d476ffbf93d65af1cfa796e6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 14 14:39:20 2014 +0100

      virtio-input: core code & base class [device]

      This patch adds virtio-input support to qemu.  It brings a abstract
      base class providing core support, other classes can build on it to
      actually implement input devices.

      virtio-input basically sends linux input layer events (evdev) over
      virtio.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2fe7c31832a345cdc34314cdcd5478d06b884842
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Mar 19 11:55:24 2015 +0100

      virtio-input: add linux/input.h

      Linux input layer (evdev) header file.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 33aa30cafcce053b833f9fe09fbb88e2f54b93aa
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 26 13:12:54 2015 +0200

      kbd: add brazil kbd keys to x11 evdev map

      This patch adds the two extra brazilian keys to the evdev keymap for
      X11.  This patch gets the two keys going with the vnc, gtk and sdl1
      UIs.

      The SDL2 library complains it doesn't know these keys, so the SDL2
      library must be fixed before we can update ui/sdl2-keymap.h

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b771f470f3e2f99f585eaae68147f0c849fd1f8d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 26 10:39:10 2015 +0200

      kbd: add brazil kbd keys to qemu

      The brazilian computer keyboard layout has two extra keys (compared to
      the usual 105-key intl ps/2 keyboard).  This patch makes these two keys
      known to qemu.

      For historic reasons qemu has two ways to specify a key:  A QKeyCode
      (name-based) or a number (ps/2 scancode based).  Therefore we have to
      update multiple places to make new keys known to qemu:

        (1) The QKeyCode definition in qapi-schema.json
        (2) The QKeyCode <-> number mapping table in ui/input-keymap.c

      This patch does just that.  With this patch applied you can send those
      two keys to the guest using the send-key monitor command.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f7a8beb5e6a13dc924895244777d9ef08b23b367
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Thu May 28 15:04:58 2015 +0200

      spice: fix spice_chr_add_watch() pre-condition

      Since e02bc6de30c44fd668dc0d6e1cd1804f2eed3ed3, add_watch() is called
      with G_IO_HUP. Even if spice-qemu-char ignores this flag, the
      precondition must be changed.

      https://bugzilla.redhat.com/show_bug.cgi?id=1128992

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 641381c1fcd66ea8de07ecfcd733089da26cbba9
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 12 11:54:34 2015 +0200

      spice: don't update mm_time when spice-server is stopped.

      Skip mm_time updates (in qxl device memory) in case the guest is stopped.
      Guest isn't able to look anyway, and it causes problems with migration.

      Also make sure the initial state for spice server is stopped.

      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e95e203c085b7731746e39c9b9f8bd2f6eaa0cd6
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue May 5 16:58:56 2015 +0200

      spice-char: notify the server when chardev is writable

      The spice server is polling on write, unless
      SPICE_CHAR_DEVICE_NOTIFY_WRITABLE flag is set. In this case, qemu must
      call spice_server_char_device_wakeup() when the frontend is writable.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 246ca55faff625f4c15e21f3424781e215a254ea
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue May 5 16:58:55 2015 +0200

      virtio-console: notify chardev when writable

      When the virtio serial is writable, notify the chardev backend
      with qemu_chr_accept_input().

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ce0274f730eacbd24c706523ddbbabb6b95d0659
  Author: Fabien Chouteau <chouteau@adacore.com>
  Date:   Sat Feb 7 09:38:45 2015 +0100

      Revert "gdbstub: Do not kill target in system emulation mode"

      The requirements described in this patch are implemented by "Add GDB
      qAttached support".

      This reverts commit 00e94dbc7fd0110b0555d59592b004333adfb4b8.

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3919386eab91b56e40fb4faead980f57a664b2e
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:44 2015 +0100

      Add GDB qAttached support

      With this patch QEMU handles qAttached request from gdb. When QEMU
      replies 1, GDB sends a "detach" command at the end of a debugging
      session otherwise GDB sends "kill".

      The default value for qAttached is 1 on system emulation and 0 on user
      emulation.

      Based on original version by Fabien Chouteau.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4dabe747af0a6bd66a86c2c7879f1882bec43c33
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:43 2015 +0100

      gdbstub: Introduce an is is_query_packet helper

      This helper supports parsing of query packets with optional extensions.
      The separator can be specified so that we can use it already for both
      qqemu.sstep[=] and qSupported[:feature].

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 070949f39ee96bd16654e6623ab4ff627d918ba6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:42 2015 +0100

      gdbstub: Fix qOffsets packet detection

      qOffsets has no additional optional parameters. So match the complete
      string to avoid stumbling over possible future commands with identical
      prefix.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a84904737277c2f07c8fbcb69db27451d844f12b
  Merge: bc3004f 46ca6b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 28 14:57:34 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150528' into staging

      A set of patches add support for vector registers on s390x.
      Notable: Floating point registers and vector registers overlap,
      so extra care is needed so that we end up with a consistent state
      in all cases.

      # gpg: Signature made Thu May 28 09:37:27 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150528:
        s390x: Enable vector processing capability
        s390x: Migrate vector registers
        s390x: Add vector registers to ELF dump
        linux/elf.h update
        s390x: Add vector registers to HMP output
        s390x: gdb updates for vector registers
        gdb-xml: Include XML for s390 vector registers
        s390x: Store Additional Status SIGP order
        s390x: Vector Register IOCTLs
        s390x: Common access to floating point registers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc3004f0bb28d36b97eea5ff48922d16b4df7a1f
  Merge: 0915aed 2bc22a5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 28 11:03:02 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Wed May 27 11:02:55 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net/net: Record usage status of mac address
        tap: Improve -netdev/netdev_add/-net/... tap error reporting
        tap: Finish conversion of tap_open() to Error
        tap-solaris: Convert tap_open() to Error
        tap-bsd: Convert tap_open() to Error
        tap-linux: Convert tap_open() to Error
        tap: Permit incremental conversion of tap_open() to Error
        tap: Convert launch_script() to Error
        tap: Convert net_init_tap_one() to Error
        tap: Convert tap_set_sndbuf() to Error
        tap: Improve -netdev/netdev_add/-net/... bridge error reporting
        tap: net_tap_fd_init() can't fail, drop dead error handling
        net/dump: Improve -net/host_net_add dump error reporting
        net: Improve -net nic error reporting
        net: Permit incremental conversion of init functions to Error
        net: Improve error message for -net hubport a bit
        net: Change help text to list -netdev instead of -net by default

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46ca6b3bc99ebf9205e28ed14c023ebf84d39bb7
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu Oct 30 09:23:06 2014 -0400

      s390x: Enable vector processing capability

      Everything is finally in place, inform the kernel that user space
      supports vector registers.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b2ac0ff5d9478907cfd5b204c9179f77d0cb943f
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 7 10:52:16 2015 -0400

      s390x: Migrate vector registers

      When migrating a guest, be sure to include the vector registers.
      The vector registers are defined in a subsection, similar to the
      existing subsection for floating point registers.  Since the
      floating point registers are always present (and thus migrated),
      we can skip them when performing the migration of the vector
      registers which may or may not be present.

      Suggested-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 3ceeb2930faf1116ee4bb22c8a7794bb2337e8a9
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 29 14:54:26 2014 -0400

      s390x: Add vector registers to ELF dump

      Create ELF notes for the vector registers where applicable, so that
      their contents can be examined by utilities such as crash or readelf.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit eeef559ab4a80753b7bf31728780692a3a4e3ec1
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Wed Nov 12 14:22:55 2014 -0500

      linux/elf.h update

      Sync with kernel elf.h updates to get s390x vector register definitions.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 56c42271495fc5f6c5bd70c4309a74b425c5cbda
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 29 13:50:37 2014 -0400

      s390x: Add vector registers to HMP output

      There are mechanisms to dump registers via the qemu HMP interface,
      such as the "info registers" command.  Expand this output to dump
      the new vector registers.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ca343c7a84fbe457dd442d26d5a01f31e8a8d308
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Tue Jun 3 08:42:18 2014 -0400

      s390x: gdb updates for vector registers

      gdb allows registers to be displayed/modified, and is being updated
      to account for the new vector registers.  Mirror these changes in
      the gdb stub in qemu so that this can be performed when gdb is
      attached to the qemu gdbserver.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 773d4ebc9a31a5e0efbaf83f76715ab40c355384
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Tue Nov 18 17:03:02 2014 -0500

      gdb-xml: Include XML for s390 vector registers

      Include the vector registers XML file that is provided by gdb,
      and can be used by the qemu gdbserver interface.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit abec53565dce5ed56bff4968d3bed88f6cf68c3c
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Wed Jan 14 09:57:16 2015 -0500

      s390x: Store Additional Status SIGP order

      Add handling for the Store Additional Status at Address order
      that exists for the Signal Processor (SIGP) instruction.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fcb79802e07fe06fe24ba97a027d8a1c3a714fa7
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Mon Aug 18 15:33:39 2014 -0400

      s390x: Vector Register IOCTLs

      Handle the actual syncing of the vector registers with kernel space,
      via the get/put register IOCTLs.

      The vector registers that were introduced with the z13 overlay
      the existing floating point registers.  FP registers 0-15 are
      the high-halves of vector registers 0-15.  Thus, remove the
      freg fields and replace them with the equivalent vector field
      to avoid errors in duplication.  Moreover, synchronize either the
      vector registers via kvm_sync_regs, or floating point registers
      via the GET/SET FPU IOCTLs.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit c498d8e36e2998fb67de21a34ece633d356a4834
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 7 14:35:44 2015 -0400

      s390x: Common access to floating point registers

      Provide a routine to access the correct floating point register,
      to simplify future expansion.

      Suggested-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2bc22a58e16f0650e56dccfac9495e5aef58e2ef
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 21 17:44:48 2015 +0800

      net/net: Record usage status of mac address

      Currently QEMU dynamically generates mac address for the NIC which
      doesn't specify the mac address. But when we hotplug a NIC without
      specifying mac address, the mac address will increase for the same NIC
      along with hotplug and hot-unplug, and at last it will overflow. And if
      we codeplug one NIC with mac address e.g. "52:54:00:12:34:56", then
      hotplug one NIC without specifying mac address and the mac address of
      the hotplugged NIC is duplicate of "52:54:00:12:34:56".

      This patch add a mac_table to record the usage status and free the mac
      address when the NIC is unrealized.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a308817743be5cc051d3379477f54027deb0befb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:03 2015 +0200

      tap: Improve -netdev/netdev_add/-net/... tap error reporting

      When -netdev tap fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -netdev tap,id=foo
          qemu-system-x86_64: -netdev tap,id=foo: could not configure /dev/net/tun: Operation not permitted
          qemu-system-x86_64: -netdev tap,id=foo: Device 'tap' could not be initialized

      With the command line, the messages go to stderr.  In HMP, they go to
      the monitor.  In QMP, the second one becomes the error reply, and the
      first one goes to stderr.

      Convert net_init_tap() to Error.  This suppresses the unwanted second
      message, and makes the specific error the QMP error reply.

      [Dropped duplicate "and" from error message as suggested by Eric Blake:
      "ifname=, script=, downscript=, and vnet_hdr=, "
      "queues=, and vhostfds= are invalid with helper="
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-16-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 95c35a74fea51e307f6a3967e465a22776056b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:02 2015 +0200

      tap: Finish conversion of tap_open() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-15-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 576c6eb6700d241c9d4a6883d25720c7bbaaeccd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:01 2015 +0200

      tap-solaris: Convert tap_open() to Error

      Fixes inappropriate use of syslog().

      Not fixed: leaks on error paths, suspicious non-fatal errors.  FIXMEs
      added instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-14-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4bce487e14bf8949a91883a3213c2b7fa9d668bc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:00 2015 +0200

      tap-bsd: Convert tap_open() to Error

      Fixes inappropriate use of stderr in monitor command handler.

      While there, improve some of the messages a bit.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-13-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47896e2fd3dd80685434b320cb0e10164995e31c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:59 2015 +0200

      tap-linux: Convert tap_open() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-12-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 468dd82408e950d48def28f87e4cffabfd592ace
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:58 2015 +0200

      tap: Permit incremental conversion of tap_open() to Error

      Convert the trivial ones immediately: tap-aix and tap-haiku.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-11-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ac4fcf5639f44f7d863a35eaa2ad07ff31aabc01
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:57 2015 +0200

      tap: Convert launch_script() to Error

      Fixes inappropriate use of stderr in monitor command handler.

      While there, improve the messages some.

      [Fixed Error **err -> Error *err local variable that broke the build.
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-10-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 445f116cabe0c4435590244741ac3d0b8f08d91d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:56 2015 +0200

      tap: Convert net_init_tap_one() to Error

      [Dropped %s from "tap: open vhost char device failed: %s" since
      error_setg_errno() already prints a human-readable error string and
      there is no format string argument.
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-9-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80b832c300c2fc39c68e0ab095d408cb9199cfa0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:55 2015 +0200

      tap: Convert tap_set_sndbuf() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-8-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a8a21be9855e0bb0947a7325d0d1741a8814f21e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:54 2015 +0200

      tap: Improve -netdev/netdev_add/-net/... bridge error reporting

      When -netdev bridge fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -netdev bridge,id=foo
          failed to launch bridge helper
          qemu-system-x86_64: -netdev bridge,id=foo: Device 'bridge' could not be initialized

      The first message goes to stderr.  Wrong for HMP, because errors need
      to go to the monitor there.

      The second message goes to stderr for -netdev, to the monitor for HMP
      netdev_add, and becomes the error reply for QMP netdev_add.

      Convert net_bridge_run_helper() to Error, and propagate its errors
      through net_init_bridge().  This ensures the error gets reported where
      the user is, and suppresses the unwanted second message.

      While there, improve the error messages a bit.

      The above example becomes:

          $ qemu-system-x86_64 -netdev bridge,id=foo
          qemu-system-x86_64: -netdev bridge,id=foo: bridge helper failed

      net_init_tap() also uses net_bridge_run_helper().  Propagate its
      errors there as well.  Improves reporting these errors with -netdev
      tap & friends.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-7-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da4a4eac26381c7fce3f147f3c8a7e7bb483be1e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:53 2015 +0200

      tap: net_tap_fd_init() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-6-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3791f83ca999edc2d11eb2006ccc1091cd712c15
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:52 2015 +0200

      net/dump: Improve -net/host_net_add dump error reporting

      When -net dump fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -net dump,id=foo,file=/eperm
          qemu-system-x86_64: -net dump,id=foo,file=/eperm: -net dump: can't open /eperm
          qemu-system-x86_64: -net dump,id=foo,file=/eperm: Device 'dump' could not be initialized

      Convert net_init_tap() to Error.  This suppresses the unwanted second
      message.

      Improve the error messages to include strerror(errno) where
      appropriate.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-5-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6630886863d4a9b3b7bcb3b0e2895d83eb269c75
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:51 2015 +0200

      net: Improve -net nic error reporting

      When -net nic fails, it first reports a specific error, then a generic
      one, like this:

          $ qemu-system-x86_64 -net nic,netdev=nonexistent
          qemu-system-x86_64: -net nic,netdev=nonexistent: netdev 'nonexistent' not found
          qemu-system-x86_64: -net nic,netdev=nonexistent: Device 'nic' could not be initialized

      Convert net_init_nic() to Error to get rid of the unwanted second
      error message.

      While there, tidy up an Overcapitalized Error Message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-4-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a30ecde6e795682d1473c45acae66a60a76fca2f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:50 2015 +0200

      net: Permit incremental conversion of init functions to Error

      Error reporting for netdev_add is broken: the net_client_init_fun[]
      report the actual errors with (at best) error_report(), and their
      caller net_client_init1() makes up a generic error on top.

      For command line and HMP, this produces an mildly ugly error cascade.

      In QMP, the actual errors go to stderr, and the generic error becomes
      the command's error reply.

      To fix this, we need to convert the net_client_init_fun[] to Error.

      To permit fixing them one by one, add an Error ** parameter to the
      net_client_init_fun[].  If the call fails without returning an Error,
      make up the same generic Error as before.  But if it returns one, use
      that instead.  Since none of them does so far, no functional change.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-3-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca7eb1848bb06d9b75784d7760b83c7b0beb1102
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:49 2015 +0200

      net: Improve error message for -net hubport a bit

      Type "hubport" is valid only with -netdev.  Unfortunately, that's
      detected late and the error message doesn't explain why:

          $ qemu-system-i386 -net hubport,id=foo,hubid=0
          qemu-system-i386: -net hubport,id=foo,hubid=0: Device 'hubport' could not be initialized

      Improve the error message to "Parameter 'type' expects a net type".

      Not fixed: -net hubport without the parameters required by -netdev
      hubport still asks for those parameters:

          $ qemu-system-i386 -net hubport
          qemu-system-i386: -net hubport: Parameter 'hubid' is missing

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-2-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6a8b4a5be21ad4941c8a6a5db1d355a522aea2fb
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Fri May 15 16:58:24 2015 +0200

      net: Change help text to list -netdev instead of -net by default

      Looking at the output of "qemu-system-xxx -help", you easily get
      the impression that "-net" is the preferred way instead of "-netdev"
      to specify host network interface, since the "-net" option is
      omnipresent but the "-netdev" option is only listed as a one-liner
      at the end. This is ugly since "-net" is considered as legacy and
      even might be removed one day. Thus, this patch switches the output
      to explain the host network interfaces with the "-netdev" option
      instead, moving the old "-net" option into some few lines at
      the end.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1431701904-12230-1-git-send-email-thuth@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0915aed5842bd4dbe396b92d4f3b846ae29ad663
  Merge: 0d2ed60 cd6cb73
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 11:31:03 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri May 22 20:58:44 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: do not remap clb/fis unconditionally
        macio: move unaligned DMA write code into separate pmac_dma_write() function
        macio: move unaligned DMA read code into separate pmac_dma_read() function
        qtest: pre-buffer hex nibs
        libqos/ahci: Swap memread/write with bufread/write
        qtest: add memset to qtest protocol
        qtest: Add base64 encoded read/write
        qtest: allow arbitrarily long sends
        qtest/ahci: add migrate halted dma test
        qtest/ahci: add halted dma test
        qtest/ahci: add flush migrate test
        qtest/ahci: add migrate dma test
        qtest/ahci: Add migration test
        ich9/ahci: Enable Migration
        libqos: Add migration helpers
        libqos/ahci: Fix sector set method
        libqos/ahci: Add halted command helpers
        glib: remove stale compat functions
        configure: require glib 2.22

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cd6cb73beb63e5fa62ca8ed540b9d54063b15c44
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      ahci: do not remap clb/fis unconditionally

      This continues the IOMMU fix from 2.3, where we should not attempt
      to remap the CLB or FIS RX buffers if the AHCI device is currently
      running.

      The same applies to migration: keep our mitts off these registers
      unless the device is supposed to be on.

      Does not impact backwards compatibility for the AHCI device.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1431470173-30847-2-git-send-email-jsnow@redhat.com

  commit bd4214fc92090694aefa17882815c6109f0fd70c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri May 22 14:13:44 2015 -0400

      macio: move unaligned DMA write code into separate pmac_dma_write() function

      Similarly switch the macio IDE routines over to use the new function and
      tidy-up the remaining code as required.

      [Maintainer edit: printf format codes adjusted for 32/64bit. --js]

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1425939893-14404-3-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 4827ac1e8f8306b24e61b44ea1f2082ea08099bb
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri May 22 14:13:44 2015 -0400

      macio: move unaligned DMA read code into separate pmac_dma_read() function

      This considerably helps simplify the complexity of the macio read routines and
      by switching macio CDROM accesses to use the new code, fixes the issue with
      the CDROM device being detected intermittently by Darwin/OS X.

      [Maintainer edit: printf format codes adjusted for 32/64bit. --js]

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ailande.co.uk>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1425939893-14404-2-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 5560b85a31e6f15a8841b66620d9497943094ee4
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: pre-buffer hex nibs

      Instead of converting each byte one-at-a-time and then sending each byte
      over the wire, use sprintf() to pre-compute all of the hex nibs into a
      single buffer, then send the entire buffer all at once.

      This gives a moderate speed boost to memread() and memwrite() functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1431021095-7558-2-git-send-email-jsnow@redhat.com

  commit 91d0374a7ffbd6a9cd0ba159c9160d9f26220cf5
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      libqos/ahci: Swap memread/write with bufread/write

      Where it makes sense, use the new faster primitives.
      For generally small reads/writes such as for the PRDT
      and FIS packets, stick with the more wasteful but
      easier to debug memread/memwrite.

      For ahci-test (before migration tests):
      With this patch:
      real    0m3.675s
      user    0m2.582s
      sys     0m1.718s

      Without any qtest protocol improvements:
      real    0m14.171s
      user    0m12.072s
      sys     0m12.527s

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-6-git-send-email-jsnow@redhat.com

  commit 4d00796364ec4edab86b08abc38fd644d5e3c0ad
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: add memset to qtest protocol

      Previously, memset was just a frontend to write() and only
      stupidly sent the pattern many times across the wire.

      Let's not discuss who stupidly wrote it like that in the first place.
      (Hint: It was me.)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-4-git-send-email-jsnow@redhat.com

  commit 7a6a740d8dcc02f5693315d7935b5de9b963bb96
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: Add base64 encoded read/write

      For larger pieces of data that won't need to be debugged and
      viewing the hex nibbles is unlikely to be useful, we can encode
      data using base64 instead of encoding each byte as %02x, which
      leads to some space savings and faster reads/writes.

      For now, the default is left as hex nibbles in memwrite() and memread().
      For the purposes of making qtest io easier to read and debug, some
      callers may want to specify using the old encoding format for small
      patches of data where the savings from base64 wouldn't be that profound.

      memwrite/memread use a data encoding that takes 2x the size of the original
      buffer, but base64 uses "only" (4/3)x, so for larger buffers we can save a
      decent amount of time and space.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-3-git-send-email-jsnow@redhat.com

  commit 332cc7e9b39ddb2feacb4c71dcd18c3e5b0c3147
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest: allow arbitrarily long sends

      qtest currently has a static buffer of size 1024 that if we
      overflow, ignores the additional data silently which leads
      to hangs or stream failures.

      Use glib's string facilities to allow arbitrarily long data,
      but split this off into a new function, qtest_sendf.

      Static data can still be sent using qtest_send, which avoids
      the malloc/copy overhead.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1430864578-22072-2-git-send-email-jsnow@redhat.com

  commit 5d1cf0917b4f1282ac81bb72697713d14c98a876
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add migrate halted dma test

      Test migrating a halted DMA transaction.
      Resume, then test data integrity.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-10-git-send-email-jsnow@redhat.com

  commit 189d1b6126625212fbb50ed3a30a3e9e7ba7ca37
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add halted dma test

      If we're going to test the migration of halted DMA jobs,
      we should probably check to make sure we can resume them
      locally as a first step.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-9-git-send-email-jsnow@redhat.com

  commit a606ce50c29561b567995ab663cbb40067623e82
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add flush migrate test

      Use blkdebug to inject an error on first flush, then attempt to flush
      on the first guest. When the error halts the VM, migrate to the
      second VM, and attempt to resume the command.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-8-git-send-email-jsnow@redhat.com

  commit 88e21f9485f0a41603f0af3483ff3f11c95979ab
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add migrate dma test

      Write to one guest, migrate, and then read from the other.
      adjust ahci_io to clear any buffers it creates, so that we
      can use ahci_io safely on both guests knowing we are using
      empty buffers and not accidentally re-using data.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-7-git-send-email-jsnow@redhat.com

  commit 278128ab06c36341edb2c8b0bfcfd92760f4db52
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: Add migration test

      Notes:

       * The migration is performed on QOSState objects.

       * The migration is performed in such a way that it does not assume
         consistency between the allocators attached to each. That is to say,
         you can use each QOSState object completely independently and then at
         an arbitrary point decide to migrate, and the destination object will
         now be consistent with the memory within the source guest. The source
         object that was migrated from will have a completely blank allocator.

      ahci-test.c:
       - verify_state is added
       - ahci_migrate is added as a frontend to migrate
       - test_migrate_sanity test case is added.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-6-git-send-email-jsnow@redhat.com

  commit 04329029a8c539eb5f75dcb6d8b016f0c53a031a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      ich9/ahci: Enable Migration

      Lift the flag preventing the migration of the ICH9/AHCI devices.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-5-git-send-email-jsnow@redhat.com

  commit 085248ae87704f1c1e4e1f929f58beca3ba294a2
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      libqos: Add migration helpers

      libqos.c:
          -set_context for addressing which commands go where
          -migrate performs the actual migration

      malloc.c:
          - Structure of the allocator is adjusted slightly with
            a second-tier malloc to make swapping around the allocators
            easy when we "migrate" the lists from the source to the destination.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-4-git-send-email-jsnow@redhat.com

  commit 455e861cc625891baacf74e66c31a914883b80ca
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      libqos/ahci: Fix sector set method

      || probably does not mean the same thing as |.

      Additionally, allow users to submit a prd_size of 0
      to indicate that they'd like to continue using the default.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-3-git-send-email-jsnow@redhat.com

  commit 008b6e123ff2ee421112768e838b0b44bc7f6c45
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      libqos/ahci: Add halted command helpers

      Sometimes we want a command to halt the VM instead
      of complete successfully, so it'd be nice to let the
      libqos/ahci functions cope with such scenarios.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-2-git-send-email-jsnow@redhat.com

  commit 62754b157156c2cd26a00ce534aeec9e74619d95
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      glib: remove stale compat functions

      Since we're bumping the version to 2.22+,
      remove the now-stale compat functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431469140-22208-2-git-send-email-jsnow@redhat.com

  commit f40685c62b802c8c3f5c914e8d357dd5c4d4f9cc
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      configure: require glib 2.22

      This provides g_ptr_array_new_with_free_func, as well as a few
      other functions that we've been hacking around in glib-compat.h.
      Cleaning up the compatibility headers will come later.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431469140-22208-2-git-send-email-jsnow@redhat.com

  commit 0d2ed6039cf86fe3a78671e32b5e3eb17d725762
  Merge: bb2fa17 4120201
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 17:20:09 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer core and image format patches

      # gpg: Signature made Fri May 22 16:21:03 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (22 commits)
        MAINTAINERS: Split "Block QAPI, monitor, command line" off core
        MAINTAINERS: Add header files to Block Layer Core section
        tests: add test case for encrypted qcow2 read/write
        qemu-io: prompt for encryption keys when required
        util: allow \n to terminate password input
        util: move read_password method out of qemu-img into osdep/oslib
        qcow2/qcow: protect against uninitialized encryption key
        qemu-iotests: Make debugging python tests easier
        qemu-iotests: qemu-img info on afl VMDK image with a huge capacity
        block: Detect multiplication overflow in bdrv_getlength
        qemu-io: Use getopt() correctly
        qcow2: style fixes in qcow2-cache.c
        qcow2: make qcow2_cache_put() a void function
        qcow2: use a hash to look for entries in the L2 cache
        qcow2: remove qcow2_cache_find_entry_to_replace()
        qcow2: use an LRU algorithm to replace entries from the L2 cache
        qcow2: simplify qcow2_cache_put() and qcow2_cache_entry_mark_dirty()
        qcow2: use one single memory block for the L2/refcount cache tables
        vmdk: Fix overflow if l1_size is 0x20000000
        vmdk: Fix next_cluster_sector for compressed write
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bb2fa17f182ee0b45b53474f76679944fc891f04
  Merge: 8b6db32 9371557
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 16:22:42 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150522' into staging

      TriCore v1.6.1 ISA and missing v1.6 instructions

      # gpg: Signature made Fri May 22 16:02:45 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150522:
        target-tricore: add RR_DIV and RR_DIV_U instructions of the v1.6 ISA
        target-tricore: add FRET instructions of the v1.6 ISA
        target-tricore: add FCALL instructions of the v1.6 ISA
        target-tricore: add SYS_RESTORE instruction of the v1.6 ISA
        target-tricore: add RR_CRC32 instruction of the v1.6.1 ISA
        target-tricore: add SWAPMSK instructions of the v1.6.1 ISA
        target-tricore: add CMPSWP instructions of the v1.6.1 ISA
        target-tricore: Add SRC_MOV_E instruction of the v1.6 ISA
        target-tricore: introduce ISA v1.6.1 feature
        target-tricore: Add ISA v1.3.1 cpu and fix tc1796 to using v1.3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4120201d2fcfc24404fe6eb6b761b66bc35bca16
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 20 13:23:46 2015 +0200

      MAINTAINERS: Split "Block QAPI, monitor, command line" off core

      Kevin and Stefan asked me to take care of this part.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c346e0bb9300afe3036560c21baa7fdfb253d9b
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed May 20 12:03:17 2015 +0200

      MAINTAINERS: Add header files to Block Layer Core section

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f7ac119cfac735b24412db8d53b9be13e5ff23b0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:22 2015 +0100

      tests: add test case for encrypted qcow2 read/write

      Add a simple test case for qemu-iotests that covers read/write
      with encrypted qcow2 files.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8caf02127e92939fff39b63a7ff1a5834d320191
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:21 2015 +0100

      qemu-io: prompt for encryption keys when required

      The qemu-io tool does not check if the image is encrypted so
      historically would silently corrupt the sectors by writing
      plain text data into them instead of cipher text. The earlier
      commit turns this mistake into a fatal abort, so check for
      encryption and prompt for key when required.

      This enables us to add unit tests to ensure we don't break
      the ability of qemu-img to convert existing encrypted qcow2
      files into a non-encrypted format.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6a11d5183fb7564a3d32007b46846312fd61a1c5
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:20 2015 +0100

      util: allow \n to terminate password input

      The qemu_read_password() method looks for \r to terminate the
      reading of the a password. This is what will be seen when
      reading the password from a TTY. When scripting though, it is
      useful to be able to send the password via a pipe, in which
      case we must look for \n to terminate password input.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d57e4e482e3997b1382625c84149ad0b69155fc0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:19 2015 +0100

      util: move read_password method out of qemu-img into osdep/oslib

      The qemu-img.c file has a read_password() method impl that is
      used to prompt for passwords on the console, with impls for
      POSIX and Windows. This will be needed by qemu-io.c too, so
      move it into the QEMU osdep/oslib files where it can be shared
      without code duplication

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8336aafae1451d54c81dd2b187b45f7c45d2428e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:18 2015 +0100

      qcow2/qcow: protect against uninitialized encryption key

      When a qcow[2] file is opened, if the header reports an
      encryption method, this is used to set the 'crypt_method_header'
      field on the BDRVQcow[2]State struct, and the 'encrypted' flag
      in the BDRVState struct.

      When doing I/O operations, the 'crypt_method' field on the
      BDRVQcow[2]State struct is checked to determine if encryption
      needs to be applied.

      The crypt_method_header value is copied into crypt_method when
      the bdrv_set_key() method is called.

      The QEMU code which opens a block device is expected to always
      do a check

         if (bdrv_is_encrypted(bs)) {
             bdrv_set_key(bs, ....key...);
         }

      If code forgets to do this, then 'crypt_method' is never set
      and so when I/O is performed, QEMU writes plain text data
      into a sector which is expected to contain cipher text, or
      when reading, will return cipher text instead of plain
      text.

      Change the qcow[2] code to consult bs->encrypted when deciding
      whether encryption is required, and assert(s->crypt_method)
      to protect against cases where the caller forgets to set the
      encryption key.

      Also put an assert in the set_key methods to protect against
      the case where the caller sets an encryption key on a block
      device that does not have encryption

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aa4f592a1dd9aea5f5c36f6ff4b22b5bd208162a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon May 18 09:39:12 2015 +0800

      qemu-iotests: Make debugging python tests easier

      Adding "-d" option. The output goes to "tee" so it appears in your
      console. Also, raise the verbosity of unnitest runner.

      When testing a topic branch, it's possible that a bug introduced by a
      code change makes the python test case hang, with debug output, it is
      much easier to locate the problem.

      This can also be helpful if you want to watch the progress of a python
      test, it offers you a way to sense the speed of each test case method
      you're writing.

      Note: because there is no easy way to get *both* the verbose output and
      the output expected by ./check comparison, the case would always fail
      with an "output mismatch". The sole purpose of using this option is
      giving developers a quick way to debug when things go wrong.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b93bbf4ee9035ae077679482305d5beb38df4d7d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 15 16:36:06 2015 +0800

      qemu-iotests: qemu-img info on afl VMDK image with a huge capacity

      The image is contributed by Richard W.M. Jones.

      Cc: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4a9c9ea0d318bec2f67848c5ceaf4ad5bcb91d09
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 15 16:36:05 2015 +0800

      block: Detect multiplication overflow in bdrv_getlength

      Bogus image may have a large total_sectors that will overflow the
      multiplication. For cleanness, fix the return code so the error message
      will be meaningful.

      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b062ad86dcd33ab39be5060b0655d8e13834b167
  Author: Eric Blake <eblake@redhat.com>
  Date:   Tue May 12 09:10:56 2015 -0600

      qemu-io: Use getopt() correctly

      POSIX says getopt() returns -1 on completion.  While Linux happens
      to define EOF as -1, this definition is not required by POSIX, and
      there may be platforms where checking for EOF instead of -1 would
      lead to an infinite loop.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d1b4efe5c4088fd2289e39b95bbdf73b3dcb7432
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:59 2015 +0300

      qcow2: style fixes in qcow2-cache.c

      Fix pointer declaration to make it consistent with the rest of the
      code.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a3f1afb43a09e4577571c044c48f2ba9e6e4ad06
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:58 2015 +0300

      qcow2: make qcow2_cache_put() a void function

      This function never receives an invalid table pointer, so we can make
      it void and remove all the error checking code.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 812e4082cae73e12fd425cace4fd3a715a7c1d32
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:57 2015 +0300

      qcow2: use a hash to look for entries in the L2 cache

      The current cache algorithm traverses the array starting always from
      the beginning, so the average number of comparisons needed to perform
      a lookup is proportional to the size of the array.

      By using a hash of the offset as the starting point, lookups are
      faster and independent from the array size.

      The hash is computed using the cluster number of the table, multiplied
      by 4 to make it perform better when there are collisions.

      In my tests, using a cache with 2048 entries, this reduces the average
      number of comparisons per lookup from 430 to 2.5.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fdfbca82a0874916007ca76323cd35f2af8a2ef3
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:56 2015 +0300

      qcow2: remove qcow2_cache_find_entry_to_replace()

      A cache miss means that the whole array was traversed and the entry
      we were looking for was not found, so there's no need to traverse it
      again in order to select an entry to replace.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2693310eccccf8351678ddd6f3b050163e51dba0
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:55 2015 +0300

      qcow2: use an LRU algorithm to replace entries from the L2 cache

      The current algorithm to evict entries from the cache gives always
      preference to those in the lowest positions. As the size of the cache
      increases, the chances of the later elements of being removed decrease
      exponentially.

      In a scenario with random I/O and lots of cache misses, entries in
      positions 8 and higher are rarely (if ever) evicted. This can be seen
      even with the default cache size, but with larger caches the problem
      becomes more obvious.

      Using an LRU algorithm makes the chances of being removed from the
      cache independent from the position.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit baf07d60f5c5d5d0f0c9e844cde75691f1ceb3d1
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:54 2015 +0300

      qcow2: simplify qcow2_cache_put() and qcow2_cache_entry_mark_dirty()

      Since all tables are now stored together, it is possible to obtain
      the position of a particular table directly from its address, so the
      operation becomes O(1).

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 72e80b89015bab196f0f0e83b12b0eee75fa0574
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:53 2015 +0300

      qcow2: use one single memory block for the L2/refcount cache tables

      The qcow2 L2/refcount cache contains one separate table for each cache
      entry. Doing one allocation per table adds unnecessary overhead and it
      also requires us to store the address of each table separately.

      Since the size of the cache is constant during its lifetime, it's
      better to have an array that contains all the tables using one single
      allocation.

      In my tests measuring freshly created caches with sizes 128MB (L2) and
      32MB (refcount) this uses around 10MB of RAM less.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 13c4941cdd8685d28c7e3a09e393a5579b58db46
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 5 17:28:13 2015 +0800

      vmdk: Fix overflow if l1_size is 0x20000000

      Richard Jones caught this bug with afl fuzzer.

      In fact, that's the only possible value to overflow (extent->l1_size =
      0x20000000) l1_size:

      l1_size = extent->l1_size * sizeof(long) => 0x80000000;

      g_try_malloc returns NULL because l1_size is interpreted as negative
      during type casting from 'int' to 'gsize', which yields a enormous
      value. Hence, by coincidence, we get a "not too bad" behavior:

      qemu-img: Could not open '/tmp/afl6.img': Could not open
      '/tmp/afl6.img': Cannot allocate memory

      Values larger than 0x20000000 will be refused by the validation in
      vmdk_add_extent.

      Values smaller than 0x20000000 will not overflow l1_size.

      Cc: qemu-stable@nongnu.org
      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5e82a31eb967db135fc4e688b134fb0972d62de3
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 6 20:23:46 2015 +0800

      vmdk: Fix next_cluster_sector for compressed write

      This fixes the bug introduced by commit c6ac36e (vmdk: Optimize cluster
      allocation).

      Sometimes, write_len could be larger than cluster size, because it
      contains both data and marker.  We must advance next_cluster_sector in
      this case, otherwise the image gets corrupted.

      Cc: qemu-stable@nongnu.org
      Reported-by: Antoni Villalonga <qemu-list@friki.cat>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aacd5650c68ef2e9e19079ba60cb0df51e15880c
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Apr 30 11:44:17 2015 +0200

      nvme: support NVME_VOLATILE_WRITE_CACHE feature

      The SCSI emulation in the Linux NVMe driver really wants to know
      if a device has a volatile write cache.  Given that qemu has moved
      away from a model where we report the backing store WCE bit to
      one where the WCE bit is supposed to be part of the migratable
      guest-visible state we always return 1 here.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ecbda7a22576591a84f44de1be0150faf6001f1c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed May 6 13:21:51 2015 +0200

      qcow2: Flush pending discards before allocating cluster

      Before a freed cluster can be reused, pending discards for this cluster
      must be processed.

      The original assumption was that this was not a problem because discards
      are only cached during discard/write zeroes operations, which are
      synchronous so that no concurrent write requests can cause cluster
      allocations.

      However, the discard/write zeroes operation itself can allocate a new L2
      table (and it has to in order to put zero flags there), so make sure we
      can cope with the situation.

      This fixes https://bugs.launchpad.net/bugs/1349972.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 9371557115a734412974f8d4096cbe8a62ca2731
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon May 11 14:59:55 2015 +0200

      target-tricore: add RR_DIV and RR_DIV_U instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0e045f43c45f675711c3f6836118dc7eabcc2411
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 22:46:50 2015 +0200

      target-tricore: add FRET instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 9e14a7b24f4cff93da664fdcfecad41fbd229e2b
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 22:38:16 2015 +0200

      target-tricore: add FCALL instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit bc3551c43308dd77bc1cc9a4e39962b2afd4dffc
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 21:25:42 2015 +0200

      target-tricore: add SYS_RESTORE instruction of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e5c96c82bc529674b61eacd221734abc2674e264
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 19:55:37 2015 +0200

      target-tricore: add RR_CRC32 instruction of the v1.6.1 ISA

      This instruction was introduced by the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ddd8cebe3106bdfb2681d8d283296199fd6c7417
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:57:10 2015 +0200

      target-tricore: add SWAPMSK instructions of the v1.6.1 ISA

      Those instruction were introduced in the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 62872ebc38d700ea30b0cd861e40703dccdcae2a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:47:39 2015 +0200

      target-tricore: add CMPSWP instructions of the v1.6.1 ISA

      Those instruction were introduced in the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fcecf12684e1169653df72ed307ec2a82ca69b18
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:22:45 2015 +0200

      target-tricore: Add SRC_MOV_E instruction of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 6d2afc8a5edc042e4e7c2ceb49f7cabe02aae793
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:18:41 2015 +0200

      target-tricore: introduce ISA v1.6.1 feature

      The aurix platform contains of several different cpu models and uses
      the 1.6.1 ISA. This patch changes the generic aurix model to the more
      specific tc27x cpu model and sets specific features.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fd5ecf31d4c48651de97c1aaf8771762753de9a7
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Mar 22 12:49:12 2015 +0000

      target-tricore: Add ISA v1.3.1 cpu and fix tc1796 to using v1.3

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 8b6db32a4ec47d1171ccfa21d557096b99f4eef0
  Merge: f5790c3 a53f1a9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 13:25:40 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri May 22 10:00:53 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (38 commits)
        block: get_block_status: use "else" when testing the opposite condition
        qemu-iotests: Test unaligned sub-block zero write
        block: Fix NULL deference for unaligned write if qiov is NULL
        Revert "block: Fix unaligned zero write"
        block: align bounce buffers to page
        block: minimal bounce buffer alignment
        block: return EPERM on writes or discards to read-only devices
        configure: Add workaround for ccache and clang
        configure: silence glib unknown attribute __alloc_size__
        configure: factor out supported flag check
        configure: handle clang -nopie argument warning
        block/parallels: improve image writing performance further
        block/parallels: optimize linear image expansion
        block/parallels: add prealloc-mode and prealloc-size open paramemets
        block/parallels: delay writing to BAT till bdrv_co_flush_to_os
        block/parallels: create bat_entry_off helper
        block/parallels: improve image reading performance
        iotests, parallels: check for incorrectly closed image in tests
        block/parallels: implement incorrect close detection
        block/parallels: implement parallels_check method of block driver
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f5790c3bc81702c98c7ddadedb274758cff8cbe7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 12:30:13 2015 +0100

      Revert "target-alpha: Add vector implementation for CMPBGE"

      This reverts commit 32ad48abd74a997220b841e4e913edeb267aa362.

      Unfortunately the SSE2 code here fails to compile on some versions
      of gcc:
       target-alpha/int_helper.c:77:24: error: invalid operands to binary >=
       (have '__vector(16) unsigned char' and '__vector(16) unsigned char')

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 27e1259a69c49ee2dd53385f4ca4ca14b822191d
  Merge: 9e549d3 32ad48a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 10:06:33 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-axp-20150521' into staging

      Rewrite fp exceptions

      # gpg: Signature made Thu May 21 18:35:52 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-axp-20150521:
        target-alpha: Add vector implementation for CMPBGE
        target-alpha: Rewrite helper_zapnot
        target-alpha: Raise IOV from CVTQL
        target-alpha: Suppress underflow from CVTTQ if DNZ
        target-alpha: Raise EXC_M_INV properly for fp inputs
        target-alpha: Disallow literal operand to 1C.30 to 1C.37
        target-alpha: Implement WH64EN
        target-alpha: Fix integer overflow checking insns
        target-alpha: Fix cvttq vs inf
        target-alpha: Fix cvttq vs large integers
        target-alpha: Raise IOV from CVTTQ
        target-alpha: Set EXC_M_SWC for exceptions from /S insns
        target-alpha: Set fpcr_exc_status even for disabled exceptions
        target-alpha: Tidy FPCR representation
        target-alpha: Set PC correctly for floating-point exceptions
        target-alpha: Forget installed round mode after MT_FPCR
        target-alpha: Rename floating-point subroutines
        target-alpha: Move VAX helpers to a new file

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a53f1a95f9605f300fbafbc8b60b8a8c67e9c4b4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 14 12:35:02 2015 +0200

      block: get_block_status: use "else" when testing the opposite condition

      A bit of Boolean algebra (and common sense) tells us that the
      second "if" here is looking for blocks that are not allocated.
      This is the opposite of the "if" that sets BDRV_BLOCK_ALLOCATED,
      and thus it can use an "else".

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1431599702-10431-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ab53c44718305d3fde3d9d2251889f1cab694be2
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:12:01 2015 +0000

      qemu-iotests: Test unaligned sub-block zero write

      Test zero write in byte range 512~1024 for 4k alignment.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431522721-3266-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9eeb6dd1b27bd57eb4e3869290e87feac8e8b226
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:12:00 2015 +0000

      block: Fix NULL deference for unaligned write if qiov is NULL

      For zero write, callers pass in NULL qiov (qemu-io "write -z" or
      scsi-disk "write same").

      Commit fc3959e466 fixed bdrv_co_write_zeroes which is the common case
      for this bug, but it still exists in bdrv_aio_write_zeroes. A simpler
      fix would be in bdrv_co_do_pwritev which is the NULL dereference point
      and covers both cases.

      So don't access it in bdrv_co_do_pwritev in this case, use three aligned
      writes.

      [Initialize ret to 0 in bdrv_co_do_zero_pwritev() to avoid uninitialized
      variable warning with gcc 4.9.2.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1431522721-3266-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d01c07f2221ca39ab2dd9e55932d99db98103b30
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:11:59 2015 +0000

      Revert "block: Fix unaligned zero write"

      This reverts commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05.

      The core write code already handles the case, so remove this
      duplication.

      Because commit 61007b316 moved the touched code from block.c to
      block/io.c, the change is manually reverted.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431522721-3266-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 459b4e66129d091a11e9886ecc15a8bf9f7f3d92
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue May 12 17:30:56 2015 +0300

      block: align bounce buffers to page

      The following sequence
          int fd = open(argv[1], O_RDWR | O_CREAT | O_DIRECT, 0644);
          for (i = 0; i < 100000; i++)
                  write(fd, buf, 4096);
      performs 5% better if buf is aligned to 4096 bytes.

      The difference is quite reliable.

      On the other hand we do not want at the moment to enforce bounce
      buffering if guest request is aligned to 512 bytes.

      The patch changes default bounce buffer optimal alignment to
      MAX(page size, 4k). 4k is chosen as maximal known sector size on real
      HDD.

      The justification of the performance improve is quite interesting.
      From the kernel point of view each request to the disk was split
      by two. This could be seen by blktrace like this:
        9,0   11  1     0.000000000 11151  Q  WS 312737792 + 1023 [qemu-img]
        9,0   11  2     0.000007938 11151  Q  WS 312738815 + 8 [qemu-img]
        9,0   11  3     0.000030735 11151  Q  WS 312738823 + 1016 [qemu-img]
        9,0   11  4     0.000032482 11151  Q  WS 312739839 + 8 [qemu-img]
        9,0   11  5     0.000041379 11151  Q  WS 312739847 + 1016 [qemu-img]
        9,0   11  6     0.000042818 11151  Q  WS 312740863 + 8 [qemu-img]
        9,0   11  7     0.000051236 11151  Q  WS 312740871 + 1017 [qemu-img]
        9,0    5  1     0.169071519 11151  Q  WS 312741888 + 1023 [qemu-img]
      After the patch the pattern becomes normal:
        9,0    6  1     0.000000000 12422  Q  WS 314834944 + 1024 [qemu-img]
        9,0    6  2     0.000038527 12422  Q  WS 314835968 + 1024 [qemu-img]
        9,0    6  3     0.000072849 12422  Q  WS 314836992 + 1024 [qemu-img]
        9,0    6  4     0.000106276 12422  Q  WS 314838016 + 1024 [qemu-img]
      and the amount of requests sent to disk (could be calculated counting
      number of lines in the output of blktrace) is reduced about 2 times.

      Both qemu-img and qemu-io are affected while qemu-kvm is not. The guest
      does his job well and real requests comes properly aligned (to page).

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431441056-26198-3-git-send-email-den@openvz.org
      CC: Paolo Bonzini <pbonzini@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4196d2f0308cb1ae13ed450424ab7dfe154acda9
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue May 12 17:30:55 2015 +0300

      block: minimal bounce buffer alignment

      The patch introduces new concept: minimal memory alignment for bounce
      buffers. Original so called "optimal" value is actually minimal required
      value for aligment. It should be used for validation that the IOVec
      is properly aligned and bounce buffer is not required.

      Though, from the performance point of view, it would be better if
      bounce buffer or IOVec allocated by QEMU will be aligned stricter.

      The patch does not change any alignment value yet.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431441056-26198-2-git-send-email-den@openvz.org
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit eaf5fe2dd4ec001d645ff3b343f466457badaa64
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 7 17:45:48 2015 +0200

      block: return EPERM on writes or discards to read-only devices

      This is the behavior in the operating system, for example Linux's
      blkdev_write_iter has the following:

              if (bdev_read_only(I_BDEV(bd_inode)))
                      return -EPERM;

      This does not apply to opening a device for read/write, when the
      device only supports read-only operation.  In this case any of
      EACCES, EPERM or EROFS is acceptable depending on why writing is
      not possible.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1431013548-22492-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fd0e60530f10078f488fa3e9591cc7db5732989c
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:39 2015 -0400

      configure: Add workaround for ccache and clang

      Test if ccache is interfering with semantic analysis of macros,
      disable its habit of trying to compile already pre-processed
      versions of code if so. ccache attempts to save time by compiling
      pre-processed versions of code, but this disturbs clang's static
      analysis enough to produce false positives.

      ccache allows us to disable this feature, opting instead to
      compile the original version instead of its preprocessed version.
      This makes ccache much slower for cache misses, but at least it
      becomes usable with QEMU/clang.

      This workaround only activates for users using ccache AND clang,
      and only if their configuration is observed to be producing warnings.
      You may need to clear your ccache for builds started without -Werror,
      as those may continue to produce warnings from the cache.

      Thanks to Peter Eisentraut for his writeup on the issue:
      http://peter.eisentraut.org/blog/2014/12/01/ccache-and-clang-part-3/

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bbbf2e04e5ea347d877c7fa8ee02e4bb647a48fc
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:38 2015 -0400

      configure: silence glib unknown attribute __alloc_size__

      The glib headers use GCC attributes.  Unfortunately the __GNUC__ and
      __GNUC_MINOR__ version macros are also defined by clang, but clang
      doesn't support the same attributes as GCC.

      clang 3.5.0 does not support the __alloc_size__ attribute:

        https://github.com/llvm-mirror/clang/commit/c047507a9a79e89fc8339e074fa72822a7e7ea73

      The following warning is produced:

        gstrfuncs.h:257:44: warning: unknown attribute '__alloc_size__' ignored [-Wunknown-attributes]
              G_GNUC_MALLOC G_GNUC_ALLOC_SIZE(2);
                gmacros.h:67:45: note: expanded from macro 'G_GNUC_ALLOC_SIZE'
                      #define G_GNUC_ALLOC_SIZE(x) __attribute__((__alloc_size__(x)))

      This patch checks whether glib headers cause warnings and disables
      -Wunknown-attributes if it is able to.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 93b25869228a3c0c632a6aa66624cc4e549ba14a
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:37 2015 -0400

      configure: factor out supported flag check

      Factor out the function that checks if a compiler
      flag is supported or not.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4a7b344df40b1f4b2e732ddb0d68079ce658d89
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Mar 25 18:57:36 2015 -0400

      configure: handle clang -nopie argument warning

      gcc 4.9.2 treats -nopie as an error:

        cc: error: unrecognized command line option ‘-nopie’

      clang 3.5.0 treats -nopie as a warning:

        clang: warning: argument unused during compilation: '-nopie'

      The causes ./configure to fail with clang:

        ERROR: configure test passed without -Werror but failed with -Werror.

      Make the -nopie test use -Werror so that compile_prog works for both gcc
      and clang.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ddd2ef2ce8d693b6e2635a0c20f65744641ff8df
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:47:00 2015 +0300

      block/parallels: improve image writing performance further

      Try to perform IO for the biggest continuous block possible.
      All blocks abscent in the image are accounted in the same type
      and preallocation is made for all of them at once.

      The performance for sequential write is increased from 200 Mb/sec to
      235 Mb/sec on my SSD HDD.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-28-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 19f5dc15912dfb6af06c97e4975023e545e85c72
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:59 2015 +0300

      block/parallels: optimize linear image expansion

      Plain image expansion spends a lot of time to update image file size.
      This seriously affects the performance. The following simple test
        qemu_img create -f parallels -o cluster_size=64k ./1.hds 64G
        qemu_io -n -c "write -P 0x11 0 1024M" ./1.hds
      could be improved if the format driver will pre-allocate some space
      in the image file with a reasonable chunk.

      This patch preallocates 128 Mb using bdrv_write_zeroes, which should
      normally use fallocate() call inside. Fallback to older truncate()
      could be used as a fallback using image open options thanks to the
      previous patch.

      The benefit is around 15%.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Karan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-27-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d61790112fa861fbbbb02b53f9c3beb9ca7f8419
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:58 2015 +0300

      block/parallels: add prealloc-mode and prealloc-size open paramemets

      This is preparational commit for tweaks in Parallels image expansion.
      The idea is that enlarge via truncate by one data block is slow. It
      would be much better to use fallocate via bdrv_write_zeroes and
      expand by some significant amount at once.

      Original idea with sequential file writing to the end of the file without
      fallocate/truncate would be slower than this approach if the image is
      expanded with several operations:
      - each image expanding means file metadata update, i.e. filesystem
        journal write. Truncate/write to newly truncated space update file
        metadata twice thus truncate removal helps. With fallocate call
        inside bdrv_write_zeroes file metadata is updated only once and
        this should happen infrequently thus this approach is the best one
        for the image expansion
      - tail writes are ordered, i.e. the guest IO queue could not be sent
        immediately to the host introducing additional IO delays

      This patch just adds proper parameters into BDRVParallelsState and
      performs options parsing in parallels_open.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-26-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0d31c7c200b3dca2aeeaa6f74ff3fd539aad803a
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:57 2015 +0300

      block/parallels: delay writing to BAT till bdrv_co_flush_to_os

      The idea is that we do not need to immediately sync BAT to the image as
      from the guest point of view there is a possibility that IO is lost
      even in the physical controller until flush command was finished.
      bdrv_co_flush_to_os is exactly the right place for this purpose.

      Technically the patch uses loaded BAT data as a cache and performs
      actual on-disk metadata updates in parallels_co_flush_to_os callback.

      This patch speed ups
        qemu-img create -f parallels -o cluster_size=64k ./1.hds 64G
        qemu-io -f parallels -c "write -P 0x11 0 1024k" 1.hds
      writing from 50-60 Mb/sec to 80-90 Mb/sec on rotational media and
      from 160 Mb/sec to 190 Mb/sec on SSD disk.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-25-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2d68e22e94e8bc5a0d32a38b53c592c320db8261
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:56 2015 +0300

      block/parallels: create bat_entry_off helper

      calculate offset of the BAT entry in the image file.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-24-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6953d920784466dfaea77f7cfd23df2ad8b772a0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:55 2015 +0300

      block/parallels: improve image reading performance

      Try to perform IO for the biggest continuous block possible.
      The performance for sequential read is increased from 220 Mb/sec to
      360 Mb/sec for continous image on my SSD HDD.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-23-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6be831e99f89d72a8c4a114347d5512c326af29
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:54 2015 +0300

      iotests, parallels: check for incorrectly closed image in tests

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-22-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6dd6b9f1440c37811ad963b49a48bf80a8bde377
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:53 2015 +0300

      block/parallels: implement incorrect close detection

      The software driver must set inuse field in Parallels header to
      0x746F6E59 when the image is opened in read-write mode. The presence of
      this magic in the header on open forces image consistency check.

      There is an unfortunate trick here. We can not check for inuse in
      parallels_check as this will happen too late. It is possible to do
      that for simple check, but during the fix this would always report
      an error as the image was opened in BDRV_O_RDWR mode. Thus we save
      the flag in BDRVParallelsState for this.

      On the other hand, nothing should be done to clear inuse in
      parallels_check. Generic close will do the job right.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-21-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 49ad6467313d17486af9029413debb709dc971a8
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:52 2015 +0300

      block/parallels: implement parallels_check method of block driver

      The check is very simple at the moment. It calculates necessary stats
      and fix only the following errors:
      - space leak at the end of the image. This would happens due to
        preallocation
      - clusters outside the image are zeroed. Nothing else could be done here

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-20-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 23d6bd3bd1225e8c8ade6ed829eabcf90ddfa6f7
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:51 2015 +0300

      block/parallels: move parallels_open/probe to the very end of the file

      This will help to avoid forward declarations for upcoming parallels_check

      Some very obvious formatting fixes were made to the moved code to make
      checkpatch happy.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-19-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9eae9cca95e76afc2f2288a665e08a64953f2820
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:50 2015 +0300

      block/parallels: read parallels image header and BAT into single buffer

      This metadata cache would allow to properly batch BAT updates to disk
      in next patches. These updates will be properly aligned to avoid
      read-modify-write transactions on block level.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-18-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd97cdc064f24484a2ebc141a4ec6bba35f56007
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:49 2015 +0300

      block/parallels: keep BAT bitmap data in little endian in memory

      This will allow to use this data as buffer to BAT update directly
      without any intermediate buffers.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-17-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 555cc9d9fc5c71be6bd3f288eaf1e5628732088f
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:48 2015 +0300

      block/parallels: create bat2sect helper

      deduplicate copy/paste arithmetcs

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-16-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 369f7de9d57e4dd2f312255fc12271d5749c0a4e
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:47 2015 +0300

      block/parallels: rename catalog_ names to bat_

      BAT means 'block allocation table'. Thus this name is clean and shorter
      on writing.

      Some obvious formatting fixes in the old code were made to make checkpatch
      happy.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-15-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit cc5690f20fcc075940a213380b362ae2054c03ba
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:46 2015 +0300

      parallels: change copyright information in the image header

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-14-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca9c4e0675f9cb98138e1069605114f45746d985
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:45 2015 +0300

      iotests, parallels: test for newly created parallels image via qemu-img

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-13-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 74cf6c5026fef6e327f09786445f626df02cbdf0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:44 2015 +0300

      block/parallels: support parallels image creation

      Do not even care to create WithoutFreeSpace image, it is obsolete.
      Always create WithouFreSpacExt one.

      The code also does not spend a lot of efforts to fill cylinders and
      heads fields, they are not used actually in a real life neither in
      QEMU nor in Parallels products.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-12-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 50ffd8fd3cfceede87cec1f7f9a04cd7b9147271
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:43 2015 +0300

      iotests, parallels: test for write into Parallels image

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-11-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5a41e1fa95f379e236883f38dacda292f6c48e6f
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:42 2015 +0300

      block/parallels: _co_writev callback for Parallels format

      Support write on Parallels images. The code is almost the same as one
      in the previous patch implemented scatter-gather IO for read.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-10-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d0e61ce56d1520cade573eb344fdb136993d2279
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:41 2015 +0300

      block/parallels: mark parallels format driver as zero inited

      From the guest point of view unallocated blocks are zeroed.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-9-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 912f31281a683a24b552a8cc6c293ab389b62013
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:40 2015 +0300

      block/parallels: replace magic constants 4, 64 with proper sizeofs

      simple purification..

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-8-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 481fb9cf18925eab19e4af8a44bd86b82eb897ad
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:39 2015 +0300

      block/parallels: provide _co_readv routine for parallels format driver

      Main approach is taken from qcow2_co_readv.

      The patch drops coroutine lock for the duration of IO operation and
      peforms normal scatter-gather IO using standard QEMU backend.

      The patch also adds comment about locking considerations in the driver.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-7-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd3bed16ff229496b30cc77224b0c0ae645c4dae
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:38 2015 +0300

      block/parallels: add get_block_status

      Implement VFS method for get_block_status to Parallels format driver.

      qemu_co_mutex_lock is not necessary yet (the driver is read-only) but
      will be necessary very soon when write will be supported.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1430207220-24458-6-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9de9da17d8304576e8402697bcee72c88ce499b8
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:37 2015 +0300

      block/parallels: read up to cluster end in one go

      Teach parallels_read() to do reads in coarser granularity than just a
      single sector: if requested, read up to the cluster end in one go.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-5-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2944256997dd8b080f8b0cc062e4b663cb2ec09c
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:36 2015 +0300

      block/parallels: switch to bdrv_read

      Switch the .bdrv_read method implementation from using bdrv_pread() to
      bdrv_read() on the underlying file, since the latter is subject to i/o
      throttling while the former is not.

      Besides, since bdrv_read() operates in sectors rather than bytes, adjust
      the helper functions to do so too.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1430207220-24458-4-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0789890467d30e2ab10d84b5398bdc903db8cb91
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:35 2015 +0300

      block/parallels: rename parallels_header to ParallelsHeader

      this follows QEMU coding convention

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-3-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d134cf73b10e9d0283e1d2531299c8f9ab13b5eb
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:34 2015 +0300

      iotests, parallels: quote TEST_IMG in 076 test to be path-safe

      suggested by Jeff Cody

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-2-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 32ad48abd74a997220b841e4e913edeb267aa362
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Aug 18 10:19:06 2014 -0700

      target-alpha: Add vector implementation for CMPBGE

      While conditionalized on SSE2, it's a "portable" gcc generic vector
      implementation, which could be enabled on other hosts.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8d8d324e3424bf891d41e9c7758dcc09cf3c38b9
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 15 12:07:05 2014 -0700

      target-alpha: Rewrite helper_zapnot

      This form produces significantly smaller code on x86_64.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9e549d36e989b14423279fb991b71728a2a4ae7c
  Merge: eba05e9 0ef705a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 21 09:07:19 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150520-1' into staging

      vnc: misc fixes.

      # gpg: Signature made Wed May 20 09:32:45 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150520-1:
        qemu-sockets: Report explicit error if unlink fails
        vnc: Tweak error when init fails
        vnc: Don't assert if opening unix socket fails
        ui: remove check for failure of qemu_acl_init()
        Strip brackets from vnc host

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ef705a2653f09c15e44a644a98b6febc761431e
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:19 2015 -0400

      qemu-sockets: Report explicit error if unlink fails

      Consider this case:

      $ ls -ld ~/root-owned/
      drwx--x--x. 2 root root 4096 Apr 29 12:55 /home/crobinso/root-owned/
      $ ls -l ~/root-owned/foo.sock
      -rwxrwxrwx. 1 crobinso crobinso 0 Apr 29 12:55 /home/crobinso/root-owned/foo.sock

      $ qemu-system-x86_64 -vnc unix:~/root-owned/foo.sock
      qemu-system-x86_64: -vnc unix:/home/crobinso/root-owned/foo.sock: Failed to start VNC server: Failed to bind socket to /home/crobinso/root-owned/foo.sock: Address already in use

      ...which is techinically true, but the real error is that we failed to
      unlink. So report it.

      This may seem pathological but it's a real possibility via libvirt.

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bc119048d7377ec8335ecde5946df629a1b72b46
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:18 2015 -0400

      vnc: Tweak error when init fails

      Before:
      qemu-system-x86_64: -display vnc=unix:/root/foo.sock: Failed to start VNC server on `(null)': Failed to bind socket to /root/foo.sock: Permission denied

      After:
      qemu-system-x86_64: -display vnc=unix:/root/foo.sock: Failed to start VNC server: Failed to bind socket to /root/foo.sock: Permission denied

      Rather than tweak the string possibly show unix: value as well,
      just drop the explicit display reporting. We already get the cli
      string in the error message, that should be sufficient.

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3d00ac1a2ee0294fc3d460e6013a5cdd9c73ea6c
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:17 2015 -0400

      vnc: Don't assert if opening unix socket fails

      Reproducer:

      $ qemu-system-x86_64 -display vnc=unix:/root/i-cant-access-you.sock
      qemu-system-x86_64: iohandler.c:60: qemu_set_fd_handler2: Assertion `fd >= 0' failed.
      Aborted (core dumped)

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2b2c1a38eeaba5d8bfe92281e9e680361e09ee3b
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Fri May 1 11:44:46 2015 +0100

      ui: remove check for failure of qemu_acl_init()

      The qemu_acl_init() function has long since stopped being able
      to return NULL, since g_malloc will abort on OOM. As such the
      checks for NULL were unreachable code.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 274c3b52e10466a4771d591f6298ef61e8354ce0
  Author: Ján Tomko <jtomko@redhat.com>
  Date:   Mon Apr 27 17:03:14 2015 +0200

      Strip brackets from vnc host

      Commit v2.2.0-1530-ge556032 vnc: switch to inet_listen_opts
      bypassed the use of inet_parse in inet_listen, making literal
      IPv6 addresses enclosed in brackets fail:

      qemu-kvm: -vnc [::1]:0: Failed to start VNC server on `(null)': address
      resolution failed for [::1]:5900: Name or service not known

      Strip the brackets to make it work again.

      Signed-off-by: Ján Tomko <jtomko@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit eba05e922e8e7f307bc5d4104a78797e55124e97
  Merge: fdbe454 a48da7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 14:10:33 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-serial-20150519-1' into staging

      serial: fix multi-pci card error cleanup.

      # gpg: Signature made Tue May 19 11:47:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-serial-20150519-1:
        serial: fix multi-pci card error cleanup.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a48da7b5bc1f0c98e7a124337140efd47049066c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed May 6 12:58:19 2015 +0200

      serial: fix multi-pci card error cleanup.

      Put the number of serial ports into a local variable in
      multi_serial_pci_realize, then increment the port count
      (pci->ports) as we initialize the serial port cores.

      Now pci->ports always holds the number of successfully
      initialized ports and we can use multi_serial_pci_exit
      to properly cleanup the already initialized bits in case
      of a init failure.

      https://bugzilla.redhat.com/show_bug.cgi?id=970551

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fdbe454a242105fcfe48b9c44b5499b80ff84160
  Merge: faa261a 176c324
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 11:47:03 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150519-1' into staging

      hw/display: qomify vga cards

      # gpg: Signature made Tue May 19 11:23:09 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150519-1:
        vga-pci: QOMify
        qxl: QOMify
        cirrus_vga: QOMify

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 176c324febd76d6f164347583f5af35b3cb4e5fb
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:08 2015 +0800

      vga-pci: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c69f6c7dcf6164ee0ee3b00bec27dfdec4e8b661
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:10 2015 +0800

      qxl: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d338bae33a76d02678ea706622dfcc26b8b8325c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:09 2015 +0800

      cirrus_vga: QOMify

      QOMify pci-cirrus-vga like isa-cirrus-vga device.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit faa261a7fb254866bdd5b6a25ad94677945f21b4
  Merge: 62bf3df b4c6a11
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 10:25:59 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150519' into staging

      cocoa queue:
       * fix various issues with full screen in the OSX UI
       * set an icon for our binary file
       * add entries to the View menu for QEMU consoles
       * fix various warnings that are produced when building on 10.10
         (largely deprecated interfaces)

      # gpg: Signature made Tue May 19 09:17:23 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-cocoa-20150519:
        ui/cocoa: Add console items to the View menu
        ui/cocoa: Avoid deprecated NSOKButton/NSCancelButton constants
        ui/cocoa: Don't use NSWindow useOptimizedDrawing on OSX 10.10 and up
        ui/cocoa: Declare that QemuCocoaAppController implements NSApplicationDelegate
        ui/cocoa: openPanelDidEnd returnCode should be NSInteger, not int
        ui/cocoa: Remove compatibility ifdefs for OSX 10.4
        ui/cocoa: Drop tests for CGImageCreateWithImageInRect support
        Makefile.target: set icon for binary file on Mac OS X
        ui/cocoa: Make -full-screen option work on Mac OS X
        ui/cocoa: Fix several full screen issues on Mac OS X

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b4c6a112dcfa1d24b905e6cccc763e02000937f1
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Add console items to the View menu

      Add any console that is available to the current emulator as a
      menu item under the View menu.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: Adjusted to apply after zoom-to-fit menu item was added;
       create the View menu at the same time as all the others, and only
       add the dynamically-determined items to it later]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8617989eae7398e9e782a73857fc53a548692b31
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Avoid deprecated NSOKButton/NSCancelButton constants

      In OSX 10.10, the NSOKButton and NSCancelButton constants are deprecated
      and provoke compiler warnings. Avoid them by using the
      NSFileHandlingPanelCancelButton and NSFileHandlingPanelOKButton constants
      instead. These are the documented correct constants for the 10.6-and-up
      beginSheetModalForWindow API we use. We also use the same method for
      the pre-10.6 compatibility code path, but conveniently the constant
      values are the same and the constant names have been present since 10.0.
      Preferring the constant names that match the non-legacy API makes more
      sense anyway.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-7-git-send-email-peter.maydell@linaro.org

  commit 81801ae21333d81a8e7887bc6b11c601b6ecbee6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Don't use NSWindow useOptimizedDrawing on OSX 10.10 and up

      Starting in OSX 10.10, NSWindow useOptimizedDrawing is deprecated, so
      don't use it there.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-6-git-send-email-peter.maydell@linaro.org

  commit 2a4c8c53dabf564142d5329b9ff8a82468324fd6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Declare that QemuCocoaAppController implements NSApplicationDelegate

      Our class QemuCocoaAppController implements the NSApplicationDelegate
      interface, and we pass an object of this class to [NSApp setDelegate].
      However, we weren't declaring in the class definition that we implemented
      this interface; in OSX 10.10 this provokes the following (slighly
      misleading) warning:
      ui/cocoa.m:1031:24: warning: sending 'QemuCocoaAppController *' to parameter of
            incompatible type 'id<NSFileManagerDelegate>'
          [NSApp setDelegate:appController];
                             ^~~~~~~~~~~~~
      /System/Library/Frameworks/Foundation.framework/Headers/NSFileManager.h:109:47:
      note: passing argument to parameter 'delegate' here
      @property (assign) id <NSFileManagerDelegate> delegate NS_AVAILABLE(10_5,
      2_0);
                                                    ^

      Annoyingly, this interface wasn't formally defined until OSX 10.6, so we
      have to surround the relevant part of the @interface line with an ifdef.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-5-git-send-email-peter.maydell@linaro.org

  commit de1aadee289722478c19f211f0fa3a38e7e66b6f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: openPanelDidEnd returnCode should be NSInteger, not int

      The type for openPanelDidEnd's returnCode argument should be NSInteger,
      not int. This only matters for the OSX 10.5 code path where we pass
      the method directly to an OSX function to call.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-4-git-send-email-peter.maydell@linaro.org

  commit 89424ff32f5c106f90627c7abe019c81c716fd13
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Remove compatibility ifdefs for OSX 10.4

      Remove compatibility ifdefs that work around OSX 10.4 not providing
      various typedefs and functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-3-git-send-email-peter.maydell@linaro.org

  commit b63901d84cc22a06f82900620fdbe01ff16511ec
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Drop tests for CGImageCreateWithImageInRect support

      The code that tries to test at both compiletime and runtime
      for whether CGImageCreateWithImageInRect is supported provokes
      a compile warning on OSX 10.3:

      ui/cocoa.m:378:13: warning: comparison of function 'CGImageCreateWithImageInRect'
            equal to a null pointer is always false[-Wtautological-pointer-compare]
              if (CGImageCreateWithImageInRect == NULL) { // test if "CGImageCreateWithImageInRect" is
      supported on host at runtime
                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~    ~~~~

      The simplest way to deal with this is just to drop this code,
      since we don't in practice support OSX 10.4 anyway. (10.5 was
      released in 2007 and is the last PPC version, so is the earliest
      we really need to continue to support at all.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-2-git-send-email-peter.maydell@linaro.org

  commit 4e34017c21485e5606beda7e6218c36d3568b363
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      Makefile.target: set icon for binary file on Mac OS X

      Implements setting the icon for the binary file in Mac OS X.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: tweaked makefile to use $@ and quiet-command]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43227af88a36faed50cedb0c7cef71a49c0be9d2
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Make -full-screen option work on Mac OS X

      This patch makes the -full-screen option actually instruct QEMU to
      enter fullscreen at startup, on Mac OS X.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5d1b2eef58632974494b4b94f8970846aa0bffb9
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Fix several full screen issues on Mac OS X

      This patch makes several changes:
      - Minimizes distorted full screen display by respecting aspect
      ratios.
      - Makes full screen mode available on Mac OS 10.7 and higher.
      - Allows user to decide if video should be stretched to fill the
      screen, using a menu item called "Zoom To Fit".
      - Hides the normalWindow so it won't show up in full screen mode.
      - Allows user to exit full screen mode.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: minor whitespace tweaks, remove incorrectly duplicated
       use of 'f' menu accelerator key]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57a808b6d7f52a62111f6070933dfca6cd88a0fd
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:42:55 2014 -0700

      target-alpha: Raise IOV from CVTQL

      Even if an exception isn't taken, the status flags need updating
      and the result should be written to the destination.  Move the body
      of cvtql out of line, since we now always need a call.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4ed069ab5334a495b49d0704795524fa34e8dbfc
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:14:09 2014 -0700

      target-alpha: Suppress underflow from CVTTQ if DNZ

      I.e. respect flush_inputs_to_zero.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit b99e80694cc635aa6ed5a3716e89645a8afa261c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:11:06 2014 -0700

      target-alpha: Raise EXC_M_INV properly for fp inputs

      Ignore DNZ if software completion isn't used.  Raise INV for
      denormals in system mode so the OS completion handler sees them.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ed0851380c8ed181ddd6ed3542b14fcb0bca6700
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jul 7 06:18:20 2014 -0700

      target-alpha: Disallow literal operand to 1C.30 to 1C.37

      Before 64f45e49 we used to have literal checks for 4 of these 8 opcodes.
      Confirmed that real hardware doesn't allow them.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 2517def6f82bec9eba9333a37f85a6f368ba52ee
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 21:04:26 2014 -0700

      target-alpha: Implement WH64EN

      Backward compatible cache insn introduced for EV7.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4d1628e832dfc6ec02b0d196f6cc250aaa7bf3b3
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 13:18:26 2014 -0700

      target-alpha: Fix integer overflow checking insns

      We need to write the result to the destination register before
      raising any exception.  Thus inline the code for each insn, and
      check for any exception after we're done.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7b4dde839e86ca6c254d4e3cd28260e9d668afb5
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 12:37:59 2014 -0700

      target-alpha: Fix cvttq vs inf

      We should raise INV for infinities as well, not OVR+INE.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7f2e40020cfc827f7e59670f8c400b0b9a704481
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 12:36:34 2014 -0700

      target-alpha: Fix cvttq vs large integers

      The range +- 2**63 - 2**64 was returning the wrong truncated
      result.  We also incorrectly signaled overflow for -2**63.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c24a8a0b6dad5a33d84f5fb846edb28c43312c71
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 12:57:03 2014 -0700

      target-alpha: Raise IOV from CVTTQ

      Floating-point overflow is a different bit from integer overflow.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit f6b6b7b8a775f97edab43eb672d5991f534c2e61
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jun 30 09:53:46 2014 -0700

      target-alpha: Set EXC_M_SWC for exceptions from /S insns

      Previously forgotten, the kernel needs the software completion bit to
      know that it needs to emulate software completion qualified insns.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 471d4930470aee38dffe6fc4890ede3d8eaf23c4
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 11:08:28 2014 -0700

      target-alpha: Set fpcr_exc_status even for disabled exceptions

      The qualifiers can suppress the raising of exceptions, but real
      hardware still records that the exceptions occurred.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit f3d3aad4a920a4436a9f5397d7a2963aefe141a9
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 12:17:07 2014 -1000

      target-alpha: Tidy FPCR representation

      Store the fpcr as the hardware represents it.  Convert the softfpu
      representation of exceptions into the fpcr representation.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ba9c5de5f2d33d468a07a8794121472ea031a0b5
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 13:06:19 2014 -0700

      target-alpha: Set PC correctly for floating-point exceptions

      PC should be one past the faulting insn.  Add better commentary
      for the machine-check exception path.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9d5a626b2c3fa98761b35b5e2ac86f7adb231002
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 10:25:36 2014 -0700

      target-alpha: Forget installed round mode after MT_FPCR

      When we use QUAL_RM_D, we copy fpcr_dyn_round to float_status.
      When we install a new FPCR value, we update fpcr_dyn_round.
      Reset the status of the cache so that we re-copy for the next
      fp insn that requires dynamic rounding.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3da653fa05579579b0ba55a02ffa2aa3d466f01b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 10:54:35 2014 -1000

      target-alpha: Rename floating-point subroutines

      ... to match the instructions, which have no leading "f".

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9354452c39fef1ab2491da5989e6944d8bb2e16a
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 10:42:45 2014 -1000

      target-alpha: Move VAX helpers to a new file

      Keep the IEEE and VAX floating point emulation separate.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 62bf3df432d93fa6eb0f355c460d6d784b7cbc1a
  Merge: 385057c 18084b2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 18 20:23:16 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150518-3' into staging

      target-arm:
       * New board model: xlnx-ep108
       * Some more preparation for AArch64 EL2/EL3
       * Fix bugs in access checking for generic counter registers
       * Remove a stray '+' sign

      # gpg: Signature made Mon May 18 20:13:05 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150518-3: (21 commits)
        target-arm: Remove unneeded '+'
        target-arm: Correct accessfn for CNTV_TVAL_EL0
        target-arm: Correct accessfn for CNTP_{CT}VAL_EL0
        target-arm: Add WFx syndrome function
        target-arm: Add EL3 and EL2 TCR checking
        target-arm: Add TTBR regime function and use
        linux-user/arm: Correct TARGET_NR_timerfd to TARGET_NR_timerfd_create
        arm: xlnx-ep108: Add bootloading
        arm: xlnx-ep108: Add external RAM
        arm: Add xlnx-ep108 machine
        arm: xlnx-zynqmp: Add UART support
        char: cadence_uart: Split state struct and type into header
        char: cadence_uart: Clean up variable names
        arm: xlnx-zynqmp: Add GEM support
        net: cadence_gem: Split state struct and type into header
        net: cadence_gem: Clean up variable names
        arm: xlnx-zynqmp: Connect CPU Timers to GIC
        arm: xlnx-zynqmp: Add GIC
        arm: Introduce Xilinx ZynqMP SoC
        target-arm: cpu64: Add support for Cortex-A53
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 18084b2f71b22b3ec3bf4828b8cb83d1d39e8502
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:28 2015 +1000

      target-arm: Remove unneeded '+'

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431499963-1019-4-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b65c08ee1a05760c1c5a786a6cedf240f924c53e
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:27 2015 +1000

      target-arm: Correct accessfn for CNTV_TVAL_EL0

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1431499963-1019-3-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12cde08aaf571de65d3fbbdf93c83f0a4321267f
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:26 2015 +1000

      target-arm: Correct accessfn for CNTP_{CT}VAL_EL0

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1431499963-1019-2-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:20 2015 -0500

      target-arm: Add WFx syndrome function

      Adds a utility function for creating a WFx exception syndrome

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 88e8add8b6656c349a96b447b074688d02dc5415
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:19 2015 -0500

      target-arm: Add EL3 and EL2 TCR checking

      Updated get_phys_addr_lpae to check the appropriate TTBCR/TCR depending on the
      current EL. Support includes using the different TCR format as well as checks to
      insure TTBR1 is not used when in EL2 or EL3.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aef878be4e7ab1bdb30b408007320400b0a29c83
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:18 2015 -0500

      target-arm: Add TTBR regime function and use

      Add a utility function for choosing the correct TTBR system register based on
      the specified MMU index. Add use of function on physical address lookup.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-7-git-send-email-greg.bellows@linaro.org
      [PMM: fixed regime_ttbr() return type to be uint64_t]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d82322e175d58c0c8951cbc905da1ca9ee2e008c
  Author: Timothy Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
  Date:   Wed Apr 8 21:40:52 2015 +0100

      linux-user/arm: Correct TARGET_NR_timerfd to TARGET_NR_timerfd_create

      Misspelled system call name in macro was causing timerfd_create not
      to be supported for the ARM target.

      Signed-off-by: Timothy Edward Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 082587b741efc5329380b4a156d86f2bdbfa2d70
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:30 2015 -0700

      arm: xlnx-ep108: Add bootloading

      Add bootloader support using standard ARM bootloader.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: b829abaf2b70d02b28e79301553cbd74afc416a1.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b79b9d28f6b8f7879c50b6c053b4e3796de5b7d0
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:27 2015 -0700

      arm: xlnx-ep108: Add external RAM

      Zynq MPSoC supports external DDR RAM. Add a RAM at 0 to the model.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 2c25e2a4198402a6477aef2975d5df7c415dd341.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 859a0c5b5fb8be0c1ed78d96695a162c9210e1e6
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:24 2015 -0700

      arm: Add xlnx-ep108 machine

      Add a machine model for the Xilinx ZynqMP SoC EP108 board.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 3896b34c862f370dc0679e4428bf3848d1f9f83c.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3bade2a9e6336e0eb7cc5ad7425994f1143c5cfa
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:21 2015 -0700

      arm: xlnx-zynqmp: Add UART support

      There are 2x Cadence UARTs in Zynq MP. Add them.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: e30795536f77599fabc1052278d846ccd52322e2.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ae57b2fa35dae9aa4b50db5e632156eded9bec0
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:18 2015 -0700

      char: cadence_uart: Split state struct and type into header

      Create a new header for Cadence UART to allow using the device with
      modern SoC programming conventions. The state struct needs to be
      visible to embed the device in SoC containers.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 46a0fbd45b6b205f54c4a8c778deb75c77f8abdf.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e86da3cb40d6f70ce99d8e64952c49df8ad78848
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:15 2015 -0700

      char: cadence_uart: Clean up variable names

      Clean up some variable names in preparation for migrating the state struct
      and type cast macro to a public header. The acronym "UART" on it's own is
      not specific enough to be used in a more global namespace so preface with
      "cadence". Fix the capitalisation of "uart" in the state type while touching
      the typename. Preface macros used by the state struct itself with CADENCE_UART
      so they don't conflict in namespace either.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 3812b7426c338beae9e082557f3524a99310ddc6.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 14ca2e462ee137974d81729b1d88d9d39cf2f22c
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:12 2015 -0700

      arm: xlnx-zynqmp: Add GEM support

      There are 4x Cadence GEMs in ZynqMP. Add them.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 7d3e68e5495d145255f0ee567046415e3a26d67e.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f49856d4e65703e347ee3e2277a87282ce601bcd
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:09 2015 -0700

      net: cadence_gem: Split state struct and type into header

      Create a new header for Cadence GEM to allow using the device with
      modern SoC programming conventions. The state struct needs to be
      visible to embed the device in SoC containers.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a98b5df6440c5bff8f813a26bb53ce1cfefb4c4c.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 448f19e23155021e42878e7effc3da895921ad4e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:07 2015 -0700

      net: cadence_gem: Clean up variable names

      Cleanup some variable names in preparation for migrating the state
      struct and type cast macro to a public header. The acronym "GEM" on
      its own is not specific enough to be used in a more global namespace
      so preface with "cadence". Fix the capitalisation of "gem" in the
      state type while touching the typename. Also preface the GEM_MAXREG
      macro as this will need to migrate to public header.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 8e2b0687b3a7b7a3fde5ba2f3bee6f3b911e84ef.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf4cb10966a7685bba3aeaf14434902889ef535d
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:04 2015 -0700

      arm: xlnx-zynqmp: Connect CPU Timers to GIC

      Connect the GPIO outputs from the individual CPUs for the timers to the
      GIC.

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a7866a4f0c903c91fa3034210b4d2879aa4bfcb9.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7729e1f4b3c670eca38cc0ee0d96c1177efbc1e3
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:01 2015 -0700

      arm: xlnx-zynqmp: Add GIC

      Add the GIC and connect IRQ outputs to the CPUs. The GIC regions are
      under-decoded through a 64k address region so implement aliases
      accordingly.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5853189965728d676106d9e94e76b9bb87981cb5.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f0a902f76452211cadbdf1d25ef9b94732b096e8
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:58 2015 -0700

      arm: Introduce Xilinx ZynqMP SoC

      With quad Cortex-A53 CPUs.

      Use SMC PSCI, with the standard policy of secondaries starting in
      power-off.

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a16202a6c7b79e446e5289d38cb18d2ee4b897a0.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e35310260ec57d20301c65a5714ca55369e971cc
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:55 2015 -0700

      target-arm: cpu64: Add support for Cortex-A53

      Add the ARM Cortex-A53 processor definition. Similar to A57, but with
      different L1 I cache policy, phys addr size and different cache
      geometries. The cache sizes is implementation configurable, but use
      these values (from Xilinx Zynq MPSoC) as a default until cache size
      configurability is added.

      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: db439ff834cf0431bc192b05272a3b28fe2045d0.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ee804264ddc4d3cd36a5183a09847e391da0fc66
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:52 2015 -0700

      target-arm: cpu64: generalise name of A57 regs

      Rename some A57 CP register variables in preparation for support for
      Cortex A53. Use "a57_a53" to describe the shareable features. Some of
      the CP15 registers (such as ACTLR) are specific to implementation, but
      we currently just RAZ them so continue with that as the policy for both
      A57 and A53 processors under a shared definition.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5a5f957994677d91435190b3be1cefa6f657e274.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 385057cbec9b4a0eb6150330c572e875ed714965
  Merge: 99e7627 4180978
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 15 17:51:20 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-05-15' into staging

      qapi: Fix qapi mangling of downstream names, and more

      # gpg: Signature made Fri May 15 17:41:31 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qapi-2015-05-15: (26 commits)
        qapi: Inline gen_command_decl_prologue(), gen_command_def_prologue()
        qapi: Drop pointless flush() before close()
        qapi: Factor open_output(), close_output() out of generators
        qapi: Turn generators' mandatory option -i into an argument
        qapi: Fix generators to report command line errors decently
        qapi: Factor parse_command_line() out of the generators
        qapi: qapi-commands.py option --type is unused, drop it
        qapi: qapi-event.py option -b does nothing, drop it
        tests: Add missing dependencies on $(qapi-py)
        qapi: Support downstream events and commands
        qapi: Support downstream alternates
        qapi: Support downstream flat unions
        qapi: Support downstream simple unions
        qapi: Support downstream structs
        qapi: Support downstream enums
        qapi: Make c_type() consistently convert qapi names
        qapi: Tidy c_type() logic
        qapi: Move camel_to_upper(), c_enum_const() to closely related code
        qapi: Use c_enum_const() in generate_alternate_qtypes()
        qapi: Simplify c_enum_const()
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 99e7627a70d1a23e30a514e5a4798005cf4eb3aa
  Merge: 1eeace9 dfb3630
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 15 16:02:08 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150514' into staging

      Per-memop alignment

      # gpg: Signature made Thu May 14 20:17:27 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150514:
        tcg: Add MO_ALIGN, MO_UNALN
        tcg: Push merged memop+mmu_idx parameter to softmmu routines
        tcg: Merge memop and mmu_idx parameters to qemu_ld/st

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfb36305626636e2e07e0c5acd3a002a5419399e
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed May 13 11:25:20 2015 -0700

      tcg: Add MO_ALIGN, MO_UNALN

      These modifiers control, on a per-memory-op basis, whether
      unaligned memory accesses are allowed.  The default setting
      reflects the target's definition of ALIGNED_ONLY.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3972ef6f830d65e9bacbd31257abedc055fd6dc8
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed May 13 09:10:33 2015 -0700

      tcg: Push merged memop+mmu_idx parameter to softmmu routines

      The extra information is not yet used but it is now available.
      This requires minor changes through all of the tcg backends.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 59227d5d45bb3c31dc2118011691c35b3c00879c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue May 12 11:51:44 2015 -0700

      tcg: Merge memop and mmu_idx parameters to qemu_ld/st

      At the tcg opcode level, not at the tcg-op.h generator level.
      This requires minor changes through all of the tcg backends,
      but none of the cpu translators.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4180978c9205c50acd2d6c385def9b3e81911696
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:52:55 2015 +0200

      qapi: Inline gen_command_decl_prologue(), gen_command_def_prologue()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 09896d3f48078a93e3d2dbd8ef86436b85ebda7c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:49:29 2015 +0200

      qapi: Drop pointless flush() before close()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12f8e1b9ff57e99dafbb13f89cd5a99ad5c28527
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:46:39 2015 +0200

      qapi: Factor open_output(), close_output() out of generators

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 16d80f61814745bd3f5bb9f47ae3b00edf9e1e45
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:32:16 2015 +0200

      qapi: Turn generators' mandatory option -i into an argument

      Mandatory option is silly, and the error handling is missing: the
      programs crash when -i isn't supplied.  Make it an argument, and check
      it properly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit b45409683e829770000a4560ed21e704f87df74c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:17:34 2015 +0200

      qapi: Fix generators to report command line errors decently

      Report to stderr, prefix with the program name.  Also reject
      extra arguments.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 2114f5a98d0d80774306279e1694de074ca86aa0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:12:21 2015 +0200

      qapi: Factor parse_command_line() out of the generators

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 72aaa73a4acef06bfaed750064c40a597f0cf745
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 11:41:22 2015 +0200

      qapi: qapi-commands.py option --type is unused, drop it

      Anything but --type sync (which is the default) suppresses output
      entirely, which makes no sense.

      Dates back to the initial commit c17d990.  Commit message says
      "Currently only generators for synchronous qapi/qmp functions are
      supported", so maybe output other than "synchronous qapi/qmp" was
      planned at the time, to be selected with --type.

      Should other kinds of output ever materialize, we can put the option
      back.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c70cef5bd48c7be603f75a7b5346db032a31b470
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 11:40:21 2015 +0200

      qapi: qapi-event.py option -b does nothing, drop it

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit df3e21a0e0edd30ea2e7c9b09b05feaaa297c718
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:38:48 2015 +0200

      tests: Add missing dependencies on $(qapi-py)

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e3c4c3d796c1147d32f66fa1413d5d7c49d5aa37
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:51:01 2015 -0600

      qapi: Support downstream events and commands

      Enhance the testsuite to cover downstream events and commands.
      Events worked without more tweaks, but commands needed a few final
      updates in the generator to mangle names in the appropriate places.
      In making those tweaks, it was easier to drop type_visitor() and
      inline its actions instead.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d1f07c86c05706facf950b0b0dba370f71fd5ef6
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:51:00 2015 -0600

      qapi: Support downstream alternates

      Enhance the testsuite to cover downstream alternates, including
      whether the branch name or type is downstream.  Update the
      generator to mangle alternate names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 857af5f06c3fb097d1bb6bc8a23b9992aac99e75
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:59 2015 -0600

      qapi: Support downstream flat unions

      Enhance the testsuite to cover downstream flat unions, including
      the base type, discriminator name and type, and branch name and
      type.  Update the generator to mangle the union names in the
      appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit bb33729043ceda56b4068db13bdc17786ebd0ed0
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:58 2015 -0600

      qapi: Support downstream simple unions

      Enhance the testsuite to cover downstream simple unions, including
      when a union branch is a downstream name.  Update the generator to
      mangle the union names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 83a02706bb1fd31c93eab755de543dfe228682d4
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:57 2015 -0600

      qapi: Support downstream structs

      Enhance the testsuite to cover downstream structs, including struct
      members and base structs.  Update the generator to mangle the
      struct names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fce384b8e5193e02421f6b2c2880f3684abcbdc0
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:56 2015 -0600

      qapi: Support downstream enums

      Enhance the testsuite to cover a downstream enum type and enum
      string.  Update the generator to mangle the enum name in the
      appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c6405b54b7b09a876f2f2fba2aa6f8ac87189cb9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:55 2015 -0600

      qapi: Make c_type() consistently convert qapi names

      Continuing the string of cleanups for supporting downstream names
      containing '.', this patch focuses on ensuring c_type() can
      handle a downstream name.  This patch alone does not fix the
      places where generator output should be calling this function
      but was open-coding things instead, but it gets us a step closer.

      In particular, the changes to c_list_type() and type_name() mean
      that type_name(FOO) now handles the case when FOO contains '.',
      '-', or is a ticklish identifier other than a builtin (builtins
      are exempted because ['int'] must remain mapped to 'intList' and
      not 'q_intList').  Meanwhile, ['unix'] now maps to 'q_unixList'
      rather than 'unixList', to match the fact that 'unix' is ticklish;
      however, our naming conventions state that complex types should
      start with a capital, so no type name following conventions will
      ever have the 'q_' prepended.

      Likewise, changes to c_type() mean that c_type(FOO) properly
      handles an enum or complex type FOO with '.' or '-' in the
      name, or is a ticklish identifier (again, a ticklish identifier
      as a type name violates conventions).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d557344628e32771f07e5b6a2a818ee3d8e7a65f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:54 2015 -0600

      qapi: Tidy c_type() logic

      c_type() is designed to be called on both string names and on
      array designations, so 'name' is a bit misleading because it
      operates on more than strings.  Also, no caller ever passes
      an empty string.  Finally, + notation is a bit nicer to read
      than '%s' % value for string concatenation.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 849bc5382e42b3b9590c6a50ba30c2fd2450308c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:53 2015 -0600

      qapi: Move camel_to_upper(), c_enum_const() to closely related code

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit b42e91484df9772bb0c26aa0f05390a92d564d6f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:52 2015 -0600

      qapi: Use c_enum_const() in generate_alternate_qtypes()

      Missed in commit b0b5819.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 02e20c7e593363c564aae96e3c5bdc58630ce584
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:51 2015 -0600

      qapi: Simplify c_enum_const()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 7c81c61f9c2274f66ba947eafd9618d60da838a6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:50 2015 -0600

      qapi: Rename generate_enum_full_value() to c_enum_const()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit fa6068a1e8ef3c878ac9ee2399bb01eeaf61c366
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:49 2015 -0600

      qapi: Rename _generate_enum_string() to camel_to_upper()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 18df515ebbefa9f13474b128b8050d5fa346ea1e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:48 2015 -0600

      qapi: Rename identical c_fun()/c_var() into c_name()

      Now that the two functions are identical, we only need one of them,
      and we might as well give it a more descriptive name.  Basically,
      the function serves as the translation from a QAPI name into a
      (portion of a) C identifier, without regards to whether it is a
      variable or function name.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 47299262de424af0cb69965d082e5e70b2314183
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:47 2015 -0600

      qapi: Fix C identifiers generated for names containing '.'

      c_fun() maps '.' to '_', c_var() doesn't.  Nothing prevents '.' in
      QAPI names that get passed to c_var().

      Which QAPI names get passed to c_fun(), to c_var(), or to both is not
      obvious.  Names of command parameters and struct type members get
      passed to c_var().

      c_var() strips a leading '*', but this cannot happen.  c_fun()
      doesn't.

      Fix c_var() to work exactly like c_fun().

      Perhaps they should be replaced by a single mapping function.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      [add 'import string']
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit 777abdfe7bb47e582c8eb87dd6cecdf3fd9f86fc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon May 11 17:17:49 2015 +0200

      doc: fix qmp event type

      Event name for hot unplug errors was wrong.
      Make doc match code.

      Cc: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reported-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 58f88d4b7e9e5578b8dd2c5acfe555b85b35af88
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 8 16:04:22 2015 -0300

      qmp: Add qom_path field to query-cpus command

      This will allow clients to query additional information directly using
      qom-get on the CPU objects.

      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 1eeace9c237a729d11c7acd7c0338ab4562af637
  Merge: 4d2d2d8 57af728
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 13 16:06:07 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-05-13

      A few TCG fixes for the s390x target. Nothing special, but with these
      applied I can run most of the SLE12 binaries in Linux-user emulation.

      # gpg: Signature made Wed May 13 13:49:25 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream:
        s390x: Add interlocked access facility 1 instructions
        s390x: Add some documentation in opcode list
        s390x: Fix stoc direction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4d2d2d8b21779d7becbdffd7cd7983a7ccb55b54
  Merge: 968bb75 e907746
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 13 13:57:44 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-cve-pull-request' into staging

      # gpg: Signature made Wed May 13 12:52:19 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-cve-pull-request:
        fdc: force the fifo access to be in bounds of the allocated buffer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57af7289f276ce70b65f2fbb4981833f04264aac
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri May 8 03:07:53 2015 +0200

      s390x: Add interlocked access facility 1 instructions

      We're currently missing all instructions defined by the "interlocked-access
      facility 1" which is part of zEC12. This patch implements all of them except
      for LPD and LPDG.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 13f67dd5825a7dfd7a4904a5fb0cf0a3f95d2d45
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri May 8 03:06:41 2015 +0200

      s390x: Add some documentation in opcode list

      I find it really hard to grasp what each field in the opcode list means.
      Slowly walking through its semantics myself, I figured I'd write a small
      summary at the top of the file to make life easier for me and whoever
      looks at the file next.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit c095ed731ce4fecf166e4ac02ddc606b408f5e1f
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Apr 15 03:45:41 2015 +0200

      s390x: Fix stoc direction

      The store conditional instruction wants to store when the condition
      is fulfilled, so we should branch out when it's not true.

      The code today branches out when the condition is true, clearly
      reversing the logic. Fix it up by negating the condition.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e907746266721f305d67bc0718795fedee2e824c
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Wed May 6 09:48:59 2015 +0200

      fdc: force the fifo access to be in bounds of the allocated buffer

      During processing of certain commands such as FD_CMD_READ_ID and
      FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
      get out of bounds leading to memory corruption with values coming
      from the guest.

      Fix this by making sure that the index is always bounded by the
      allocated memory.

      This is CVE-2015-3456.

      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 968bb75c348a401b85e08d5eb1887a3e6c3185f5
  Merge: 19fbe50 5ae79fe
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 12:11:32 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150512' into staging

      target-arm queue:
       * Support TZ and grouping in the GIC
       * hw/sd: sd_reset cleanup
       * armv7m_nvic: fix bug in systick device

      # gpg: Signature made Tue May 12 12:02:26 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150512:
        hw/arm/highbank.c: Wire FIQ between CPU <> GIC
        hw/arm/vexpress.c: Wire FIQ between CPU <> GIC
        hw/arm/virt.c: Wire FIQ between CPU <> GIC
        hw/intc/arm_gic: Add grouping support to gic_update()
        hw/intc/arm_gic: Change behavior of IAR writes
        hw/intc/arm_gic: Change behavior of EOIR writes
        hw/intc/arm_gic: Handle grouping for GICC_HPPIR
        hw/intc/arm_gic: Restrict priority view
        hw/intc/arm_gic: Implement Non-secure view of RPR
        hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked
        hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked
        hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked
        hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state
        hw/intc/arm_gic: Add Interrupt Group Registers
        hw/intc/arm_gic: Switch to read/write callbacks with tx attributes
        hw/intc/arm_gic: Add Security Extensions property
        hw/intc/arm_gic: Create outbound FIQ lines
        hw/sd: Don't pass BlockBackend to sd_reset()
        armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5ae79fe825bedc89db8b6bde9d0ed0bb5d59558c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:19 2015 +0100

      hw/arm/highbank.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-18-git-send-email-peter.maydell@linaro.org

  commit 27192e390d064489dcb23d5fcceb21cabf86d789
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/arm/vexpress.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-17-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-3-git-send-email-greg.bellows@linaro.org
      [PMM: minor format tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8e7b4ca08b968c9e195bcae9c6cb827c8564871a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/arm/virt.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-16-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-4-git-send-email-greg.bellows@linaro.org
      [PMM: minor format tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dadbb58f5955053c5f5dc2252a4b183f90d7bfce
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Add grouping support to gic_update()

      Add support to gic_update() for determining the current IRQ
      and FIQ status when interrupt grouping is supported. This
      simply requires that instead of always raising IRQ we
      check the group of the highest priority pending interrupt
      and the GICC_CTLR.FIQEn bit to see whether we should raise
      IRQ or FIQ.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1430502643-25909-15-git-send-email-peter.maydell@linaro.org

  commit c5619bf9e8935aeb972c0bd935549e9ee0a739f2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Change behavior of IAR writes

      Grouping (GICv2) and Security Extensions change the behavior of IAR
      reads. Acknowledging Group0 interrupts is only allowed from Secure
      state and acknowledging Group1 interrupts from Secure state is only
      allowed if AckCtl bit is set.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-14-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-14-git-send-email-greg.bellows@linaro.org
      [PMM: simplify significantly by reusing the existing
       gic_get_current_pending_irq() rather than reimplementing the
       same logic here]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9c6a7f1395c6d88a3bb1a0cb48811994709966e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Change behavior of EOIR writes

      Grouping (GICv2) and Security Extensions change the behavior of EOIR
      writes. Completing Group0 interrupts is only allowed from Secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-13-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-13-git-send-email-greg.bellows@linaro.org
      [PMM: Rather than go to great lengths to ignore the UNPREDICTABLE case
       of a Secure EOI of a Group1 (NS) irq with AckCtl == 0, we just let
       it fall through; add a comment about it.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c0fa108d918ab818e49c4588ab290004d6b532e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Handle grouping for GICC_HPPIR

      Grouping (GICv2) and Security Extensions change the behaviour of reads
      of the highest priority pending interrupt register (ICCHPIR/GICC_HPPIR).

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-12-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-12-git-send-email-greg.bellows@linaro.org
      [PMM: make utility fn static; coding style fixes; AckCtl has an effect
       for GICv2 without security extensions as well; removed checks on enable
       bits because these are done when we set current_pending[cpu]]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8150847061f8d2606101bfff77cc6ec86b081ab0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Restrict priority view

      GICs with Security Extensions restrict the non-secure view of the
      interrupt priority and priority mask registers.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-11-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-15-git-send-email-greg.bellows@linaro.org
      [PMM: minor code tweaks; fixed missing masking in gic_set_priority_mask
      and gic_set_priority]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08efa9f2d1bb27d64fbedcc2879ca45ae6832c20
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Implement Non-secure view of RPR

      For GICs with Security Extensions Non-secure reads have a restricted
      view on the current running priority.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-10-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-11-git-send-email-greg.bellows@linaro.org
      [PMM: make function static, minor comment tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 32951860834f09d1c1a0b81d8d7d5529e2d0e074
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked

      ICCICR/GICC_CTLR is banked in GICv1 implementations with Security
      Extensions or in GICv2 in independent from Security Extensions.
      This makes it possible to enable forwarding of interrupts from
      the CPU interfaces to the connected processors for Group0 and Group1.

      We also allow to set additional bits like AckCtl and FIQEn by changing
      the type from bool to uint32. Since the field does not only store the
      enable bit anymore and since we are touching the vmstate, we use the
      opportunity to rename the field to cpu_ctlr.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-9-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-9-git-send-email-greg.bellows@linaro.org
      [PMM: rewrote to store state in a single uint32_t rather than
       keeping the NS and S banked variants separate; this considerably
       simplifies the get/set functions]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 822e9cc310484f77e0b1c16fbef763a5d0eec80a
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked

      This register is banked in GICs with Security Extensions. Storing the
      non-secure copy of BPR in the abpr, which is an alias to the non-secure
      copy for secure access. ABPR itself is only accessible from secure state
      if the GIC implements Security Extensions.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-8-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-10-git-send-email-greg.bellows@linaro.org
      [PMM: rewrote to fix style issues and correct handling of GICv2
       without security extensions]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 679aa175e84f5f80b32b307fce5a6b92729e0e61
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked

      ICDDCR/GICD_CTLR is banked if the GIC has the security extensions,
      and the S (or only) copy has separate enable bits for Group0 and
      Group1 enable if the GIC implements interrupt groups.

      EnableGroup0 (Bit [1]) in GICv1 is architecturally IMPDEF. Since this
      bit (Enable Non-secure) is present in the integrated GIC of the Cortex-A9
      MPCore, we support this bit in our GICv1 implementation too.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-7-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-8-git-send-email-greg.bellows@linaro.org
      [PMM: rewritten to store the state in a single s->ctlr uint32,
       with the NS register handled as an alias of bit 1 in that value;
       added vmstate version bump]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit eb8b9530b0c618d4f2e728eae10d89239d35b0c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state

      Now that the GIC base class has state fields for the GICD_IGROUPRn
      registers, make kvm_arm_gic_get() and kvm_arm_gic_put() write and
      read them. This allows us to remove the check that made us
      fail migration if the guest had set any of the group register bits.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-6-git-send-email-peter.maydell@linaro.org

  commit c27a5ba94874cb3a29e21b3ad4bd5e504aea93b2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Add Interrupt Group Registers

      The Interrupt Group Registers allow the guest to configure interrupts
      into one of two groups, where Group0 are higher priority and may
      be routed to IRQ or FIQ, and Group1 are lower priority and always
      routed to IRQ. (In a GIC with the security extensions Group0 is
      Secure interrupts and Group 1 is NonSecure.)
      The GICv2 always supports interrupt grouping; the GICv1 does only
      if it implements the security extensions.

      This patch implements the ability to read and write the registers;
      the actual functionality the bits control will be added in a
      subsequent patch.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-5-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-7-git-send-email-greg.bellows@linaro.org
      [PMM: bring GIC_*_GROUP macros into line with the others, ie a
       simple SET/CLEAR/TEST rather than GROUP0/GROUP1;
       utility gic_has_groups() function;
       minor style fixes;
       bump vmstate version]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9d853533cc1a27dc09b10c7ab89677f9c5dd8f4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Switch to read/write callbacks with tx attributes

      Switch the GIC's MMIO callback functions to the read_with_attrs
      and write_with_attrs functions which provide MemTxAttrs. This will
      allow the GIC to correctly handle secure and nonsecure register
      accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1430502643-25909-4-git-send-email-peter.maydell@linaro.org

  commit 5543d1abb6e218a9d3b8887b777fd3947c86c4cf
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Add Security Extensions property

      Add a QOM property which allows the GIC Security Extensions to be
      enabled. These are an optional part of the GICv1 and GICv2 architecture.
      This commit just adds the property and some sanity checks that it
      is only enabled on GIC revisions that support it.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-3-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-5-git-send-email-greg.bellows@linaro.org
      [PMM: changed property name, added checks that it isn't set for
       older GIC revisions or if using the KVM VGIC; reworded commit message]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 44f552964714a41ccd41b5e8ac4cbd2478249db1
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Create outbound FIQ lines

      Create the outbound FIQ lines from the GIC to the CPUs; these are
      used if the GIC has security extensions or grouping support.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-2-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-2-git-send-email-greg.bellows@linaro.org
      [PMM: added FIQ lines to kvm-arm-gic so its interface is the same;
      tweaked commit message]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 16b781aaef69c90d5f4f5456615f0c26a4f45740
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/sd: Don't pass BlockBackend to sd_reset()

      The only valid BlockBackend to pass to sd_reset() is the one for
      the SD card, which is sd->blk. Drop the second argument from this
      function in favour of having it just use sd->blk.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1430683444-9797-1-git-send-email-peter.maydell@linaro.org

  commit 165cdaf857dc850f676fff0b5b873a51865baa9c
  Author: Adrian Huang <adrianhuang0701@gmail.com>
  Date:   Tue May 12 11:57:16 2015 +0100

      armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set

      Consider the following pseudo code to configure SYSTICK (The
      recommended programming sequence from "the definitive guide to the
      arm cortex-m3"):
          SYSTICK Reload Value Register = 0xffff
          SYSTICK Current Value Register = 0
          SYSTICK Control and Status Register = 0x7

      The pseudo code "SYSTICK Current Value Register = 0" leads to invoking
      systick_reload(). As a consequence, the systick.tick member is updated
      and the systick timer starts to count down when the ENABLE bit of
      SYSTICK Control and Status Register is cleared.

      The worst case is that: during the system initialization, the reset
      value of the SYSTICK Control and Status Register is 0x00000000.
      When the code "SYSTICK Current Value Register = 0" is executed, the
      systick.tick member is accumulated with "(s->systick.reload + 1) *
      systick_scale(s)". The systick_scale() gets the external_ref_clock
      scale because the CLKSOURCE bit of the SYSTICK Control and Status
      Register is cleared. This is the incorrect behavior because of the
      code "SYSTICK Control and Status Register = 0x7". Actually, we want
      the processor clock instead of the external reference clock.

      This incorrect behavior defers the generation of the first interrupt.

      The patch fixes the above-mentioned issue by setting the systick.tick
      member and modifying the systick timer only if the ENABLE bit of
      the SYSTICK Control and Status Register is set.

      In addition, the Cortex-M3 Devices Generic User Guide mentioned that
      "When ENABLE is set to 1, the counter loads the RELOAD value from the
      SYST RVR register and then counts down". This patch adheres to the
      statement of the user guide.

      Signed-off-by: Adrian Huang <adrianhuang0701@gmail.com>
      Reviewed-by: Jim Huang <jserv.tw@gmail.com>
      [PMM: minor tweak to comment text]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 19fbe5084c1da6af95177c86e4cab64241d479a8
  Merge: 704eb1c 7db161f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 10:40:31 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon May 11 16:25:58 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        rocker: timestamp on the debug logs helps correlate with events in the VM
        MAINTAINERS: add rocker
        rocker: add tests
        rocker: add new rocker switch device
        pci: add network device class 'other' for network switches
        pci: add rocker device ID
        rocker: add register programming guide
        virtio-net: use qemu_mac_strdup_printf
        net: add MAC address string printer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 704eb1c09963149db4a3407d5ba173ba2a9244bb
  Merge: 0403b0f 1ceca07
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 09:01:51 2015 +0100

      Merge remote-tracking branch 'remotes/qmp-unstable/tags/for-upstream' into staging

      QMP pull request

      # gpg: Signature made Mon May 11 14:15:19 2015 BST using RSA key ID E24ED5A7
      # gpg: Good signature from "Luiz Capitulino <lcapitulino@gmail.com>"

      * remotes/qmp-unstable/tags/for-upstream:
        scripts: qmp-shell: Add verbose flag
        scripts: qmp-shell: add transaction subshell
        scripts: qmp-shell: Expand support for QMP expressions
        scripts: qmp-shell: refactor helpers
        MAINTAINERS: New maintainer for QMP and QAPI
        json-parser: Accept 'null' in QMP
        qobject: Add a special null QObject
        qobject: Clean up around qtype_code
        QJSON: Use OBJECT_CHECK

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0403b0f539f40a21da60409b825b4653b273ab39
  Merge: 266745c bc1f7c4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 16:21:50 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, virtio enhancements

      Memory hot-unplug support for pc, MSI-X
      mapping update speedup for virtio-pci,
      misc refactorings and bugfixes.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon May 11 08:23:43 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (28 commits)
        acpi: update expected files for memory unplug
        virtio-scsi: Move DEFINE_VIRTIO_SCSI_FEATURES to virtio-scsi
        virtio-net: Move DEFINE_VIRTIO_NET_FEATURES to virtio-net
        pci: Merge pci_nic_init() into pci_nic_init_nofail()
        acpi: add a missing backslash to the \_SB scope.
        qmp-event: add event notification for memory hot unplug error
        acpi: add hardware implementation for memory hot unplug
        acpi: fix "Memory device control fields" register
        acpi: extend aml_field() to support UpdateRule
        acpi, mem-hotplug: add unplug cb for memory device
        acpi, mem-hotplug: add unplug request cb for memory device
        acpi, mem-hotplug: add acpi_memory_slot_status() to get MemStatus
        docs: update documentation for memory hot unplug
        virtio: coding style tweak
        pci: remove hard-coded bar size in msix_init_exclusive_bar()
        virtio-pci: speedup MSI-X masking and unmasking
        virtio: introduce vector to virtqueues mapping
        virtio-ccw: using VIRTIO_NO_VECTOR instead of 0 for invalid virtqueue
        monitor: check return value of qemu_find_net_clients_except()
        monitor: replace the magic number 255 with MAX_QUEUE_NUM
        ...

      Conflicts:
      	hw/s390x/s390-virtio-bus.c

      [PMM: fixed conflict in s390_virtio_scsi_properties and
      s390_virtio_net_properties arrays; since the result of the
      two conflicting patches is to empty the property arrays
      completely, the conflict resolution is to remove them entirely.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 266745cacb848d7cd0ae8889ae262e8718ace4d4
  Merge: 9ad2c8c 3446a11
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 15:07:12 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150511' into staging

      TriCore bugfixes

      # gpg: Signature made Mon May 11 13:26:40 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150511:
        target-tricore: fix rfe not restoring the PC
        target-tricore: fix rslcx restoring the upper context instead of the lower
        target-tricore: fix BO_OFF10_SEXT calculating the wrong offset
        target-tricore: fix SLR_LD_W and SLR_LD_W_POSTINC insn being a 2 byte memory access insted of 4
        target-tricore: Fix LOOP using wrong register for compare

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7db161f6dd144760b2912026d992837ef80ca7e7
  Author: David Ahern <dsahern@gmail.com>
  Date:   Fri Mar 13 21:09:33 2015 -0700

      rocker: timestamp on the debug logs helps correlate with events in the VM

      Signed-off-by: David Ahern <dsahern@gmail.com>
      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-10-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de24d3f1013dbee65b42f34cb825f056647861a5
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:32 2015 -0700

      MAINTAINERS: add rocker

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-9-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 63d2ada2f55a85c3143ecf69a5aeecf6b3f3ffc9
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:31 2015 -0700

      rocker: add tests

      Add some basic test for rocker to test L2/L3/L4 functionality.  Requires an
      external test environment, simp, located here:

      https://github.com/scottfeldman/simp

      To run tests, simp environment must be installed and a suitable VM image built
      and installed with a Linux 3.18 (or greater) kernel with rocker driver support
      enabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1426306173-24884-8-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dc488f888060afdc129e0cc8812cf50c4c083423
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:30 2015 -0700

      rocker: add new rocker switch device

      Rocker is a simulated ethernet switch device.  The device supports up to 62
      front-panel ports and supports L2 switching and L3 routing functions, as well
      as L2/L3/L4 ACLs.  The device presents a single PCI device for each switch,
      with a memory-mapped register space for device driver access.

      Rocker device is invoked with -device, for example a 4-port switch:

        -device rocker,name=sw1,len-ports=4,ports[0]=dev0,ports[1]=dev1, \
               ports[2]=dev2,ports[3]=dev3

      Each port is a netdev and can be paired with using -netdev id=<port name>.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Acked-by: Scott Feldman <sfeldma@gmail.com>
      Acked-by: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: David Ahern <dsahern@gmail.com>
      Message-id: 1426306173-24884-7-git-send-email-sfeldma@gmail.com

      rocker: fix clang compiler errors

      Consolidate all forward typedef declarations to rocker.h.

      Signed-off-by: David Ahern <dsahern@gmail.com>
      Acked-by: Scott Feldman <sfeldma@gmail.com>
      Acked-by: Jiri Pirko <jiri@resnulli.us>

      rocker: add support for flow modification

      We had support for flow add/del.  This adds support for flow mod.  I needed
      this for L3 support where an existing route is modified using NLM_F_REPLACE.
      For example:

        ip route add 12.0.0.0/30 nexthop via 11.0.0.1 dev swp1
        ip route change 12.0.0.0/30 nexthop via 11.0.0.9 dev swp2

      The first cmd adds the route.  The second cmd changes the existing route by
      changing its nexthop info.

      In the device, a mod operation results in the matching flow enty being modified
      with the new settings.  This is atomic to the device.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dc407ae8a75d03cf48e114d3812d077fa29a8bd9
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:29 2015 -0700

      pci: add network device class 'other' for network switches

      Rocker is an ethernet switch device, so add 'other' network device class as
      defined by PCI to cover these types of devices.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-6-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5dcc26371dcc72976777c51f0251127716a59ed8
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:28 2015 -0700

      pci: add rocker device ID

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bbc53c7e2580264fe2b6ea84bd8f3480bcc7c845
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:27 2015 -0700

      rocker: add register programming guide

      This is the register programming guide for the Rocker device.  It's intended
      for driver writers and device writers.  It covers the device's PCI space,
      the register set, DMA interface, and interrupts.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0575ba4a52c9259357af29d842950e978306fa4
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:26 2015 -0700

      virtio-net: use qemu_mac_strdup_printf

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426306173-24884-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 890ee6abb385d6508bba7f5273c74a8e43bea6af
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:25 2015 -0700

      net: add MAC address string printer

      We can use this in virtio-net code as well as new Rocker driver code, so
      up-level this.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426306173-24884-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ceca07e48ead0dd2e41576c81d40e6a91cafefd
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:04 2015 -0400

      scripts: qmp-shell: Add verbose flag

      Add a verbose flag that shows the QMP command that was
      constructed, to allow for later copy/pasting, reference,
      debugging, etc.

      The QMP is converted from a Python literal to JSON first,
      to ensure that it is viable input to the actual QMP parser.

      As a side-effect, this JSON output will helpfully show all
      the necessary conversions that were performed on the input,
      illustrating that "True" was transformed back into "true",
      literal values are now escaped with "" instead of '', and so on.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 30bd6815efbaf5bae70885feac9a35e149e2f1ad
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:03 2015 -0400

      scripts: qmp-shell: add transaction subshell

      Add a special processing mode to craft transactions.

      By entering "transaction(" the shell will enter a special
      mode where each subsequent command will be saved as a transaction
      instead of executed as an individual command.

      The transaction can be submitted by entering ")" on a line by itself.

      Examples:

      Separate lines:

      (QEMU) transaction(
      TRANS> block-dirty-bitmap-add node=drive0 name=bitmap1
      TRANS> block-dirty-bitmap-clear node=drive0 name=bitmap0
      TRANS> )

      With a transaction action included on the first line:

      (QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap2
      TRANS> block-dirty-bitmap-add node=drive0 name=bitmap3
      TRANS> )

      As a one-liner, with just one transaction action:

      (QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap0 )

      As a side-effect of this patch, blank lines are now parsed as no-ops,
      regardless of which shell mode you are in.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6092c3ecc4bdafee5bf07061be78a4a2cc5a5088
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:02 2015 -0400

      scripts: qmp-shell: Expand support for QMP expressions

      This includes support for [] expressions, single-quotes in
      QMP expressions (which is not strictly a part of JSON), and
      the ability to use "True", "False" and "None" literals instead
      of JSON's equivalent true, false, and null literals.

      qmp-shell currently allows you to describe values as
      JSON expressions:
      key={"key":{"key2":"val"}}

      But it does not currently support arrays, which are needed
      for serializing and deserializing transactions:
      key=[{"type":"drive-backup","data":{...}}]

      qmp-shell also only currently accepts doubly quoted strings
      as-per JSON spec, but QMP allows single quotes.

      Lastly, python allows you to utilize "True" or "False" as
      boolean literals, but JSON expects "true" or "false". Expand
      qmp-shell to allow the user to type either, converting to the
      correct type.

      As a consequence of the above, the key=val parsing is also improved
      to give better error messages if a key=val token is not provided.

      CAVEAT: The parser is still extremely rudimentary and does not
      expect to find spaces in {} nor [] expressions. This patch does
      not improve this functionality.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit a7430a0badc59bd6295936e06c1869e8fe32649d
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:01 2015 -0400

      scripts: qmp-shell: refactor helpers

      Refactor the qmp-shell command line processing function
      into two components. This will be used to allow sub-expressions,
      which will assist us in adding transactional support to qmp-shell.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9740618cd2a0ed85b9c1648f05f3066f525f4b2e
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Tue May 5 10:39:15 2015 -0400

      MAINTAINERS: New maintainer for QMP and QAPI

      Markus is taking over maintership of QMP and the QAPI from
      me. Markus has always been a great reviewer and contributor
      to those subsystems. In the last few months he's also doing
      pull requests that are a lot more relevant than the ones I
      was able to do. So, this is a natural move.

      I'm still the maintainer of HMP and QObjects, but I'm
      looking for someone to take over those too.

      PS: This commit also fixes the file listing for the QMP
          entry.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e549e7161f37416ff66971d77d021d30057045ca
  Author: Eric Blake <eblake@redhat.com>
  Date:   Wed Apr 29 15:35:06 2015 -0600

      json-parser: Accept 'null' in QMP

      We document that in QMP, the client may send any json-value
      for the optional "id" key, and then return that same value
      on reply (both success and failures, insofar as the failure
      happened after parsing the id).  [Note that the output may
      not be identical to the input, as whitespace may change and
      since we may reorder keys within a json-object, but that this
      still constitutes the same json-value].  However, we were not
      handling the JSON literal null, which counts as a json-value
      per RFC 7159.

      Also, down the road, given the QAPI schema of {'*foo':'str'} or
      {'*foo':'ComplexType'}, we could decide to allow the QMP client
      to pass { "foo":null } instead of the current representation of
      { } where omitting the key is the only way to get at the default
      NULL value.  Such a change might be useful for argument
      introspection (if a type in older qemu lacks 'foo' altogether,
      then an explicit "foo":null probe will force an easily
      distinguished error message for whether the optional "foo" key
      is even understood in newer qemu).  And if we add default values
      to optional arguments, allowing an explicit null would be
      required for getting a NULL value associated with an optional
      string that has a non-null default.  But all that can come at a
      later day.

      The 'check-unit' testsuite is enhanced to test that parsing
      produces the same object as explicitly requesting a reference
      to the special qnull object.  In addition, I tested with:

      $ ./x86_64-softmmu/qemu-system-x86_64 -qmp stdio -nodefaults
      {"QMP": {"version": {"qemu": {"micro": 91, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
      {"execute":"qmp_capabilities","id":null}
      {"return": {}, "id": null}
      {"id":{"a":null,"b":[1,null]},"execute":"quit"}
      {"return": {}, "id": {"a": null, "b": [1, null]}}
      {"timestamp": {"seconds": 1427742379, "microseconds": 423128}, "event": "SHUTDOWN"}

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 481b002cc81ed7fc7b06e32e9d4d495d81739d14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Apr 29 15:35:05 2015 -0600

      qobject: Add a special null QObject

      I'm going to fix the JSON parser to recognize null.  The obvious
      representation of JSON null as (QObject *)NULL doesn't work, because
      the parser already uses it as an error value.  Perhaps we should
      change it to free NULL for null, but that's more than I can do right
      now.  Create a special null QObject instead.

      The existing QDict, QList, and QString all represent something that
      is a pointer in C and could therefore be associated with NULL.  But
      right now, all three of these sub-types are always non-null once
      created, so the new null sentinel object is intentionally unrelated
      to them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit a7c31816288a8f20fc387d69d441413e7a8c9ff1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Apr 29 15:35:04 2015 -0600

      qobject: Clean up around qtype_code

      QTYPE_NONE is a sentinel value.  No QObject has this type code.
      Document it properly.

      Fix dump_qobject() to abort() on QTYPE_NONE, just like for any other
      invalid type code.

      Fix to_json() to abort() on all invalid type codes, not just
      QTYPE_MAX.

      Clean up Property member qtype's type: it's a qtype_code.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4cf2d837340589155acfda993c51e66eb5800416
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sat Apr 25 12:28:06 2015 -0300

      QJSON: Use OBJECT_CHECK

      The QJSON code used casts to (QJSON*) directly, instead of OBJECT_CHECK.
      There were even some functions using object_dynamic_cast() calls
      followed by assert(), which is exactly what OBJECT_CHECK does (by
      calling object_dynamic_cast_assert()).

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9ad2c8cd41a086020e21aa6d616b73bd5e2a800b
  Merge: b951cda 0caef8f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 13:54:00 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-05-09' into staging

      trivial patches for 2015-05-09

      # gpg: Signature made Fri May  8 22:58:42 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-05-09:
        docs: update BLOCK_IMAGE_CORRUPTED documentation
        glib-compat.h: change assert to g_assert
        Remove various unused functions
        sheepdog: fix resource leak with sd_snapshot_create
        xhci: remove unused code

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3446a11181c6e8263dbd9c13c28986df4317099e
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:41:10 2015 +0200

      target-tricore: fix rfe not restoring the PC

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit bc72f8aaf23fa11833e0e04c10b5c0e1036c2609
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:39:18 2015 +0200

      target-tricore: fix rslcx restoring the upper context instead of the lower

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4959d6b3662d94a5add5811ba1ff5243116b8987
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:36:55 2015 +0200

      target-tricore: fix BO_OFF10_SEXT calculating the wrong offset

      The lower part of the combined offset was sign extended and could lead to
      wrong results.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 7bd0eaec311d188412123a034abb44595deb7dae
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Apr 3 14:29:22 2015 +0200

      target-tricore: fix SLR_LD_W and SLR_LD_W_POSTINC insn being a 2 byte memory access insted of 4

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 250ef8c76861c756354ed1c67f0a4524e5339369
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 9 16:04:46 2014 +0000

      target-tricore: Fix LOOP using wrong register for compare

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit b951cda21d6b232f138ccf008e12bce8ddc95465
  Merge: ec62ad1 ca44148
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 12:01:09 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - build bugfix from Fam and new configure check from Emilio
      - two improvements to "info mtere" from Gerd
      - KVM support for memory transaction attributes
      - one more small step towards unlocked MMIO dispatch
      - one piece of the qemu-nbd errno fixes
      - trivial-ish patches from Denis and Thomas

      # gpg: Signature made Fri May  8 13:47:29 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        qemu-nbd: only send a limited number of errno codes on the wire
        rules.mak: Force CFLAGS for all objects in DSO
        configure: require __thread support
        exec: move rcu_read_lock/unlock to address_space_translate callers
        kvm: add support for memory transaction attributes
        mtree: also print disabled regions
        mtree: tag & indent a bit better
        apic_common: improve readability of apic_reset_common
        kvm: Silence warning from valgrind

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ec62ad1e27ffd1f7ff2172a916d161cc385e73bd
  Merge: 4ae740c 1271f7f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 10:43:08 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150508-1' into staging

      gtk: add ui_info support, cleanups + fixes.

      # gpg: Signature made Fri May  8 12:47:04 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150508-1:
        gtk: update mouse position in mouse_set()
        gtk: create gtk.h
        gtk: add ui_info support
        console: add dpy_ui_info_supported
        console: delayed ui_info guest notification

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ae740cc0e4a123047b40c373e699e28031d420e
  Merge: fc85cf4 ca5a21c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 09:42:20 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150508-1' into staging

      usb: qomify, bugfixes for xhci & uhci.

      # gpg: Signature made Fri May  8 12:39:28 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150508-1:
        uhci: controller is halted after reset
        usb: usb-serial QOMify
        usb: usb-redir QOMify
        usb: usb-wacom-tablet QOMify
        usb: usb-uas QOMify
        usb: usb-storage QOMify
        usb: usb-ccid QOMify
        usb: usb-net QOMify
        usb-mtp: fix segmentation fault
        usb: usb-mtp QOMify
        usb: usb-hub QOMify
        usb: usb-hid QOMify
        usb: usb-bt QOMify
        usb: usb-audio QOMify
        uhci: QOMify
        xhci: fix events for setup trb.
        Revert "xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set"
        xhci: set timer to retry xfers
        usb: fix usb-net segfault

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc1f7c4c915a7c727741c4d27a2795e1039eacd3
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon May 11 09:21:37 2015 +0200

      acpi: update expected files for memory unplug

      commit c06b2ffb02bfcc642c67300d2c4dffd5aa54932b
          acpi: add hardware implementation for memory hot unplug

      Changed both the DSDT and the SSDT. Update the expected files
      accordingly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fc85cf4a8199a657fdfd5fb902f1835973406454
  Merge: f8340b3 3cda44f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun May 10 21:40:54 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150508' into staging

      Assorted s390x patches:
      - updates for virtio-ccw and s390-virtio, making them more similar
        to virtio-pci
      - improvements regarding per-vcpu interrupts and migration

      # gpg: Signature made Fri May  8 09:45:09 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150508:
        s390x/kvm: migrate vcpu interrupt state
        s390x: move fpu regs into a subsection of the vmstate
        s390x/kvm: use ioctl KVM_S390_IRQ for vcpu interrupts
        virtio-ccw: implement ->device_plugged
        virtio-ccw: change realization sequence
        s390-virtio: clear {used,avail}_event_idx on reset as well
        s390-virtio: use common features
        s390-virtio: Accommodate guests using virtqueues too early

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca4414804114fd0095b317785bc0b51862e62ebb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 7 17:25:10 2015 +0200

      qemu-nbd: only send a limited number of errno codes on the wire

      Right now, NBD includes potentially platform-specific error values in
      the wire protocol.

      Luckily, most common error values are more or less universal: in
      particular, of all errno values <= 34 (up to ERANGE), they are all the
      same on supported platforms except for 11 (which is EAGAIN on Windows and
      Linux, but EDEADLK on Darwin and the *BSDs).  So, in order to guarantee
      some portability, only keep a handful of possible error codes and squash
      everything else to EINVAL.

      This patch defines a limited set of errno values that are valid for the
      NBD protocol, and specifies recommendations for what error to return
      in specific corner cases.  The set of errno values is roughly based on
      the errors listed in the read(2) and write(2) man pages, with some
      exceptions:

      - ENOMEM is added for servers that implement copy-on-write or other
        formats that require dynamic allocation.

      - EDQUOT is not part of the universal set of errors; it can be changed
        to ENOSPC on the wire format.

      - EFBIG is part of the universal set of errors, but it is also changed
        to ENOSPC because it is pretty similar to ENOSPC or EDQUOT.

      Incoming values will in general match system errno values, but not
      on the Hurd which has different errno values (they have a "subsystem
      code" equal to 0x10 in bits 24-31).  The Hurd is probably not something
      to which QEMU has been ported, but still do the right thing and
      reverse-map the NBD errno values to the system errno values.

      The corresponding patch to the NBD protocol description can be found at
      http://article.gmane.org/gmane.linux.drivers.nbd.general/3154.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d24697e1824467f3921c84a94f011f43d6466403
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu May 7 14:55:15 2015 +0800

      rules.mak: Force CFLAGS for all objects in DSO

      Because of the trick of process-archive-undefs, all .mo objects, even
      with --enable-modules, are dependencies of executables.

      This breaks CFLAGS propogation because the compiling of module object
      will happen too early before building for DSO.

      With GCC 5, the linking would fail because .o doesn't have -fPIC. Also,
      BUILD_DSO will be missed. (module-common.o will have it, so the stamp
      symbol was still liked in .so).

      Fix the problem by forcing the CFLAGS on individual .o-cflags during
      unnest-vars.

      Reported-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Cc: qemu-stable@nongnu.org # 2.3
      Message-Id: <1430981715-31465-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0caef8f6df4a9426bd6333ab843ce51ce005d7d0
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu May 7 17:58:26 2015 +0300

      docs: update BLOCK_IMAGE_CORRUPTED documentation

      Label the "size" and "offset" fields in BLOCK_IMAGE_CORRUPTED as
      optional, and clarify that the latter refers to the host's offset into
      the image.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f20f2a1f339b99f5b840367236ddce9d9736247c
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu May 7 13:38:02 2015 +0300

      glib-compat.h: change assert to g_assert

      include/glib-compat.h defines a bunch of functions based on glib primitives,
      and uses assert() without including assert.h.  Replace assert() with
      g_assert() to make the file more self-contained, and to fix compilation
      breakage after 28507a415a9b1e.

      Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

  commit ac9541579eb95b0b8c93ca58d0a074e1f22cd55a
  Author: Thomas Huth <huth@tuxfamily.org>
  Date:   Sun May 3 10:47:22 2015 +0200

      Remove various unused functions

      The functions tpm_backend_thread_tpm_reset() and iothread_find()
      are completely unused, let's remove them.

      Signed-off-by: Thomas Huth <huth@tuxfamily.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 973a8529c54f9e4410a0e4a18ca1dcb2b085ca7e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue May 5 09:48:03 2015 +0800

      sheepdog: fix resource leak with sd_snapshot_create

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e5a88b0cf3c902d6e9b342a90f0a4a4d5d954f7a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:03 2015 +0800

      xhci: remove unused code

      Value from xfer->packet.ep is assigned to ep here, but that
      stored value is not used before it is overwritten. Remove it.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ca5a21c40d95d7a4e26ea0a304fd2cd8ad4e6ae1
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu May 7 09:24:00 2015 +0200

      uhci: controller is halted after reset

      ... and the status register should say so.

      Fixes "usbus0: controller did not stop" error printed by freebsd.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cdf0d7694d877f19936d7404fd10b580f6e9a9b1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:36 2015 +0800

      usb: usb-serial QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d371cbc778e1868b18faa8d6764602b1f4806100
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:35 2015 +0800

      usb: usb-redir QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 924e567e1e6641f4af7e927f9c420cc7b4464073
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:34 2015 +0800

      usb: usb-wacom-tablet QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b06d099b0ab9b055414508ca55133b200d675f8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:33 2015 +0800

      usb: usb-uas QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 79e2590cbf9887a99a65d2aa62da78c6dfd9cdb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:32 2015 +0800

      usb: usb-storage QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 61b4887b41b270bc837ead57bc502d904af023bb
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:31 2015 +0800

      usb: usb-ccid QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fe47db72210dc17b794954f978ef1d1236cbeb72
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:30 2015 +0800

      usb: usb-net QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e60baebd409d547292c778d599111ea1623dd4b5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:29 2015 +0800

      usb-mtp: fix segmentation fault

      When x-root property not be configured, will cause segfault
      because of null pointer accessing. Add a check for s->root
      property avoid segfault.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7c03a899e6e4030a88bd42c4d494e3a7521806ea
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:28 2015 +0800

      usb: usb-mtp QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e81b13ad94803bf13491bb71c8a76a5d7db9ddf1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:27 2015 +0800

      usb: usb-hub QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f56691295e38429bbfe476d57676c53bcb1fd437
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:26 2015 +0800

      usb: usb-hid QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a293e82bbef666f66be733993e276998319568e1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:25 2015 +0800

      usb: usb-bt QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0389a0b10967b639ac7444453274b910a4b6f2ed
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:24 2015 +0800

      usb: usb-audio QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49184b6253a50385c5e934cc4eb813b79cc956f2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:23 2015 +0800

      uhci: QOMify

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit df0f1692db9236a469496cc09fc7bd5faf31efad
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:31:44 2015 +0200

      xhci: fix events for setup trb.

      When we find a IOC bit set on a setup trb and therefore queue an event,
      that should not stop events being generated for following data trbs.
      So clear the 'reported' flag.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88dbed3f5946b74cf02c1bb0082b8c50037720ea
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:19:35 2015 +0200

      Revert "xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set"

      This makes xhci generate multiple short packet events in case of
      multi-trb transfers.  Which is wrong.  We need to fix this in a
      different way.

      This reverts commit aa6857891df614c620e6e9fc4bc4af6e0e49cafd.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4e8cfbe1143d8384387595b500212d7a7f11aeae
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:19:14 2015 +0200

      xhci: set timer to retry xfers

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e
  Author: Michal Kazior <michal.kazior@tieto.com>
  Date:   Wed Apr 29 11:34:59 2015 +0000

      usb: fix usb-net segfault

      The dev->config pointer isn't set until guest
      system initializes usb devices (via
      usb_desc_set_config). However qemu networking can
      go through some motions prior to that, e.g.:

       #0  is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653
       #1  0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315
       #2  0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470
       #3  0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101
       #4  0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470
       #5  0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172

      The command to reproduce most reliably was:

       qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0

      This wasn't strictly a problem with tap. Other
      networking endpoints (vde, user) could trigger
      this problem as well.

      Fixes: https://bugs.launchpad.net/qemu/+bug/1050823
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 768b7855c86c4f46b605183ae9451e9af64ca288
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Wed Apr 29 13:09:02 2015 +0200

      configure: require __thread support

      The codebase doesn't build without __thread support.
      Formalise this requirement by adding a check for it in the
      configure script.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3cda44f7bae5c9feddc11630ba6eecb2e3bed425
  Author: Jens Freimann <jfrei@linux.vnet.ibm.com>
  Date:   Mon Mar 2 17:44:24 2015 +0100

      s390x/kvm: migrate vcpu interrupt state

      This patch adds support to migrate vcpu interrupts.
      We use ioctl KVM_S390_GET_IRQ_STATE and _SET_IRQ_STATE
      to get/set the complete interrupt state for a vcpu.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 46c804def4bda2491c546e8e33b86fe4981e4b68
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Mon Mar 30 13:22:47 2015 +0200

      s390x: move fpu regs into a subsection of the vmstate

      Let's move the floating point registers into a seperate subsection and
      bump up the version id. This cleans up the current vmstate and will
      allow for a future extension with vector registers in a compatible way.

      This patch is based on a patch from Eric Farman.

      Reviewed-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 1191c94963f36b3f9631fcd1ec2e9296631b407e
  Author: Jens Freimann <jfrei@linux.vnet.ibm.com>
  Date:   Thu Dec 18 17:38:05 2014 +0100

      s390x/kvm: use ioctl KVM_S390_IRQ for vcpu interrupts

      KVM_S390_INT uses only two parameter fields. This is not
      enough to pass all required information for certain interrupts.

      A new ioctl KVM_S390_IRQ is available which allows us to
      inject all local interrupts as defined in the Principles of
      Operation. It takes a struct kvm_s390_irq as a parameter
      which can store interrupt payload data for all interrupts.

      Let's use the new ioctl for injecting vcpu interrupts.

      Tested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fb846a094fdee7bb6a88b48aeed0d97a8080a20d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Apr 21 16:36:56 2015 +0200

      virtio-ccw: implement ->device_plugged

      Let's move operations that are only valid after the backend has been
      realized to a ->device_plugged callback, just as virtio-pci does.
      Also reorder setting up the host feature bits to the sequence used
      by virtio-pci.

      While we're at it, also add a ->device_unplugged callback to stop
      ioeventfd, just to be on the safe side.

      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1429627016-30656-3-git-send-email-cornelia.huck@de.ibm.com>

  commit 1fa755234e24697cc76f326782edbb09bd0a3a53
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Apr 21 16:36:55 2015 +0200

      virtio-ccw: change realization sequence

      virtio-ccw has an odd sequence of realizing devices: first the
      device-specific relization (net, block, ...), then the generic
      realization. It feels less odd to have the generic realization
      callback trigger the device-specific realization instead (and this
      also matches what virtio-pci does).

      One thing to note: We need to defer initializing the cu model in the
      sense id data until after the device-specific realization has been
      performed, as we need to refer to the virtio device's device_id.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1429627016-30656-2-git-send-email-cornelia.huck@de.ibm.com>

  commit 77ae0b2a6e731ab7b97e9fae401c579397edb31c
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon May 4 15:27:25 2015 +0200

      s390-virtio: clear {used,avail}_event_idx on reset as well

      The old s390-virtio transport clears the vring used/avail indices in
      the shared area on reset. When we enabled event_idx for virtio-blk, we
      noticed that this is not enough: We also need to clear the published
      used/avail event indices, or reboot will fail.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f50616a81b7f88a9adac16f3ea0236311a748eca
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Apr 29 15:30:58 2015 +0200

      s390-virtio: use common features

      We used to avoid enabling event_idx for virtio-blk devices via
      s390-virtio, but we now have a workaround in place for guests trying
      to use the device before setting DRIVER_OK. Therefore, let's add
      DEFINE_VIRTIO_COMMON_FEATURES to the base device so all devices get
      those common features - and make s390-virtio use the same mechanism
      as the other transports do.

      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit cb927b8aee7c3993a43cb829f7341071f873857b
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Apr 30 17:53:13 2015 +0200

      s390-virtio: Accommodate guests using virtqueues too early

      Feature updates are not a synchronuous operation for the legacy
      s390-virtio transport. This transport syncs the guest feature bits
      (those from finalize) on the set_status hypercall. Before that qemu
      thinks that features are zero, which means QEMU will misbehave, e.g.
      it will not write the event index, even if the guest asks for it.

      Let's detect the case where a kick happens before the driver is ready
      and force sync the features.
      With this workaround, it is now safe to switch to the common feature
      bit handling code as used by all other transports.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f8340b360b9bc29d48716ba8aca79df2b9544979
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed Sep 10 18:33:58 2014 +1000

      hw/ptimer: Do not artificially limit timers when using icount

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 838686357b1a175e9a32569700a153b207a9e10f
  Merge: 38003ae 362ba4e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 7 18:22:03 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150507-1' into staging

      migration/next for 20150507

      # gpg: Signature made Thu May  7 17:42:19 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150507-1:
        migration: Fix migration state update issue
        migration: avoid divide by zero in xbzrle cache miss rate
        migration: Add hmp interface to set and query parameters
        migration: Add qmp commands to set and query parameters
        migration: Use an array instead of 3 parameters
        migration: Add interface to control compression
        migration: Add the core code for decompression
        migration: Make compression co-work with xbzrle
        migration: Add the core code of multi-thread compression
        migration: Split save_zero_page from ram_save_page
        arch_init: Add and free data struct for decompression
        arch_init: Alloc and free data struct for compression
        qemu-file: Add compression functions to QEMUFile
        migration: Add the framework of multi-thread decompression
        migration: Add the framework of multi-thread compression
        docs: Add a doc about multiple thread compression

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 362ba4e3ee801e8f5e28d72d0009547384222927
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Fri May 8 02:31:22 2015 +0800

      migration: Fix migration state update issue

      If live migration is very fast and can be completed in 1 second,
      the dirty_sync_count of MigrationState will not be updated.
      Then you will see "dirty sync count: 0" in qemu monitor even if
      the actual dirty sync count is not 0.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 27ff42e29a1d12e9d9dbc473bbca36a50baf278b
  Author: Michael Chapman <mike@very.puzzling.org>
  Date:   Wed Apr 15 13:59:14 2015 +1000

      migration: avoid divide by zero in xbzrle cache miss rate

      This bug manifested itself as a VM that could not be resumed by libvirt
      following a migration:

        # virsh resume example
        error: Failed to resume domain example
        error: internal error: cannot parse json {"return":
          {"xbzrle-cache":
            {..., "cache-miss-rate": -nan, ...},
            ...
          }
        }: lexical error: malformed number, a digit is required after the minus sign.

      This patch also ensures xbzrle_cache_miss_prev and iterations_prev are
      cleared at the start of the migration.

      Signed-off-by: Michael Chapman <mike@very.puzzling.org>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 50e9a629c6c92e73260cd3d7c2e3f5bfd84e47e2
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:29 2015 +0800

      migration: Add hmp interface to set and query parameters

      Add the hmp interface to tune and query the parameters used in
      live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 85de83231ecde075c6b25897f2e74cd1767880e3
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:28 2015 +0800

      migration: Add qmp commands to set and query parameters

      Add the qmp commands to tune and query the parameters used in live
      migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 43c60a81ba15ea040709be5809a279a4ca59b26b
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:27 2015 +0800

      migration: Use an array instead of 3 parameters

      Put the three parameters related to multiple thread (de)compression
      into an int array, and use an enum type to index the parameter.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit dde4e694ae576462990b2ce711e62565e085c261
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:26 2015 +0800

      migration: Add interface to control compression

      The multiple compression threads can be turned on/off through
      qmp and hmp interface before doing live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 68ae113646dc84637359472e89669e5547dc5ee3
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:25 2015 +0800

      migration: Add the core code for decompression

      Implement the core logic of multiple thread decompression,
      the decompression can work now.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 98f1138902195bd9ab8a753d0ee2cf2a0a88b6e8
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:24 2015 +0800

      migration: Make compression co-work with xbzrle

      Now, multiple thread compression can co-work with xbzrle. when
      xbzrle is on, multiple thread compression will only work at the
      first round of RAM data sync.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 20eb617eacf7a0ce76d9dd10ff246d6ae7f0b4e1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:23 2015 +0800

      migration: Add the core code of multi-thread compression

      Implement the core logic of the multiple thread compression. At this
      point, multiple thread compression can't co-work with xbzrle yet.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e2102428c09901788a5e585f32f9e805137f5967
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:22 2015 +0800

      migration: Split save_zero_page from ram_save_page

      Split the function save_zero_page from ram_save_page so that we can
      reuse it later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3caf633dbde8a347cff49e960691c7fa6a82afa1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:21 2015 +0800

      arch_init: Add and free data struct for decompression

      Define the data structure and variables used to do multiple thread
      decompression, and add the code to initialize and free them.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 474ddaf6e3aebc470f4665ef4f7ce6578448c6d1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:20 2015 +0800

      arch_init: Alloc and free data struct for compression

      Define the data structure and variables used to do multiple thread
      compression, and add the code to initialize and free them.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 44f0eadc338f55d3bffe4fccefb1d4241defa418
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:19 2015 +0800

      qemu-file: Add compression functions to QEMUFile

      qemu_put_compression_data() compress the data and put it to QEMUFile.
      qemu_put_qemu_file() put the data in the buffer of source QEMUFile to
      destination QEMUFile.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3fcb38c223510cf88c6101f5d218ce0840d1354c
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:18 2015 +0800

      migration: Add the framework of multi-thread decompression

      Add the code to create and destroy the multiple threads those will be
      used to do data decompression. Left some functions empty just to keep
      clearness, and the code will be added later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8706d2d566cbf4bad2c5597bb57358e3d5f5caf0
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:17 2015 +0800

      migration: Add the framework of multi-thread compression

      Add the code to create and destroy the multiple threads those will
      be used to do data compression. Left some functions empty to keep
      clearness, and the code will be added later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 263170e679dfb456f8812a0100073990586cecb5
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:16 2015 +0800

      docs: Add a doc about multiple thread compression

      Give some details about the multiple thread (de)compression and
      how to use it in live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 38003aee196a96edccd4d64471beb1b67e9b2b17
  Merge: 233353e 00c8fa9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 6 11:16:35 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/tcg-next-20150505' into staging

      size reduction merge

      # gpg: Signature made Wed May  6 00:21:43 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-next-20150505:
        tcg: optimise memory layout of TCGTemp

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1271f7f7c60e0b0a3cc031921008a69dfd53bd34
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 1 19:12:45 2014 +0200

      gtk: update mouse position in mouse_set()

      Without that the next mouse motion event uses the old position
      as base for relative move calculation, giving wrong results and
      making your mouse pointer jump around.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit dc7ff344187db6a94294a87d63cf8332e8ed0e6f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Mar 4 15:37:27 2015 +0100

      gtk: create gtk.h

      Move various gtk bits (includes, data structures) to a header file.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1301e515eff267d4b8684e74a5b2c1b5cf03f103
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:47:00 2015 +0100

      gtk: add ui_info support

      Pass new display size to the guest after window resizes.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b7fb49f0c709a406f79372be397367ff2550373b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:21:14 2015 +0100

      console: add dpy_ui_info_supported

      Allow ui code to check whenever the emulated
      display supports display change notifications.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf1ecc82ab84dbfb4b6eea02c329bf9c2aa856ec
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Mar 12 12:51:13 2015 +0100

      console: delayed ui_info guest notification

      So we don't flood the guest with display change notifications
      while the user resizes the window.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 233353ec93e4541fa7ab1c53a922a6d5c2bfce7a
  Merge: 874e9ae ff55d72
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 18:22:12 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qmp-2015-05-05' into staging

      drop qapi nested structs

      # gpg: Signature made Tue May  5 17:40:40 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qmp-2015-05-05: (40 commits)
        qapi: Check for member name conflicts with a base class
        qapi: Support (subset of) \u escapes in strings
        qapi: Tweak doc references to QMP when QGA is also meant
        qapi: Drop dead visitor code related to nested structs
        qapi: Drop support for inline nested types
        qapi: Drop inline nested structs in query-pci
        qapi: Drop inline nested struct in query-version
        qapi: Drop tests for inline nested structs
        qapi: Merge UserDefTwo and UserDefNested in tests
        qapi: Forbid 'type' in schema
        qapi: Use 'struct' instead of 'type' in schema
        qapi: Document 'struct' metatype
        qapi: Prefer 'struct' over 'type' in generator
        qapi: More rigorous checking for type safety bypass
        qapi: Whitelist commands that don't return dictionary
        qapi: Require valid names
        qapi: More rigourous checking of types
        qapi: Add some type check tests
        qapi: Unify type bypass and add tests
        qapi: Allow true, false and null in schema json
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff55d72eaf9628e7d58e7b067b361cdbf789c9f4
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:37 2015 -0600

      qapi: Check for member name conflicts with a base class

      Our type inheritance for both 'struct' and for flat 'union' merges
      key/value pairs from the base class with those from the type in
      question.  Although the C code currently boxes things so that there
      is a distinction between which member is referred to, the QMP wire
      format does not allow passing a key more than once in a single
      object.  Besides, if we ever change the generated C code to not be
      quite so boxy, we'd want to avoid duplicate member names there,
      too.

      Fix a testsuite entry added in an earlier patch, as well as adding
      a couple more tests to ensure we have appropriate coverage.  Ensure
      that collisions are detected, regardless of whether there is a
      difference in opinion on whether the member name is optional.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a7f5966b297330f6492020019544ae87c45d699b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:36 2015 -0600

      qapi: Support (subset of) \u escapes in strings

      The handling of \ inside QAPI strings was less than ideal, and
      really only worked JSON's \/, \\, \", and our extension of \'
      (an obvious extension, when you realize we use '' instead of ""
      for strings).  For other things, like '\n', it resulted in a
      literal 'n' instead of a newline.

      Of course, at the moment, we really have no use for escaped
      characters, as QAPI has to map to C identifiers, and we currently
      support ASCII only for that.  But down the road, we may add
      support for default values for string parameters to a command
      or struct; if that happens, it would be nice to correctly support
      all JSON escape sequences, such as \n or \uXXXX.  This gets us
      closer, by supporting Unicode escapes in the ASCII range.

      Since JSON does not require \OCTAL or \xXX escapes, and our QMP
      implementation does not understand them either, I intentionally
      reject it here, but it would be an easy addition if we desired it.
      Likewise, intentionally refusing the NUL byte means we don't have
      to worry about C strings being shorter than the qapi input.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 363b4262a10a52f6d7ac1073bab5e6648da4051b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:35 2015 -0600

      qapi: Tweak doc references to QMP when QGA is also meant

      We have more than one qapi schema in use by more than one protocol.
      Add a new term 'Client JSON Protocol' for use throughout the
      document, to avoid confusion on whether something refers only to
      QMP and not QGA.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a82b982e2bddf7cd7cb490f83643e952e17d4523
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:34 2015 -0600

      qapi: Drop dead visitor code related to nested structs

      Now that we no longer have nested structs to visit, the use of
      prefix strings is no longer required.  Remove the code that is
      no longer reachable.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6b5abc7df7ef9aadb3ff0eba6ccf4f1f0181e2e1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:33 2015 -0600

      qapi: Drop support for inline nested types

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit messages for more details why); but existing
      use of inline nested structs conflicts with that goal. Now that
      all commands have been changed to avoid inline nested structs,
      nuke support for them, and turn it into a hard error. Update the
      testsuite to reflect tighter parsing rules.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 9fa02cd194a131aca75ab646ece975b6835400e1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:32 2015 -0600

      qapi: Drop inline nested structs in query-pci

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit message for more details why); but existing
      use of inline nested structs conflicts with that goal. This patch
      fixes one of only two commands relying on nested types, by
      breaking the nesting into an explicit type; it means that the
      type is now boxed instead of unboxed in C code, but the QMP wire
      format is unaffected by this change.

      Prefer the safer g_new0() while making the conversion, and reduce
      some long lines.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 4752cdbbf330ac7c593a6f337b97a79648f3f878
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:31 2015 -0600

      qapi: Drop inline nested struct in query-version

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit message for more details why); but existing
      use of inline nested structs conflicts with that goal. This patch
      fixes one of only two commands relying on nested types, by
      breaking the nesting into an explicit type; it means that the
      type is now boxed instead of unboxed in C code, but the QMP wire
      format is unaffected by this change.

      Prefer the safer g_new0() while making the conversion.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6446a592760155bb3e2e248d56bab97a34af0336
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:30 2015 -0600

      qapi: Drop tests for inline nested structs

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument;
      but existing use of inline nested structs conflicts with that goal.

      More precisely, a definition in the QAPI schema associates a name
      with a set of properties:

      Example 1: { 'struct': 'Foo', 'data': { MEMBERS... } }
      associates the global name 'Foo' with properties (meta-type struct)
      and MEMBERS...

      Example 2: 'mumble': TYPE
      within MEMBERS... above associates 'mumble' with properties (type
      TYPE) and (optional false) within type Foo

      The syntax of example 1 is extensible; if we need another property,
      we add another name/value pair to the dictionary (such as
      'base':TYPE).  The syntax of example 2 is not extensible, because
      the right hand side can only be a type.

      We have used name encoding to add a property: "'*mumble': 'int'"
      associates 'mumble' with (type int) and (optional true).  Nice,
      but doesn't scale.  So the solution is to change our existing uses
      to be syntactic sugar to an extensible form:

         NAME: TYPE   --> NAME:  { 'type': TYPE, 'optional': false }
         *ONAME: TYPE --> ONAME: { 'type': TYPE, 'optional': true }

      This patch fixes the testsuite to avoid inline nested types, by
      breaking the nesting into explicit types; it means that the type
      is now boxed instead of unboxed in C code, but makes no difference
      on the wire (and if desired, a later patch could change the
      generator to not do so much boxing in C).  When touching code to
      add new allocations, also convert existing allocations to
      consistently prefer typesafe g_new0 over g_malloc0 when a type
      name is involved.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit b6fcf32d9b851a83dedcb609091236b97cc4a985
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:29 2015 -0600

      qapi: Merge UserDefTwo and UserDefNested in tests

      In the testsuite, UserDefTwo and UserDefNested were identical
      structs other than the member names.  Reduce code duplication by
      having just one type, and choose names that also favor reuse.
      This will also make it easier for a later patch to get rid of
      inline nested types in QAPI.  When touching code related to
      allocations, convert g_malloc0(sizeof(Type)) to the more typesafe
      g_new0(Type, 1).

      Ensure that 'make check-qapi-schema check-unit' still passes.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3e391d355644b2bff7c9f187759aadb46c6e051f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:28 2015 -0600

      qapi: Forbid 'type' in schema

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Finish up the
      conversion to using "struct" in qapi schema by removing the hack
      in the generator that allowed 'type'.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 895a2a80e0e054f0d5d3715aa93d10d15e49f9f7
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:27 2015 -0600

      qapi: Use 'struct' instead of 'type' in schema

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Do the bulk of
      the conversion to "struct" in qapi schema, with a fairly
      mechanical:

      for f in `find -name '*.json'; do sed -i "s/'type'/'struct'/"; done

      followed by manually filtering out the places where we have a
      'type' embedded in 'data'.  Then tweak a couple of tests whose
      output changes slightly due to longer lines.

      I also verified that the generated files for QMP and QGA (such
      as qmp-commands.h) are the same before and after, as assurance
      that I didn't leave in any accidental member name changes.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3b2a8b85322f3677525a65c0b35deadf45fb704b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:26 2015 -0600

      qapi: Document 'struct' metatype

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Now that the
      generator accepts 'struct' as a synonym for 'type', update all
      documentation to use saner wording.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fd41dd4eae5f7ea92f10c04cb3f217727fcee91f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:25 2015 -0600

      qapi: Prefer 'struct' over 'type' in generator

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  The confusion
      is only made worse by the fact that the generator mostly already
      refers to struct even when dealing with expr['type'].  This
      commit changes the generator to consistently refer to it as
      struct everywhere, plus a single back-compat tweak that allows
      accepting the existing .json files as-is, so that the meat of
      this change is separate from the mindless churn of that change.

      Fix the testsuite fallout for error messages that change, and
      in some cases, become more legible.  Improve comments to better
      match our intentions where a struct (rather than any complex
      type) is required.  Note that in some cases, an error message
      now refers to 'struct' while the schema still refers to 'type';
      that will be cleaned up in the later commit to the schema.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 2cbf09925ad45401673a79ab77f67de2f04a826c
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:24 2015 -0600

      qapi: More rigorous checking for type safety bypass

      Now that we have a way to validate every type, we can also be
      stricter about enforcing that callers that want to bypass
      type safety in generated code.  Prior to this patch, it didn't
      matter what value was associated with the key 'gen', but it
      looked odd that 'gen':'yes' could result in bypassing the
      generated code.  These changes also enforce the changes made
      earlier in the series for documentation and consolidation of
      using '**' as the wildcard type, as well as 'gen':false as the
      canonical spelling for requesting type bypass.

      Note that 'gen':false is a one-way switch away from the default;
      we do not support 'gen':true (similar for 'success-response').
      In practice, this doesn't matter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 10d4d997f86cf2a4ce89145df5658952d5722e56
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:23 2015 -0600

      qapi: Whitelist commands that don't return dictionary

      ...or an array of dictionaries.  Although we have to cater to
      existing commands, returning a non-dictionary means the command
      is not extensible (no new name/value pairs can be added if more
      information must be returned in parallel).  By making the
      whitelist explicit, any new command that falls foul of this
      practice will have to be self-documenting, which will encourage
      developers to either justify the action or rework the design to
      use a dictionary after all.

      It's a little bit sloppy that we share a single whitelist among
      three clients (it's too permissive for each).  If this is a
      problem, a future patch could tighten things by having the
      generator take the whitelist as an argument (as in
      scripts/qapi-commands.py --legacy-returns=...), or by having
      the generator output C code that requires explicit use of the
      whitelist (as in:
       #ifndef FROBNICATE_LEGACY_RETURN_OK
       # error Command 'frobnicate' should return a dictionary
       #endif
      then having the callers define appropriate macros).  But until
      we need such fine-grained separation (if ever), this patch does
      the job just fine.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c9e0a798691d8c45747b082206e789c8f50523c9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:22 2015 -0600

      qapi: Require valid names

      Previous commits demonstrated that the generator overlooked various
      bad naming situations:
      - types, commands, and events need a valid name
      - enum members must be valid names, when combined with prefix
      - union and alternate branches cannot be marked optional

      Valid upstream names match [a-zA-Z][a-zA-Z0-9_-]*; valid downstream
      names match __[a-zA-Z][a-zA-Z0-9._-]*.  Enumerations match the
      weaker [a-zA-Z0-9._-]+ (in part thanks to QKeyCode picking an enum
      that starts with a digit, which we can't change now due to
      backwards compatibility).  Rather than call out three separate
      regex, this patch just uses a broader combination that allows both
      upstream and downstream names, as well as a small hack that
      realizes that any enum name is merely a suffix to an already valid
      name prefix (that is, any enum name is valid if prepending _ fits
      the normal rules).

      We could reject new enumeration names beginning with a digit by
      whitelisting existing exceptions.  We could also be stricter
      about the distinction between upstream names (no leading
      underscore, no use of dot) and downstream (mandatory leading
      double underscore), but it is probably not worth the bother.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit dd883c6f0547f02ae805d02852ff3691f6d08f85
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:21 2015 -0600

      qapi: More rigourous checking of types

      Now that we know every expression is valid with regards to
      its keys, we can add further tests that those keys refer to
      valid types.  With this patch, all uses of a type (the 'data':
      of command, type, union, alternate, and event; the 'returns':
      of command; the 'base': of type and union) must resolve to an
      appropriate subset of metatypes  declared by the current qapi
      parse; this includes recursing into each member of a data
      dictionary.  Dealing with '**' and nested anonymous structs
      will be done in later patches.

      Update the testsuite to match improved output.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0d8b9fb5f296a96723d98a45a6a00bfd4e45e1b9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:20 2015 -0600

      qapi: Add some type check tests

      Demonstrate that the qapi generator silently parses confusing
      types, which may cause other errors later on. Later patches
      will update the expected results as the generator is made stricter.

      Most of the new tests focus on blatant errors.  But
      returns-whitelist is a case where we have historically allowed
      returning something other than a JSON object from particular
      commands; we have to keep that behavior to avoid breaking clients,
      but it would be nicer to avoid adding such commands in the future,
      because any return that is not an (array of) object cannot be
      easily extended if future qemu wants to return additional
      information.  The QMP protocol already documents that clients
      should ignore unknown dictionary keys, but does not require
      clients to have to handle more than one type of JSON object.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d708cdbe8792a55f53e90c1c787e871d527e8d4b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:19 2015 -0600

      qapi: Unify type bypass and add tests

      For a few QMP commands, we are forced to pass an arbitrary type
      without tracking it properly in QAPI.  Among the existing clients,
      this unnamed type was spelled 'dict', 'visitor', and '**'; this
      patch standardizes on '**', matching the documentation changes
      earlier in the series.

      Meanwhile, for the 'gen' key, we have been ignoring the value,
      although the schema consistently used "'no'" ('success-response'
      was hard-coded to checking for 'no').  But now that we can support
      a literal "false" in the schema, we might as well use that rather
      than ignoring the value or special-casing a random string.  Note
      that these are one-way switches (use of 'gen':true is not the same
      as omitting 'gen'). Also, the use of '**' requires 'gen':false,
      but the use of 'gen':false does not mandate the use of '**'.

      There is no difference to the generated code.  Add some tests on
      what we'd like to guarantee, although it will take later patches
      to clean up test results and actually enforce the use of a bool
      parameter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e53188ada516c814a729551be2448684d6d8ce08
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon May 4 09:05:18 2015 -0600

      qapi: Allow true, false and null in schema json

      In the near term, we will use it for a sensible-looking
      'gen':false inside command declarations, instead of the
      current ugly 'gen':'no'.

      In the long term, it will allow conversion from shorthand
      with defaults mentioned only in side-band documentation:
       'data':{'*flag':'bool', '*string':'str'}
      into an explicit default value documentation, as in:
       'data':{'flag':{'type':'bool', 'optional':true, 'default':true},
               'string':{'type':'str', 'optional':true, 'default':null}}

      We still don't parse integer values (also necessary before
      we can allow explicit defaults), but that can come in a later
      series.

      Update the testsuite to match an improved error message.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 4dc2e6906e1084fdd37bf67385c5dcd2c72ae22b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:17 2015 -0600

      qapi: Better error messages for duplicated expressions

      The previous commit demonstrated that the generator overlooked
      duplicate expressions:
      - a complex type or command reusing a built-in type name
      - redeclaration of a type name, whether by the same or different
      metatype
      - redeclaration of a command or event
      - collision of a type with implicit 'Kind' enum for a union
      - collision with an implicit MAX enum constant

      Since the c_type() function in the generator treats all names
      as being in the same namespace, this patch adds a global array
      to track all known names and their source, to prevent collisions
      before it can cause further problems.  While valid .json files
      won't trigger any of these cases, we might as well be nicer to
      developers that make a typo while trying to add new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cfdd5bcad515a8371af59dba9625e31a6f6f733e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:16 2015 -0600

      qapi: Add tests of redefined expressions

      Demonstrate that the qapi generator doesn't deal very well with
      redefined expressions.  At the parse level, they are silently
      accepted; and while the testsuite just stops at parsing, I've
      further tested that many of them cause generator crashes or
      invalid C code if they were appended to qapi-schema-test.json.
      A later patch will tighten things up and adjust the testsuite
      to match.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0545f6b8874c28d97369f2c83e5077e0461d4f12
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:15 2015 -0600

      qapi: Better error messages for bad expressions

      The previous commit demonstrated that the generator overlooked some
      fairly basic broken expressions:
      - missing metataype
      - metatype key has a non-string value
      - unknown key in relation to the metatype
      - conflicting metatype (this patch treats the second metatype as an
      unknown key of the first key visited, which is not necessarily the
      first key the user typed)

      Add check_keys to cover these situations, and update testcases to
      match.  A couple other tests (enum-missing-data, indented-expr) had
      to change since the validation added here occurs so early.
      Conversely, changes to ident-with-escape results show that we still
      have problems where our handling of escape sequences differs from
      true JSON, which will matter down the road if we allow arbitrary
      default string values for optional parameters (but for now is not
      too bad, as we currently can avoid unicode escaping as we don't
      need to represent anything beyond C identifier material).

      While valid .json files won't trigger any of these cases, we might
      as well be nicer to developers that make a typo while trying to add
      new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 9050c65b71ac1d197330e6db221f63189e21bad5
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:14 2015 -0600

      qapi: Add some expr tests

      Demonstrate that the qapi generator doesn't deal well with
      expressions that aren't up to par. Later patches will improve
      the expected results as the generator is made stricter.  Only
      a few of the the added tests actually behave sanely at
      rejecting obvious problems or demonstrating success.

      Note that in some cases, we reject bad QAPI merely because our
      pseudo-JSON parser does not yet know how to parse numbers.  This
      series does not address that, but when a later series adds support
      for numeric defaults of integer fields, the testsuite will ensure
      that we don't lose the error (and hopefully that the error
      message quality is improved).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ab916faddd16f0165e9cc2551f90699be8efde53
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:13 2015 -0600

      qapi: Use 'alternate' to replace anonymous union

      Previous patches have led up to the point where I create the
      new meta-type "'alternate':'Foo'".  See the previous patches
      for documentation; I intentionally split as much work into
      earlier patches to minimize the size of this patch, but a lot
      of it is churn due to testsuite fallout after updating to the
      new type.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 7b1b98c420355ccea98d8bd55c9193ee6b7cef97
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:12 2015 -0600

      qapi: Document new 'alternate' meta-type

      The next patch will quit special-casing "'union':'Foo',
      'discriminator':{}" and instead use "'alternate':'Foo'".

      Separating docs from implementation makes it easier to focus
      on wording without holding up code.  In particular, making
      alternate a separate type makes for a nice type hierarchy:

                /-------- meta-type ------\
               /              |            \
          simple types    alternate     complex types
          |         |                   |           |
       built-in   enum             type(struct)   union
       |       \    /                            /    \
      numeric  string                         simple  flat

      A later patch will then clean up 'type' vs. 'struct'
      confusion.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ab045267447d52e63a79c0e18f89ae4411f5420b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:11 2015 -0600

      qapi: Rename anonymous union type in test

      Reduce churn in the future patch that replaces anonymous unions
      with a new metatype 'alternate' by changing 'AnonUnion' to
      'Alternate'.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 811d04fd0cff1229480d3f5b2e349f646ab6e3c1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:10 2015 -0600

      qapi: Segregate anonymous unions into alternates in generator

      Special-casing 'discriminator == {}' for handling anonymous unions
      is getting awkward; since this particular type is not always a
      dictionary on the wire, it is easier to treat it as a completely
      different class of type, "alternate", so that if a type is listed
      in the union_types array, we know it is not an anonymous union.

      This patch just further segregates union handling, to make sure that
      anonymous unions are not stored in union_types, and splitting up
      check_union() into separate functions.  A future patch will change
      the qapi grammar, and having the segregation already in place will
      make it easier to deal with the distinct meta-type.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 268a1c5eb10832c2e4476d3fe199ea547dabecb7
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:09 2015 -0600

      qapi: Prepare for catching more semantic parse errors

      This patch widens the scope of a try block (with the attending
      reindentation required by Python) in preparation for a future
      patch adding more instances of QAPIExprError inside the block.
      It's easier to separate indentation from semantic changes, so
      this patch has no real behavior change.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 44bd1276a7dea747c41f250cb71ab65965343a7f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:08 2015 -0600

      qapi: Tighten checking of unions

      Previous commits demonstrated that the generator had several
      flaws with less-than-perfect unions:
      - a simple union that listed the same branch twice (or two variant
      names that map to the same C enumerator, including the implicit
      MAX sentinel) ended up generating invalid C code
      - an anonymous union that listed two branches with the same qtype
      ended up generating invalid C code
      - the generator crashed on anonymous union attempts to use an
      array type
      - the generator was silently ignoring a base type for anonymous
      unions
      - the generator allowed unknown types or nested anonymous unions
      as a branch in an anonymous union

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a8d4a2e4d7e1a0207699de47142c9bdbf2cc8675
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:07 2015 -0600

      qapi: Forbid base without discriminator in unions

      None of the existing QMP or QGA interfaces uses a union with a
      base type but no discriminator; it is easier to avoid this in the
      generator to save room for other future extensions more likely to
      be useful.  An earlier commit added a union-base-no-discriminator
      test to ensure that we eventually give a decent error message;
      likewise, removing UserDefUnion outright is okay, because we moved
      all the tests we wish to keep into the tests of the simple union
      UserDefNativeListUnion in the previous commit.  Now is the time to
      actually forbid simple union with base, and remove the last
      vestiges from the testsuite.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 805017b7791200f1b72deef17dc98fd272b941eb
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:06 2015 -0600

      qapi: Clean up test coverage of simple unions

      The tests of UserDefNativeListUnion serve to validate code
      generation of simple unions without a base type, except that it
      did not have full coverage in the strict test.  The next commits
      will remove tests and support for simple unions with a base type,
      so there is no real loss at repurposing that test here as
      opposed to churn of adding a new test then deleting the old one.

      Fix some indentation and long lines while at it.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3d0c48292633260269cb21551d9bab006b2f2781
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:05 2015 -0600

      qapi: Add some union tests

      Demonstrate that the qapi generator doesn't deal well with unions
      that aren't up to par. Later patches will update the expected
      reseults as the generator is made stricter.  A few tests work
      as planned, but most show poor or missing error messages.

      Of particular note, qapi-code-gen.txt documents 'base' only for
      flat unions, but the tests here demonstrate that we currently allow
      a 'base' to a simple union, although it is exercised only in the
      testsuite.  Later patches will remove this undocumented feature, to
      give us more flexibility in adding other future extensions to union
      types.  For example, one possible extension is the idea of a
      type-safe simple enum, where added fields tie the discriminator to
      a user-defined enum type rather than creating an implicit enum from
      the names in 'data'.  But adding such safety on top of a simple
      enum with a base type could look ambiguous with a flat enum;
      besides, the documentation also mentions how any simple union can
      be represented by an equivalent flat union.  So it will be simpler
      to just outlaw support for something we aren't using.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cf3935907b5df16f667d54ad6761c7e937dcf425
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:04 2015 -0600

      qapi: Better error messages for bad enums

      The previous commit demonstrated that the generator had several
      flaws with less-than-perfect enums:
      - an enum that listed the same string twice (or two variant
      strings that map to the same C enumerator) ended up generating
      an invalid C enum
      - because the generator adds a _MAX terminator to each enum,
      the use of an enum member 'max' can also cause this clash
      - if an enum omits 'data', the generator left a python stack
      trace rather than a graceful message
      - an enum that used a non-array 'data' was silently accepted by
      the parser
      - an enum that used non-string members in the 'data' member
      was silently accepted by the parser

      Add check_enum to cover these situations, and update testcases
      to match.  While valid .json files won't trigger any of these
      cases, we might as well be nicer to developers that make a typo
      while trying to add new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ad11dbb93752ffd4bd1d5f31da7e2d9c40a68e8a
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:03 2015 -0600

      qapi: Add some enum tests

      Demonstrate that the qapi generator doesn't deal well with enums
      that aren't up to par. Later patches will update the expected
      results as the generator is made stricter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fe2a9303c9e511462f662a415c2e9d2defe9b7ca
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:02 2015 -0600

      qapi: Require ASCII in schema

      Python 2 and Python 3 have a wild history of whether strings
      default to ascii or unicode, where Python 3 requires checking
      isinstance(foo, basestr) to cover all strings, but where that
      code is not portable to Python 2.  It's simpler to just state
      that we don't care about Unicode strings, and to just always
      use the simpler isinstance(foo, str) everywhere.

      I'm no python expert, so I'm basing it on this conversation:
      https://lists.gnu.org/archive/html/qemu-devel/2014-09/msg05278.html

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cb17f79eef0d161e81ac457e4c1f124405be2a18
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:01 2015 -0600

      qapi: Fix generation of 'size' builtin type

      We were missing the 'size' builtin type (which means that QAPI using
      [ 'size' ] would fail to compile).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit b52c4b9cf0bbafdf8cede4ea1f62770d86815718
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:00 2015 -0600

      qapi: Simplify builtin type handling

      There was some redundancy between builtin_types[] and
      builtin_type_qtypes{}.  Merge them into one.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e790e666518e68134ca0570b6b4a707169ea3cb1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:04:59 2015 -0600

      qapi: Document type-safety considerations

      Go into more details about the various types of valid expressions
      in a qapi schema, including tweaks to document fixes being done
      later in the current patch series.  Also fix some stale and missing
      documentation in the QMP specification.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6fb55451728e6dc74ae4e67e4f5ab557468f084e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:04:58 2015 -0600

      qapi: Add copyright declaration on docs

      While our top-level COPYING with its GPLv2+ license applies to
      any documentation file that omits explicit instructions, these
      days it's better to be a good example of calling out our
      intentions.  Correct use of GPL requires the use of a copyright
      statement, so I'm adding notice to two QAPI documents, by
      attributing these files to the initial authors and major
      contributors.  I used:

      $ git blame --line-porcelain $file \
        | sed -n 's/^author //p' | sort | uniq -c | sort -rn

      to determine authorship of these two files.  qmp-spec.txt blames
      entirely to Red Hat (easy, since my contribution falls in that
      category); while qapi-code-gen.txt has multiple contributors
      representing multiple entities.  But since it was originally
      supplied by Michael Roth, the notice I added there copies the
      notice he has used in other files.  As there is no intended
      change in license from the implicit one previously present from
      the top level, I have not bothered to CC other contributors;
      if we want to weaken things to something looser (such as LGPL)
      so that there is no question that someone re-implementing the
      spec is not forced to use GPL, that would be a different commit.

      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 00c8fa9ffeee7458e5ed62c962faf638156c18da
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Thu Apr 2 20:07:53 2015 -0400

      tcg: optimise memory layout of TCGTemp

      This brings down the size of the struct from 56 to 32 bytes on 64-bit,
      and to 20 bytes on 32-bit. This leads to memory savings:

      Before:
      $ find . -name 'tcg.o' | xargs size
         text    data     bss     dec     hex filename
        41131   29800      88   71019   1156b ./aarch64-softmmu/tcg/tcg.o
        37969   29416      96   67481   10799 ./x86_64-linux-user/tcg/tcg.o
        39354   28816      96   68266   10aaa ./arm-linux-user/tcg/tcg.o
        40802   29096      88   69986   11162 ./arm-softmmu/tcg/tcg.o
        39417   29672      88   69177   10e39 ./x86_64-softmmu/tcg/tcg.o

      After:
      $ find . -name 'tcg.o' | xargs size
         text    data     bss     dec     hex filename
        40883   29800      88   70771   11473 ./aarch64-softmmu/tcg/tcg.o
        37473   29416      96   66985   105a9 ./x86_64-linux-user/tcg/tcg.o
        38858   28816      96   67770   108ba ./arm-linux-user/tcg/tcg.o
        40554   29096      88   69738   1106a ./arm-softmmu/tcg/tcg.o
        39169   29672      88   68929   10d41 ./x86_64-softmmu/tcg/tcg.o

      Note that using an entire byte for some enums that need less than
      that wastes a few bits (noticeable in 32 bits, where we use
      20 bytes instead of 16) but avoids extraction code, which overall
      is a win--I've tested several variations of the patch, and the appended
      is the best performer for OpenSSL's bntest by a very small margin:

      Before:
      $ taskset -c 0 perf stat -r 15 -- x86_64-linux-user/qemu-x86_64 img/bntest-x86_64 >/dev/null
      [...]
       Performance counter stats for 'x86_64-linux-user/qemu-x86_64 img/bntest-x86_64' (15 runs):

            10538.479833 task-clock (msec)  # 0.999 CPUs utilized  ( +-  0.38% )
                     772 context-switches   # 0.073 K/sec          ( +-  2.03% )
                       0 cpu-migrations     # 0.000 K/sec          ( +-100.00% )
                   2,207 page-faults        # 0.209 K/sec          ( +-  0.08% )
            10.552871687 seconds time elapsed                      ( +-  0.39% )

      After:
      $ taskset -c 0 perf stat -r 15 -- x86_64-linux-user/qemu-x86_64 img/bntest-x86_64 >/dev/null
       Performance counter stats for 'x86_64-linux-user/qemu-x86_64 img/bntest-x86_64' (15 runs):

            10459.968847 task-clock (msec)  # 0.999 CPUs utilized  ( +-  0.30% )
                     739 context-switches   # 0.071 K/sec          ( +-  1.71% )
                       0 cpu-migrations     # 0.000 K/sec          ( +- 68.14% )
                   2,204 page-faults        # 0.211 K/sec          ( +-  0.10% )
            10.473900411 seconds time elapsed                      ( +-  0.30% )

      Suggested-by: Stefan Weil <sw@weilnetz.de>
      Suggested-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 874e9aeeeb74c5459639a93439a502d262847e68
  Merge: b4c5df7 e444ea3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 14:06:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150505-1' into staging

      sdl2: add opengl support

      # gpg: Signature made Tue May  5 10:36:25 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150505-1:
        sdl2: Fix RGB555
        sdl2: add support for display rendering using opengl.
        sdl2: move SDL_* includes to sdl2.h
        console-gl: add opengl rendering helper functions
        opengl: add shader helper functions.
        opengl: add shader build infrastructure

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b4c5df7a15dad2417bc05d08a470b82ab89d56ea
  Merge: 5bccbb0 2e1c92d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 10:23:22 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-05-05' into staging

      coverity: fix address_space_rw model

      # gpg: Signature made Tue May  5 09:44:26 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-05-05:
        coverity: fix address_space_rw model

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e444ea34f8ec27acfa9ead7eaa9904238c831e69
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 12:25:27 2015 -0500

      sdl2: Fix RGB555

      Reproducable with:

      $ x86_64-softmmu/qemu-system-x86_64 \
          -kernel $vmlinuz_of_your_choice \
          -append vga=0x313 -sdl

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b71a5d5caa4f709d37fa1d7786dffc2c94f8414
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 16:54:45 2014 +0100

      sdl2: add support for display rendering using opengl.

      Add new sdl2-gl.c file, with display
      rendering functions using opengl.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 19dadfccd0124804e2790e7cb075c9df7cd3154f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 19 14:19:49 2014 +0100

      sdl2: move SDL_* includes to sdl2.h

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit cd2bc889e5b30c69926fc1511b6522e7cb4c705d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 11:40:23 2015 +0100

      console-gl: add opengl rendering helper functions

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 985e1c9b008e5e8b6eac41546266d3abcfa6282a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Apr 24 07:48:45 2015 +0200

      opengl: add shader helper functions.

      Helper functions to compile, link and run opengl shader programs.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e1c92daff752c056ae10087e6b1702b0460af88
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 4 14:18:09 2015 +0200

      coverity: fix address_space_rw model

      If the is_write argument is true, address_space_rw writes to memory
      and thus reads from the buffer.  The opposite holds if is_write is
      false.  Fix the model.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d98bc0b654b97d130338e76e0928296f84e6d6fd
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 16 13:59:17 2015 +0100

      opengl: add shader build infrastructure

      perl script to transform shader programs into c include files with
      static string constands containing the shader programs, so we can
      easily embed them into qemu.  Also some Makefile logic for them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 5bccbb04a4abba7af4398de992bf06d585fd1333
  Merge: f90f5b9 4a4d614
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 20:34:54 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches

      # gpg: Signature made Thu Apr 30 19:51:16 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        Enable NVMe start controller for Windows guest.
        MAINTAINERS: Add qemu-block list where missing
        MAINTAINERS: make block layer core Kevin Wolf's responsibility
        MAINTAINERS: make image fuzzer Stefan Hajnoczi's responsibility
        MAINTAINERS: make block I/O path Stefan Hajnoczi's responsibility
        MAINTAINERS: split out image formats
        MAINTAINERS: make virtio-blk Stefan Hajnoczi's responsibility

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 41063e1e7afcb2f13e103720fe96221657f5dbbc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 18 14:21:43 2015 +0100

      exec: move rcu_read_lock/unlock to address_space_translate callers

      Once address_space_translate will be called outside the BQL, the returned
      MemoryRegion might disappear as soon as the RCU read-side critical section
      ends.  Avoid this by moving the critical section to the callers.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1426684909-95030-3-git-send-email-pbonzini@redhat.com>

  commit 4c6637525290dc863a00be7f58fc11d07b780bd4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:30:58 2015 +0200

      kvm: add support for memory transaction attributes

      Let kvm_arch_post_run convert fields in the kvm_run struct to MemTxAttrs.
      These are then passed to address_space_rw.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8a9f720dd2fa5c1560838c26c6dad396a0cef5b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 12:57:11 2015 +0200

      mtree: also print disabled regions

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e48816aac6eef50c851e3833add886f0403b6f11
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 12:53:47 2015 +0200

      mtree: tag & indent a bit better

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 813297541196698f60525d611dd09007fa60b45b
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 7 16:53:52 2015 +0300

      apic_common: improve readability of apic_reset_common

      Replace call of cpu_is_bsp(s->cpu) which really returns
          !!(s->apicbase & MSR_IA32_APICBASE_BSP)
      with directly collected value. Due to this the tracepoint
        trace_cpu_get_apic_base((uint64_t)s->apicbase);
      will not be hit anymore in apic_reset_common.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Andreas Färber <afaerber@suse.de>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1428414832-3104-1-git-send-email-den@openvz.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03a96b83b539498510e22aab585e41015ba18247
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon Apr 27 18:59:04 2015 +0200

      kvm: Silence warning from valgrind

      valgrind complains here about uninitialized bytes with the following message:

      ==17814== Syscall param ioctl(generic) points to uninitialised byte(s)
      ==17814==    at 0x466A780: ioctl (in /usr/lib64/power8/libc-2.17.so)
      ==17814==    by 0x100735B7: kvm_vm_ioctl (kvm-all.c:1920)
      ==17814==    by 0x10074583: kvm_set_ioeventfd_mmio (kvm-all.c:574)

      Let's fix it by using a proper struct initializer in kvm_set_ioeventfd_mmio().

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-Id: <1430153944-24368-1-git-send-email-thuth@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f90f5b9a9aa41e5ea47dc7a0f3e1f99196f485c3
  Merge: 4981475 5530293
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 15:18:30 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-04-30' into staging

      trivial patches for 2015-04-30

      # gpg: Signature made Thu Apr 30 14:07:50 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-04-30: (42 commits)
        openrisc: cpu: Remove unused cpu_get_pc
        microblaze: fix memory leak
        tcg: Delete unused cpu_pc_from_tb()
        kvm: Silence warning from valgrind
        vhost-user: remove superfluous '\n' around error_report()
        target-mips: fix memory leak
        qmp-commands: Fix typo
        linux-user/elfload: use QTAILQ_FOREACH instead of open-coding it
        coroutine: remove unnecessary parentheses in qemu_co_queue_empty
        qemu-char: remove unused list node from FDCharDriver
        input: remove unused mouse_handlers list
        cpus: use first_cpu macro instead of QTAILQ_FIRST(&cpus)
        microblaze: cpu: delete unused cpu_interrupts_enabled
        microblaze: cpu: Renumber EXCP_* constants to close gap
        microblaze: cpu: Delete EXCP_NMI
        microblaze: cpu: Remove unused CC_OP enum
        microblaze: cpu: Remote unused cpu_get_pc
        microblaze: mmu: Delete flip_um fn prototype
        defconfigs: Piggyback microblazeel on microblaze
        libcacard: do not use full paths for include files in the same dir
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4a4d614ff56b4cf15e83629946afe51dc116053f
  Author: Daniel Stekloff <dan@wendan.org>
  Date:   Fri Apr 24 11:55:42 2015 -0700

      Enable NVMe start controller for Windows guest.

      Windows seems to send two separate calls to NVMe controller configuration. The
      first sends configuration info and the second the enable bit. I couldn't
      enable the Windows 8.1 in-box NVMe driver with base Qemu. I made the
      following change to store the configuration data and then handle enable and
      NVMe driver works on Windows 8.1.

      I am not a Windows expert and I'm not entirely sure this is the correct
      approach. I'm offering it for anyone who wishes to use NVMe on Windows 8.1
      using Qemu.

      I have tested this change with Linux and Windows guests with NVMe devices.

      Signed-off-by: Daniel Stekloff <dan@wendan.org>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 498147529d1f8e902e6528a0115143b53475791e
  Merge: 06feaac 2c80e99
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 14:15:56 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150430' into staging

      First pile of s390x patches for 2.4, including:
      - some cleanup patches
      - sort most of the s390x devices into categories
      - support for the new STSI post handler, used to insert vm name and
        friends
      - support for the new MEM_OP ioctl (including access register mode)
        for accessing guest memory

      # gpg: Signature made Thu Apr 30 12:56:58 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150430:
        kvm: better advice for failed s390x startup
        s390x/kvm: Support access register mode for KVM_S390_MEM_OP ioctl
        s390x/mmu: Use ioctl for reading and writing from/to guest memory
        s390x/kvm: Put vm name, extended name and UUID into STSI322 SYSIB
        linux-headers: update
        s390x/mmu: Use access type definitions instead of magic values
        s390x/ipl: sort into categories
        sclp: sort into categories
        s390-virtio: sort into categories
        virtio-ccw: sort into categories

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c95e4c0e53c774dd82a78ae751ea24f537e38778
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 30 15:15:13 2015 +0200

      MAINTAINERS: Add qemu-block list where missing

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 17f1e8f5acf0016bf0b14ef9ec591d3f5081fc60
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:29 2015 +0100

      MAINTAINERS: make block layer core Kevin Wolf's responsibility

      Kevin is now sole maintainer of the core block layer, including
      BlockDriverState graphs and monitor commands.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit abfe4e9408a9e82bec9e9834eabc65f53907f281
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:28 2015 +0100

      MAINTAINERS: make image fuzzer Stefan Hajnoczi's responsibility

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d55053b16e22d46db0d98819814a31ae5c33e2c7
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:27 2015 +0100

      MAINTAINERS: make block I/O path Stefan Hajnoczi's responsibility

      The block I/O path includes the asynchronous I/O machinery and
      read/write/flush/discard processing.  It somewhat arbitrarily also
      includes block migration, which I've found myself reviewing patches for
      over the years.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e7c6e631b191c99eecb4a06fe19302e863f033c6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:26 2015 +0100

      MAINTAINERS: split out image formats

      Block driver submaintainers has proven to be a good model.  Kevin and
      Stefan are splitting up the unclaimed block drivers so each has a
      dedicated maintainer.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b457a5f54cd857815401dc4708a4c778481ec562
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:25 2015 +0100

      MAINTAINERS: make virtio-blk Stefan Hajnoczi's responsibility

      Cc: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 553029351bac9f5b4f9ea72793e55f02e7677ec2
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu Apr 30 00:38:52 2015 -0700

      openrisc: cpu: Remove unused cpu_get_pc

      This function is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4d850406a859d3a5dcfca74eb9caa76ccc064ab3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 5 11:05:20 2015 +0800

      microblaze: fix memory leak

      When not assign a -dtb argument, the variable dtb_filename
      storage returned from qemu_find_file(), which should be freed
      after use. Alternatively we define a local variable filename,
      with 'char *' type, free after use.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fee068e4f190a36ef3bda9aa7c802f90434ef8e5
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Wed Apr 29 00:52:21 2015 -0700

      tcg: Delete unused cpu_pc_from_tb()

      No code uses the cpu_pc_from_tb() function. Delete from tricore and
      arm which each provide an unused implementation. Update the comment
      in tcg.h to reflect that this is obsoleted by synchronize_from_tb.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ed0c3dad769ab747e1f5448b70eeaf134c76982
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon Apr 27 18:59:04 2015 +0200

      kvm: Silence warning from valgrind

      valgrind complains here about uninitialized bytes with the following message:

      ==17814== Syscall param ioctl(generic) points to uninitialised byte(s)
      ==17814==    at 0x466A780: ioctl (in /usr/lib64/power8/libc-2.17.so)
      ==17814==    by 0x100735B7: kvm_vm_ioctl (kvm-all.c:1920)
      ==17814==    by 0x10074583: kvm_set_ioeventfd_mmio (kvm-all.c:574)

      Let's fix it by using a proper struct initializer in kvm_set_ioeventfd_mmio().

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ab7c5aaf31213f5fc96018514e3d258e951d520f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:04 2015 +0800

      vhost-user: remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3ad9fd5a257794d516db515c217c78a5806112fe
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:02 2015 +0800

      target-mips: fix memory leak

      Coveristy reports that variable prom_buf/params_buf going
      out of scope leaks the storage it points to.

      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5403432f39fc09ce1973cc8c1a62e16502358bf7
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:20:41 2015 -0400

      qmp-commands: Fix typo

      Just a trivial patch to correct a QMP example in qmp-commands.hx.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52a53afebd2604af957d50fd4f3ce2012350a40d
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:33 2015 -0400

      linux-user/elfload: use QTAILQ_FOREACH instead of open-coding it

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b1201addc7ceb8f1fcdc378071ec6f5ab5b3f7ab
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:32 2015 -0400

      coroutine: remove unnecessary parentheses in qemu_co_queue_empty

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 63d229c32b72767461262ade78a5cb98dbe0f1b4
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:30 2015 -0400

      qemu-char: remove unused list node from FDCharDriver

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dfbf272b77cfb6b74131746a67c82271ab009f2f
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:29 2015 -0400

      input: remove unused mouse_handlers list

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c28e399cadbeaa996e2a3d334368edd4cd6b6889
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:28 2015 -0400

      cpus: use first_cpu macro instead of QTAILQ_FIRST(&cpus)

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 93100f67c723f5812d0fa9a026208cf320ef46e6
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:24 2015 -0700

      microblaze: cpu: delete unused cpu_interrupts_enabled

      This function is unused. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2161be35ce57ed5b0da0b98f902d003bfebac2c9
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Apr 29 08:34:29 2015 +0300

      microblaze: cpu: Renumber EXCP_* constants to close gap

      After removal of EXCP_NMI there's a gap in EXCP_*
      numbering. Let's remove it.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 059ec9aa34fd3c5bfe65141741c671b3e80ac6e7
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:23 2015 -0700

      microblaze: cpu: Delete EXCP_NMI

      This define is unused. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 004f979fbb83397349c9158946ec5d4f0036632b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:22 2015 -0700

      microblaze: cpu: Remove unused CC_OP enum

      This enum is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b133b09a9d8ae280bba279a1aba9af73a805e198
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:21 2015 -0700

      microblaze: cpu: Remote unused cpu_get_pc

      This function is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 19191a6bc537b2290e18430e1877de9c2db20510
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:20 2015 -0700

      microblaze: mmu: Delete flip_um fn prototype

      This is not implemented or used.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a0970d91c94241c74b2b8027268d2a7e8fe19ae3
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:19 2015 -0700

      defconfigs: Piggyback microblazeel on microblaze

      Theres no difference in defconfig. Going forward microblazeel should
      superset microblaze so use an include.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f66759d3aec208651a7ad0cd37f4fec8d86fa7c1
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 16:29:58 2015 +0300

      libcacard: do not use full paths for include files in the same dir

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 28507a415a9b1e897aa8cdab658c6cdc00eff6cd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 27 12:34:18 2015 +0200

      libcacard: stop including qemu-common.h

      This is a small step towards making libcacard standalone.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d3e4abdddfcf70b2e678de1c6b9b1c6cd3ce541e
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Apr 27 13:32:35 2015 +0200

      docs/atomics.txt: fix two typos

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5ecaa4ed882aa6040d2ddbfc6f487d8b4bcd3b83
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 19:14:26 2015 -0700

      configure: alphabetize tricore in target list

      tricore was out of alphabetical order in the target list. Fix.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ef1d27f4b17c4238ed3395724026910973026d2b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 18:38:18 2015 -0700

      arm: cpu.h: Remove unused typdefs

      These CP accessor function prototypes are unused. Remove them.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3bf2af7b40281f73d0e33ecca4095078feed07b1
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:33 2015 +0100

      util: Remove unused functions

      Delete the unused functions qemu_signalfd_available(),
      qemu_send_full() and qemu_recv_full().

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ec29ea1b2b5ffed569d52393ad8e8d3f4215b9b3
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:32 2015 +0100

      usb: Remove unused functions

      Delete set_usb_string(), usb_ep_get_ifnum(), usb_ep_get_max_packet_size()
      usb_ep_get_max_streams() and usb_ep_set_pipeline() since they are
      not used anymore.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 26b93109c0dff55aab67da66ebbace2cc39becfc
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:31 2015 +0100

      monitor: Remove unused functions

      The functions ringbuf_read_completion() and monitor_get_rs()
      are not used anywhere anymore, so let's remove them.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 04768b985e8da35cba67b60dab02865a4d8ecdca
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:30 2015 +0100

      pci: Remove unused function ich9_d2pbr_init()

      The function ich9_d2pbr_init() is completely unused and
      thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9dcfda1298662223af1b99f7aef1bcf94df134a8
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:29 2015 +0100

      vmxnet: Remove unused function vmxnet_rx_pkt_get_num_frags()

      The function is not used anymore and thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Dmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 825976153ee4c787326e0beb31144906f0a3c210
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 11:12:49 2015 +0300

      qemu-options: trivial spelling fix (messsage)

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c2cb2b041b56e113e43da78528c9dfd8257e0206
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Fri Apr 24 19:41:26 2015 +0200

      hostmem: Fix mem-path property name in error report

      The subtle difference between "property not found" and "property not
      set" is already confusing enough.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 29b558d87710a962203a45d9dd57bf7eab19dca0
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Wed Apr 15 10:18:55 2015 -0400

      tpm: fix coding style

      Fix coding style in one instance.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1897b212b780a02a5605ad934a6dd16c76571fe3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 13 17:28:27 2015 +0200

      qemu-config: remove stray inclusions of hw/ files

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f2fbb40ea32445b281696a1b3f16de670951de2e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 13 17:28:26 2015 +0200

      range: remove useless inclusions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 631b22ea206300f09b9d1bb9249169e0f0092639
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Thu Apr 9 20:32:39 2015 +0200

      misc: Fix new collection of typos

      All of them were reported by codespell.
      Most typos are in comments, one is in an error message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c9f88ce330c3d9107adfabdde33bdf10dcc05934
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:14 2015 +0800

      hw/display : remove 'struct' from 'typedef QXL struct'

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9425c004fe287bfe95e2bf64634d6a618c2b596c
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:13 2015 +0800

      ui/console : remove 'struct' from 'typedef struct' type

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4769a881cbe1130e7ba4650471ef37e2cf998a9c
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:12 2015 +0800

      ui/vnc : remove 'struct' of 'typedef struct'

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 494cb81741f867319f11ecfa0949168baf9f01d7
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:11 2015 +0800

      ui/vnc : fix coding style

          reported by checkpatch.pl

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4188e39055bfaf6d76b7d98294b0aeb8e4f3082d
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:10 2015 +0800

      bitops : fix coding style

          don't mix tab and space. The rule is 4 spaces

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4d1ba9c4f8a4d68b9d053946d551ffa8f1006b77
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue Mar 31 14:49:10 2015 -0400

      tpm: Modify DPRINTF to enable -Wformat checking

      Modify DPRINTF to always enable -Wformat checking.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 070c7607f62f9623be9ff14623a43b0ca195c572
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue Mar 31 14:49:09 2015 -0400

      tpm: Cast 64bit variables to int when used in DPRINTF

      Cast 64bit variables to int when used in DPRINTF. They only contain
      32bit of data.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c80e996e427ae31982f3405a762859578a6261d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Apr 23 17:03:46 2015 +0200

      kvm: better advice for failed s390x startup

      If KVM_CREATE failed on s390x, we print a hint to enable the switch_amode
      kernel parameter. This only applies to old kernels, and only if the
      error was -EINVAL. Moreover, with new kernels, the most likely reason
      for -EINVAL is that pgstes were not enabled.

      Let's update the error message to give a better hint on where things
      may need fixing.

      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6cb1e49de58cab8f243b05a971a9a1f80ab3223d
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Thu Mar 5 12:36:48 2015 +0300

      s390x/kvm: Support access register mode for KVM_S390_MEM_OP ioctl

      Access register mode is one of the modes that control dynamic address
      translation. In this mode the address space is specified by values of
      the access registers. The effective address-space-control element is
      obtained from the result of the access register translation. See
      the "Access-Register Introduction" section of the chapter 5 "Program
      Execution" in "Principles of Operations" for more details.

      When the CPU is in AR mode, the s390_cpu_virt_mem_rw() function must
      know which access register number to use for address translation.
      This patch does several things:
      - add new parameter 'uint8_t ar' to that function
      - decode ar number from intercepted instructions
      - pass the ar number to s390_cpu_virt_mem_rw(), which in turn passes it
      to the KVM_S390_MEM_OP ioctl.

      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit a9bcd1b8719dea2e91512238d810e2a0037e174d
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Fri Feb 6 15:54:58 2015 +0100

      s390x/mmu: Use ioctl for reading and writing from/to guest memory

      Add code to make use of the new ioctl for reading from / writing to
      virtual guest memory. By using the ioctl, the memory accesses are now
      protected with the so-called ipte-lock in the kernel.

      [CH: moved error message into kvm_s390_mem_op()]
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f07177a5599fb204e42a007db4820ceda1bc85ba
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Tue Mar 3 18:35:27 2015 +0100

      s390x/kvm: Put vm name, extended name and UUID into STSI322 SYSIB

      KVM prefills the SYSIB, returned by STSI 3.2.2. This patch allows
      userspace to intercept execution, and fill in the values, that are
      known to qemu: machine name (8 chars), extended machine name (256
      chars), extended machine name encoding (equals 2 for UTF-8) and UUID.

      STSI322 qemu handler also finds a highest virtualization level in
      level-3 virtualization stack that doesn't support Extended Names
      (Ext Name delimiter) and propagates zero Ext Name to all levels below,
      because this level is not capable of managing Extended Names of lower
      levels.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7a52ce8a160739c5d37469b0e344d3239eb86462
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 31 16:07:08 2015 +0200

      linux-headers: update

      This updates linux-headers against master 4.1-rc1 (commit
      b787f68c36d49bb1d9236f403813641efa74a031).

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 217a4acb211d603f33199cf94ada9fce3ac419b5
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 19 15:04:50 2015 +0100

      s390x/mmu: Use access type definitions instead of magic values

      Since there are now proper definitions for the MMU access type,
      let's use them in the s390x MMU code, too, instead of the
      hard-to-understand magic values.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b4ab4572b319f2c26435b2ed18cfd3fb602c7439
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 10:17:08 2015 +0100

      s390x/ipl: sort into categories

      The s390 ipl device has no real home (it's not really a storage device),
      so let's sort it into the misc category.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 183f6b8d7e7adf6b892523644e38b534c5954be1
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:44:39 2015 +0100

      sclp: sort into categories

      Sort the sclp consoles into the input category, just as virtio-serial.
      Various other sclp devices don't have an obvious category, sort them
      into misc.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 4d1866de9422c4b359f61819ee01efc9b988187b
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:43:26 2015 +0100

      s390-virtio: sort into categories

      Sort the various s390-virtio devices into the same categories as their
      virtio-pci counterparts.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit cd20d61634092a9fa19c8c6f0a749526e9958374
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:42:03 2015 +0100

      virtio-ccw: sort into categories

      Sort the various virtio-ccw devices into the same categories as their
      virtio-pci counterparts.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 06feaacfb4cfef10cc0c93d97df7bfc8a71dbc7e
  Merge: a1fe58f d064d9f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 12:04:11 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan)
      - next part in the thread-safe address_space_* saga: atomic access
        to the bounce buffer and the map_clients list, from Fam
      - optional support for linking with tcmalloc, also from Fam
      - reapplying Peter Crosthwaite's "Respect as_translate_internal
        length clamp" after fixing the SPARC fallout.
      - build system fix from Wei Liu
      - small acpi-build and ioport cleanup by myself

      # gpg: Signature made Wed Apr 29 09:34:00 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (22 commits)
        nbd/trivial: fix type cast for ioctl
        translate-all: use bitmap helpers for PageDesc's bitmap
        target-i386: disable LINT0 after reset
        Makefile.target: prepend $libs_softmmu to $LIBS
        milkymist: do not modify libs-softmmu
        configure: Add support for tcmalloc
        exec: Respect as_translate_internal length clamp
        ioport: reserve the whole range of an I/O port in the AddressSpace
        ioport: loosen assertions on emulation of 16-bit ports
        ioport: remove wrong comment
        ide: there is only one data port
        gus: clean up MemoryRegionPortio
        sb16: remove useless mixer_write_indexw
        sun4m: fix slavio sysctrl and led register sizes
        acpi-build: remove dependency from ram_addr.h
        memory: add memory_region_ram_resize
        dma-helpers: Fix race condition of continue_after_map_failure and dma_aio_cancel
        exec: Notify cpu_register_map_client caller if the bounce buffer is available
        exec: Protect map_client_list with mutex
        linux-user, bsd-user: Remove two calls to cpu_exec_init_all
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1fe58f6ad2282399da256b8579b49b43527e486
  Merge: 52b7aba c836867
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 10:10:31 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Wed Apr 29 00:03:44 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        qtest: Add assertion that required environment variable is set
        qtest/ahci: add flush retry test
        libqos: add blkdebug_prepare_script
        libqtest: add qmp_async
        libqtest: add qmp_eventwait
        qtest/ahci: Allow override of default CLI options
        qtest/ahci: Add simple flush test
        qtest/ahci: test different disk sectors
        qtest/ahci: add qcow2 support to ahci-test
        fdc: remove sparc sun4m mutations

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d064d9f381b00538e41f14104b88a1ae85d78865
  Author: Bogdan Purcareata <bogdan.purcareata@freescale.com>
  Date:   Fri Apr 3 11:01:54 2015 +0000

      nbd/trivial: fix type cast for ioctl

      This fixes ioctl behavior on powerpc e6500 platforms with 64bit kernel and 32bit
      userspace. The current type cast has no effect there and the value passed to the
      kernel is still 0. Probably an issue related to the compiler, since I'm assuming
      the same configuration works on a similar setup on x86.

      Also ensure consistency with previous type cast in TRACE message.

      Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
      Message-Id: <1428058914-32050-1-git-send-email-bogdan.purcareata@freescale.com>
      Cc: qemu-stable@nongnu.org
      [Fix parens as noticed by Michael. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 510a647fa27a12b66be40da4c2c098430003225c
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Wed Apr 22 17:50:52 2015 -0400

      translate-all: use bitmap helpers for PageDesc's bitmap

      Here we have an open-coded byte-based bitmap implementation.
      Get rid of it since there's a ulong-based implementation to be
      used by all code.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b8eb5512fd8a115f164edbbe897cdf8884920ccb
  Author: Nadav Amit <namit@cs.technion.ac.il>
  Date:   Mon Apr 13 02:32:08 2015 +0300

      target-i386: disable LINT0 after reset

      Due to old Seabios bug, QEMU reenable LINT0 after reset. This bug is long gone
      and therefore this hack is no longer needed.  Since it violates the
      specifications, it is removed.

      Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
      Message-Id: <1428881529-29459-2-git-send-email-namit@cs.technion.ac.il>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7398dfc7799a50097803db4796c7edb6cd7d47a1
  Author: Wei Liu <wei.liu2@citrix.com>
  Date:   Mon Mar 9 14:54:33 2015 +0000

      Makefile.target: prepend $libs_softmmu to $LIBS

      I discovered a problem when trying to build QEMU statically with gcc.
      libm is an element of LIBS while libpixman-1 is an element in
      libs_softmmu. Libpixman references functions in libm, so the original
      ordering makes linking fail.

      This fix is to reorder $libs_softmmu and $LIBS to make -lm appear after
      -lpixman-1. However I'm not quite sure if this is the right fix, hence
      the RFC tag.

      Normally QEMU is built with c++ compiler which happens to link in libm
      (at least this is the case with g++), so building QEMU statically
      normally just works and nobody notices this issue.

      Signed-off-by: Wei Liu <wei.liu2@citrix.com>
      Message-Id: <1425912873-21215-1-git-send-email-wei.liu2@citrix.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 738e4171de478da2516180c7a139f1b762443618
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 10 11:17:48 2015 +0100

      milkymist: do not modify libs-softmmu

      This is better and prepares for the next patch.  When we copy
      libs_softmmu's value into LIBS with a := assignment, we cannot
      anymore modify libs_softmmu in the Makefiles.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2847b46958ab0bd604e1b3fcafba0f5ba4375833
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Mar 26 11:03:12 2015 +0800

      configure: Add support for tcmalloc

      This adds "--enable-tcmalloc" and "--disable-tcmalloc" to allow linking
      to libtcmalloc from gperftools.

      tcmalloc is a malloc implementation that works well with threads and is
      fast, so it is good for performance.

      It is disabled by default, because the MALLOC_PERTURB_ flag we use in
      tests doesn't work with tcmalloc. However we can enable tcmalloc
      specific heap checker and profilers later.

      An IOPS gain can be observed with virtio-blk-dataplane, other parts of
      QEMU will directly benefit from it as well:

      ==========================================================
                             glibc malloc
      ----------------------------------------------------------
      rw         bs         iodepth    bw     iops       latency
      read       4k         1          150    38511      24
      ----------------------------------------------------------

      ==========================================================
                               tcmalloc
      ----------------------------------------------------------
      rw         bs         iodepth    bw     iops       latency
      read       4k         1          156    39969      23
      ----------------------------------------------------------

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1427338992-27057-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c8368674980b299604e3cfe9215c4105acefa516
  Author: Ed Maste <emaste@freebsd.org>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest: Add assertion that required environment variable is set

      Signed-off-by: Ed Maste <emaste@freebsd.org>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1427911244-22565-1-git-send-email-emaste@freebsd.org
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit cf5aa89e9d32ae39bd9df27c9b2aec03c0d240b2
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: add flush retry test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-7-git-send-email-jsnow@redhat.com

  commit 72c85e949fd162b039614d588d94393ff3e2dae3
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqos: add blkdebug_prepare_script

      Pull this helper out of ide-test and into libqos,
      to be shared with ahci-test.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-6-git-send-email-jsnow@redhat.com

  commit ba4ed39346c1bdbfefd1d781b39009f90822b956
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqtest: add qmp_async

      Add qmp_async, which lets us send QMP commands asynchronously.
      This is useful when we want to send commands that will trigger
      event responses, but we don't know in what order to expect them.

      Sometimes the event responses may arrive even before the command
      confirmation will show up, so it is convenient to leave the responses
      in the stream.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-5-git-send-email-jsnow@redhat.com

  commit 8fe941f749b2db3735abade1c298552de4eab496
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqtest: add qmp_eventwait

      Allow the user to poll until a desired interrupt occurs.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-4-git-send-email-jsnow@redhat.com

  commit debaaa114a8877a939533ba846e64168fb287b7b
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: Allow override of default CLI options

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-3-git-send-email-jsnow@redhat.com

  commit 4e217074ca3f704d9a1c3bd1ebb03eb7621ab882
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: Add simple flush test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-2-git-send-email-jsnow@redhat.com

  commit 727be1a7550b5caad0b94098a41de8033ad43f85
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: test different disk sectors

      Test sector offset 0, 1, and the last sector(s)
      in LBA28 and LBA48 modes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426274523-22661-3-git-send-email-jsnow@redhat.com

  commit 122fdf2d8822699482723e6f50f34c9c3933360b
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: add qcow2 support to ahci-test

      This will enable the testing of high offsets without
      wasting a lot of disk space, and does not impact the
      previous tests.

      mkimg and mkqcow2 are added to libqos for other tests.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426274523-22661-2-git-send-email-jsnow@redhat.com

  commit 24a5c62cfe3cbe3fb4722f79661b9900a2579316
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      fdc: remove sparc sun4m mutations

      They were introduced in 6f7e9aec5eb5bdfa57a9e458e391b785c283a007 and
      82407d1a4035e5bfefb53ffdcb270872f813b34c and lots of bug fixes were done after that.

      This fixes (at least) the detection of the floppy controller on Debian 4.0r9/SPARC,
      and SS-5's OBP initialization routine still works.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Message-id: 1426351846-6497-1-git-send-email-hpoussin@reactos.org
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 52b7aba62f02cf90f57ee7e02f67d2d8445e7e40
  Merge: a9392bc 5655f93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 18:58:15 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150428.0' into staging

      VFIO updates
       - Correction to BAR overflow
       - Fix error sign
       - Reset workaround for AMD Bonaire & Hawaii GPUs

      # gpg: Signature made Tue Apr 28 18:26:43 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150428.0:
        vfio-pci: Reset workaround for AMD Bonaire and Hawaii GPUs
        vfio-pci: Fix error path sign
        vfio-pci: Further fix BAR size overflow

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5655f931abcfa5f100d12d021eaed606c2d4ef52
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Reset workaround for AMD Bonaire and Hawaii GPUs

      Somehow these GPUs manage not to respond to a PCI bus reset, removing
      our primary mechanism for resetting graphics cards.  The result is
      that these devices typically work well for a single VM boot.  If the
      VM is rebooted or restarted, the guest driver is not able to init the
      card from the dirty state, resulting in a blue screen for Windows
      guests.

      The workaround is to use a device specific reset.  This is not 100%
      reliable though since it depends on the incoming state of the device,
      but it substantially improves the usability of these devices in a VM.

      Credit to Alex Deucher <alexander.deucher@amd.com> for his guidance.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit c6d231e2fd3773ef9a566ca24962f2314cb78f73
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Fix error path sign

      This is an impossible error path due to the fact that we're reading a
      kernel provided, rather than user provided link, which will certainly
      always fit in PATH_MAX.  Currently it returns a fixed 26 char path
      plus %d group number, which typically maxes out at double digits.
      However, the caller of the initfn certainly expects a less-than zero
      return value on error, not just a non-zero value.  Therefore we
      should correct the sign here.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 07ceaf98800519ef9c5dc893af00f1fe1f9144e4
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Further fix BAR size overflow

      In an analysis by Laszlo, the resulting type of our calculation for
      the end of the MSI-X table, and thus the start of memory after the
      table, is uint32_t.  We're therefore not correctly preventing the
      corner case overflow that we intended to fix here where a BAR >=4G
      could place the MSI-X table to end exactly at the 4G boundary.  The
      MSI-X table offset is defined by the hardware spec to 32bits, so we
      simply use a cast rather than changing data structure types.  This
      scenario is purely theoretically, typically the MSI-X table is located
      at the front of the BAR.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit a9392bc93c8615ad1983047e9f91ee3fa8aae75f
  Merge: 84cbd63 61007b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 16:55:03 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches

      # gpg: Signature made Tue Apr 28 15:35:05 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (76 commits)
        block: move I/O request processing to block/io.c
        block: extract bdrv_setup_io_funcs()
        block: add bdrv_set_dirty()/bdrv_reset_dirty() to block_int.h
        block: replace bdrv_states iteration with bdrv_next()
        vmdk: Widen before shifting 32 bit header field
        block/dmg: make it modular
        block/mirror: Always call block_job_sleep_ns()
        iotests: add incremental backup granularity tests
        iotests: add incremental backup failure recovery test
        iotests: add simple incremental backup case
        iotests: add QMP event waiting queue
        iotests: add invalid input incremental backup tests
        hbitmap: truncate tests
        block: Resize bitmaps on bdrv_truncate
        block: Ensure consistent bitmap function prototypes
        block: add BdrvDirtyBitmap documentation
        qmp: Add dirty bitmap status field in query-block
        qmp: add block-dirty-bitmap-clear
        qmp: Add support of "dirty-bitmap" sync mode for drive-backup
        block: Add bitmap successors
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da2f84d1270d203027d82f778d5bcc1f7a49bab0
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue Apr 28 19:51:13 2015 +0800

      virtio-scsi: Move DEFINE_VIRTIO_SCSI_FEATURES to virtio-scsi

      So far virtio-scsi-device can't expose host features to guest while
      using virtio-mmio because it doesn't set DEFINE_VIRTIO_SCSI_FEATURES on
      backend or transport.

      The host features belong to the backends while virtio-scsi-pci,
      virtio-scsi-s390 and virtio-scsi-ccw set the DEFINE_VIRTIO_SCSI_FEATURES
      on transports. But they already have the ability to forward property
      accesses to the backend child. So if we move the host features to
      backends, it doesn't break the backwards compatibility for them and
      make host features work while using virtio-mmio.

      Move DEFINE_VIRTIO_SCSI_FEATURES to the backend virtio-scsi. The
      transports just sync the host features from backends.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit da3e8a23492dbc13c4b70d90b6ae42970624e63a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue Apr 28 19:51:12 2015 +0800

      virtio-net: Move DEFINE_VIRTIO_NET_FEATURES to virtio-net

      So far virtio-net-device can't expose host features to guest while
      using virtio-mmio because it doesn't set DEFINE_VIRTIO_NET_FEATURES on
      backend or transport. So the performance is low.

      The host features belong to the backend while virtio-net-pci,
      virtio-net-s390 and virtio-net-ccw set the DEFINE_VIRTIO_NET_FEATURES
      on transports. But they already have the ability to forward property
      accesses to the backend child. So if we move the host features to
      backends, it doesn't break the backwards compatibility for them and
      make host features work while using virtio-mmio.

      Here we move DEFINE_VIRTIO_NET_FEATURES to the backend virtio-net. The
      transports just sync the host features from backend. Meanwhile move
      virtio_net_set_config_size to virtio-net to make sure the config size
      is correct and don't expose it.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51f7cb974ba1af9f68302f2bae4bf0161fb0ab03
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Tue Apr 28 12:50:07 2015 +0200

      pci: Merge pci_nic_init() into pci_nic_init_nofail()

      The error reporting in pci_nic_init() is quite erratic: Some errors
      are printed directly with error_report(), and some are passed back
      to the caller pci_nic_init_nofail() via an Error pointer.
      Since pci_nic_init() is only used by pci_nic_init_nofail(), the
      functions can be simply merged to clean up this inconsistency.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 61007b316cd71ee7333ff7a0a749a8949527575f
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:52 2015 +0100

      block: move I/O request processing to block/io.c

      The block.c file has grown to over 6000 lines.  It is time to split this
      file so there are fewer conflicts and the code is easier to maintain.

      Extract I/O request processing code:
       * Read
       * Write
       * Zero writes and making the image empty
       * Flush
       * Discard
       * ioctl
       * Tracked requests and queuing
       * Throttling and copy-on-read
       * Block status and allocated functions
       * Refreshing block limits
       * Reading/writing vmstate
       * qemu_blockalign() and friends

      The patch simply moves code from block.c into block/io.c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0eb7217e49b84553bb30f97bc34380633fd846fe
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:51 2015 +0100

      block: extract bdrv_setup_io_funcs()

      Move the code to install coroutine and aio emulation function pointers
      in a BlockDriver to its own function.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e0c47b6cb1de430fbc6f828f7acffa851c580840
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:50 2015 +0100

      block: add bdrv_set_dirty()/bdrv_reset_dirty() to block_int.h

      The dirty bitmap functions are called from the block I/O processing
      code.  Make them visible to block_int.h users so they can be used
      outside block.c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4f5472cb2d3d37ec3282cc3829612f9d696c2df7
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:49 2015 +0100

      block: replace bdrv_states iteration with bdrv_next()

      The bdrv_states list is a static variable in block.c.

      bdrv_drain_all() and bdrv_flush_all() use this variable to iterate over
      all drives.

      The next patch will move bdrv_drain_all() and bdrv_flush_all() out of
      block.c so it's necessary to switch to the public bdrv_next() interface.

      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7237aecd7e8fcc3ccf7fded77b6c127b4df5d3ac
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Apr 27 22:23:01 2015 +0800

      vmdk: Widen before shifting 32 bit header field

      Coverity spotted this.

      The field is 32 bits, but if it's possible to overflow in 32 bit
      left shift.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5505e8b76f86f925c35ecc2b2d311886bb36534c
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 14:51:56 2015 +0300

      block/dmg: make it modular

      dmg can optionally utilize libbz2, make it modular

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 001c95b740b2ed3d8b486952f68b5f06e609f1f2
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Apr 27 13:07:31 2015 +0200

      block/mirror: Always call block_job_sleep_ns()

      The mirror block job is trying to take a clever shortcut if delay_ns is
      0 and skips block_job_sleep_ns() in that case. But that function must be
      called in every block job iteration, because otherwise it is for example
      impossible to pause the job.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59fc5d844fe192494308d0f07507b712ec395129
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:09 2015 -0400

      iotests: add incremental backup granularity tests

      Test what happens if you fiddle with the granularity.

      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-22-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 24618f5381da650bd50c78feea07b35cf82e7d6c
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:08 2015 -0400

      iotests: add incremental backup failure recovery test

      Test the failure case for incremental backups.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-21-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a3d715958c4456afea402e891288864fe4e51547
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:07 2015 -0400

      iotests: add simple incremental backup case

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-20-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7898f74e78a5900fc079868e255b65d807fa8a8f
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:06 2015 -0400

      iotests: add QMP event waiting queue

      A filter is added to allow callers to request very specific
      events to be pulled from the event queue, while leaving undesired
      events still in the stream.

      This allows us to poll for completion data for multiple asynchronous
      events in any arbitrary order.

      A new timeout context is added to the qmp pull_event method's
      wait parameter to allow tests to fail if they do not complete
      within some expected period of time.

      Also fixed is a bug in qmp.pull_event where we try to retrieve an event
      from an empty list if we attempt to retrieve an event with wait=False
      but no events have occurred.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-19-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9f7264f57c8307bca32e78427348b8b323d5db21
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:05 2015 -0400

      iotests: add invalid input incremental backup tests

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a94e87c08cfff73ac4b179adc3d0d9c3b8d2ddef
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:04 2015 -0400

      hbitmap: truncate tests

      The general approach is to set bits close to the boundaries of
      where we are truncating and ensure that everything appears to
      have gone OK.

      We test growing and shrinking by different amounts:
      - Less than the granularity
      - Less than the granularity, but across a boundary
      - Less than sizeof(unsigned long)
      - Less than sizeof(unsigned long), but across a ulong boundary
      - More than sizeof(unsigned long)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ce1ffea8cdcea41533bde87759b8390f0e3a9ad3
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:03 2015 -0400

      block: Resize bitmaps on bdrv_truncate

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20dca81075e712ebcbc151eed9b1a02d4e5d08f5
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:02 2015 -0400

      block: Ensure consistent bitmap function prototypes

      We often don't need the BlockDriverState for functions
      that operate on bitmaps. Remove it.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aa0c7ca506bb3f661be673b3d5c1320f37e52fdb
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:01 2015 -0400

      block: add BdrvDirtyBitmap documentation

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a113534ffb8f2580d323e6397e6908d5f4bfa0b7
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:00 2015 -0400

      qmp: Add dirty bitmap status field in query-block

      Add the "frozen" status booleans, to inform clients
      when a bitmap is occupied doing a task.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e74e6b78e6fe0c9ee426d1278fff45f5fa0af766
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:59 2015 -0400

      qmp: add block-dirty-bitmap-clear

      Add bdrv_clear_dirty_bitmap and a matching QMP command,
      qmp_block_dirty_bitmap_clear that enables a user to reset
      the bitmap attached to a drive.

      This allows us to reset a bitmap in the event of a full
      drive backup.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d58d84539784d27c826924a79d9436178b07ff69
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:58 2015 -0400

      qmp: Add support of "dirty-bitmap" sync mode for drive-backup

      For "dirty-bitmap" sync mode, the block job will iterate through the
      given dirty bitmap to decide if a sector needs backup (backup all the
      dirty clusters and skip clean ones), just as allocation conditions of
      "top" sync mode.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9bd2b08f27b9c27bb40d73b6466321b8c635086e
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:57 2015 -0400

      block: Add bitmap successors

      A bitmap successor is an anonymous BdrvDirtyBitmap that is intended to
      be created just prior to a sensitive operation (e.g. Incremental Backup)
      that can either succeed or fail, but during the course of which we still
      want a bitmap tracking writes.

      On creating a successor, we "freeze" the parent bitmap which prevents
      its deletion, enabling, anonymization, or creating a bitmap with the
      same name.

      On success, the parent bitmap can "abdicate" responsibility to the
      successor, which will inherit its name. The successor will have been
      tracking writes during the course of the backup operation. The parent
      will be safely deleted.

      On failure, we can "reclaim" the successor from the parent, unifying
      them such that the resulting bitmap describes all writes occurring since
      the last successful backup, for instance. Reclamation will thaw the
      parent, but not explicitly re-enable it.

      BdrvDirtyBitmap operations that target a single bitmap are protected
      by assertions that the bitmap is not frozen and/or disabled.

      BdrvDirtyBitmap operations that target a group of bitmaps, such as
      bdrv_{set,reset}_dirty will ignore frozen/disabled drives with a
      conditional instead.

      Internal functions that enable/disable dirty bitmaps have assertions
      added to them to prevent modifying frozen bitmaps.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8e6fb752e43b45b428487c244cab35f0ab94b10
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:56 2015 -0400

      block: Add bitmap disabled status

      Add a status indicating the enabled/disabled state of the bitmap.
      A bitmap is by default enabled, but you can lock the bitmap into
      a read-only state by setting disabled = true.

      A previous version of this patch added a QMP interface for changing
      the state of the bitmap, but it has since been removed for now until
      a use case emerges where this state must be revealed to the user.

      The disabled state WILL be used internally for bitmap migration and
      bitmap persistence.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit be58721dbf882fa8830f3669f499b0a5b501e90f
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:55 2015 -0400

      hbitmap: add hbitmap_merge

      We add a bitmap merge operation to assist in error cases
      where we wish to combine two bitmaps together.

      This is algorithmically O(bits) provided HBITMAP_LEVELS remains
      constant. For a full bitmap on a 64bit machine:
      sum(bits/64^k, k, 0, HBITMAP_LEVELS) ~= 1.01587 * bits

      We may be able to improve running speed for particularly sparse
      bitmaps by using iterators, but the running time for dense maps
      will be worse.

      We present the simpler solution first, and we can refine it later
      if needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8515efbef1759b9143f06e9722c8f4e145032181
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:54 2015 -0400

      hbitmap: cache array lengths

      As a convenience: between incremental backups, bitmap migrations
      and bitmap persistence we seem to need to recalculate these a lot.

      Because the lengths are a little bit-twiddly, let's just solidly
      cache them and be done with it.

      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 592fdd02ae987a439a2ba25a2a973673f1484805
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:53 2015 -0400

      block: Introduce bdrv_dirty_bitmap_granularity()

      This returns the granularity (in bytes) of dirty bitmap,
      which matches the QMP interface and the existing query
      interface.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 341ebc2f81b14862347e4d4c1fcb3759f815237a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:52 2015 -0400

      qmp: Add block-dirty-bitmap-add and block-dirty-bitmap-remove

      The new command pair is added to manage a user created dirty bitmap. The
      dirty bitmap's name is mandatory and must be unique for the same device,
      but different devices can have bitmaps with the same names.

      The granularity is an optional field. If it is not specified, we will
      choose a default granularity based on the cluster size if available,
      clamped to between 4K and 64K to mirror how the 'mirror' code was
      already choosing granularity. If we do not have cluster size info
      available, we choose 64K. This code has been factored out into a helper
      shared with block/mirror.

      This patch also introduces the 'block_dirty_bitmap_lookup' helper,
      which takes a device name and a dirty bitmap name and validates the
      lookup, returning NULL and setting errp if there is a problem with
      either field. This helper will be re-used in future patches in this
      series.

      The types added to block-core.json will be re-used in future patches
      in this series, see:
      'qapi: Add transaction support to block-dirty-bitmap-{add, enable, disable}'

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5fba6c0e50b66691568b34d5a2f4be0b39f5e20a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:51 2015 -0400

      qmp: Ensure consistent granularity type

      We treat this field with a variety of different types everywhere
      in the code. Now it's just uint32_t.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0db6e54a8a2c6e16780356422da671b71f862341
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 17 19:49:50 2015 -0400

      qapi: Add optional field "name" to block dirty bitmap

      This field will be set for user created dirty bitmap. Also pass in an
      error pointer to bdrv_create_dirty_bitmap, so when a name is already
      taken on this BDS, it can report an error message. This is not global
      check, two BDSes can have dirty bitmap with a common name.

      Implemented bdrv_find_dirty_bitmap to find a dirty bitmap by name, will
      be used later when other QMP commands want to reference dirty bitmap by
      name.

      Add bdrv_dirty_bitmap_make_anon. This unsets the name of dirty bitmap.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit efcfa278dca27f1c9db8b8283eac54f5e19074e7
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:49 2015 -0400

      docs: incremental backup documentation

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9eac3622a2b1159ab50b10540e822f3e58fdc383
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:33 2015 +0200

      block/iscsi: use the allocationmap also if cache.direct=on

      the allocationmap has only a hint character. The driver always
      double checks that blocks marked unallocated in the cache are
      still unallocated before taking the fast path and return zeroes.
      So using the allocationmap is migration safe and can
      also be enabled with cache.direct=on.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-10-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 03e40fef4678f9a42846c91a804b6d3c820e8b90
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:32 2015 +0200

      block/iscsi: bump year in copyright notice

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-9-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e380aff831c24b37c023010852e7ddd2ae1ec385
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:31 2015 +0200

      block/iscsi: handle SCSI_STATUS_TASK_SET_FULL

      a target may issue a SCSI_STATUS_TASK_SET_FULL status
      if there is more than one "BUSY" command queued already.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-8-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59dd0a22ca4c3ac70c37263208b9e49cfeacf2e4
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:30 2015 +0200

      block/iscsi: increase retry count

      The idea is that a command is retried in a BUSY condition
      up a time of approx. 60 seconds before it is failed. This should
      be far higher than any command timeout in the guest.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-7-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73b5394e2e4af3bbe01e221fa395373facc67f78
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:29 2015 +0200

      block/iscsi: optimize WRITE10/16 if cache.writeback is not set

      SCSI allowes to tell the target to not return from a write command
      if the date is not written to the disk. Use this so called FUA
      bit if it is supported to optimize WRITE commands if writeback is
      not allowed.

      In this case qemu always issues a WRITE followed by a FLUSH. This
      is 2 round trip times. If we set the FUA bit we can ignore the
      following FLUSH.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-6-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 752ce45150d3d70aabc4eb46a7a9cdfd8b4640fd
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:28 2015 +0200

      block/iscsi: store DPOFUA bit from the modesense command

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-5-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7191f2080c70228c6483b6604cc1c18943d8d766
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:27 2015 +0200

      block/iscsi: rename iscsi_write_protected and let it return void

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-4-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a386e48527d16e5dedbc1ff62aa0042a1cbdac5
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:26 2015 +0200

      block/iscsi: change all iscsilun properties from uint8_t to bool

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-3-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20474e9aa040b9a255c63127f1eb873c29c54f68
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:25 2015 +0200

      block/iscsi: do not forget to logout from target

      We actually were always impolitely dropping the connection and
      not cleanly logging out.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-2-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d5a8ee60a0fbc20a2c2d02f3bda1bb1bd365f1ee
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Apr 17 14:52:43 2015 +0300

      qmp: fill in the image field in BlockDeviceInfo

      The image field in BlockDeviceInfo is supposed to contain an ImageInfo
      object. However that is being filled in by bdrv_query_info(), not by
      bdrv_block_device_info(), which is where BlockDeviceInfo is actually
      created.

      Anyone calling bdrv_block_device_info() directly will get a null image
      field. As a consequence of this, the HMP command 'info block -n -v'
      crashes QEMU.

      This patch moves the code that fills in that field from
      bdrv_query_info() to bdrv_block_device_info().

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1429271563-3765-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9419874f709469de16c1bced7731bfecb07fe1cf
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 22 11:15:10 2015 +0100

      Revert "hmp: fix crash in 'info block -n -v'"

      This reverts commit 638b8366200130cc7cf7a026630bc6bfb63b0c4c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit dc881b441d74b8fc6c9c007cd03d5d05bca388dd
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:20 2015 +0300

      block: add 'node-name' field to BLOCK_IMAGE_CORRUPTED

      Since this event can occur in nodes that cannot have a device name
      associated, include also a field with the node name.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 147cec5b3594f4bec0cb41c98afe5fcbfb67567c.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 81e5f78a9f4f13548ec1edddaf780d339f18e2d2
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:19 2015 +0300

      block: use bdrv_get_device_or_node_name() in error messages

      There are several error messages that identify a BlockDriverState by
      its device name. However those errors can be produced in nodes that
      don't have a device name associated.

      In those cases we should use bdrv_get_device_or_node_name() to fall
      back to the node name and produce a more meaningful message. The
      messages are also updated to use the more generic term 'node' instead
      of 'device'.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 9823a1f0514fdb0692e92868661c38a9e00a12d6.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9b2aa84f87f5b95cb0295dcae38fbfbf115df2be
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:18 2015 +0300

      block: add bdrv_get_device_or_node_name()

      This function gets the device name associated with a BlockDriverState,
      or its node name if the device name is empty.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 4fa30aa8d61d9052ce266fd5429a59a14e941255.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ec683d604069dcdaaa516789274bc0cdc14e5247
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 15 11:43:42 2015 +0100

      block: document block-stream in qmp-commands.hx

      The 'block-stream' QMP command is documented in block-core.json but not
      qmp-commands.hx.  Add a summary of the command to qmp-commands.hx
      (similar to the documentation for 'block-commit').

      Reported-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1429094622-26218-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c485cf9c9277ca9b3d5227c99a13c374e812f42b
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 15 10:43:44 2015 +0100

      m25p80: fix s->blk usage before assignment

      Delay the call to blk_blockalign() until s->blk has been assigned.

      This never caused a crash because blk_blockalign(NULL, size) defaults to
      4096 alignment but it's technically incorrect.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1429091024-25098-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d07063e46047242c4f010ff9ddbff5e02f15d9e7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Apr 14 17:29:47 2015 +0200

      m25p80: add missing blk_attach_dev_nofail

      Of the block devices that poked into -drive options via drive_get_next,
      m25p80 was the only one who also did not attach itself to the BlockBackend.

      Since sd does it, and all other devices go through a "drive" property,
      with this change all block backends attached to the guest will have a
      non-NULL result for blk_get_attached_dev().

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1429025387-11077-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4eb867e98c1815d9d7a2a9380182005df12064a7
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Apr 12 17:55:17 2015 +0200

      virtio_blk: comment fix

      update virtio blk header from latest linux, include comment fixups.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1428854036-12806-1-git-send-email-mst@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b5a24454fc551f0294fe93821e8c643214a55f5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Mar 28 07:37:18 2015 +0100

      block: avoid unnecessary bottom halves

      bdrv_aio_* APIs can use coroutines to achieve asynchronicity.  However,
      the coroutine may terminate without having yielded back to the caller
      (for example because of something that invokes a nested event loop,
      or because the coroutine is doing nothing at all).  In this case,
      the bdrv_aio_* API must delay the completion to the next iteration
      of the main loop, because bdrv_aio_* will never invoke the callback
      before returning.

      This can be done with a bottom half, and indeed bdrv_aio_* is always
      using one for simplicity.  It is possible to gain some performance
      (~3%) by avoiding this in the common case.  A new field in the
      BlockAIOCBCoroutine struct is set to true until the first time the
      corotine has yielded to its creator, and completion goes through a
      new function bdrv_co_complete.  If the flag is false, bdrv_co_complete
      invokes the callback immediately.  If it is true, the caller will
      notice that the coroutine has completed and schedule the bottom
      half itself.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427524638-28157-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a7282330c01364ef00260749bc6a37c7f16ec047
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:21 2015 +0800

      blockjob: Update function name in comments

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e62303a437af72141c8d04c36799521a56d6f4f6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:20 2015 +0800

      qemu-iotests: Test that "stop" doesn't drain block jobs

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 69da3b0b47c8f6016e9109fcfa608e9e7e99bc05
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:19 2015 +0800

      block: Pause block jobs in bdrv_drain_all

      This is necessary to suppress more IO requests from being generated from
      block job coroutines.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 751ebd76e654bd1e65da08ecf694325282b4cfcc
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:18 2015 +0800

      blockjob: Allow nested pause

      This patch changes block_job_pause to increase the pause counter and
      block_job_resume to decrease it.

      The counter will allow calling block_job_pause/block_job_resume
      unconditionally on a job when we need to suspend the IO temporarily.

      From now on, each block_job_resume must be paired with a block_job_pause
      to keep the counter balanced.

      The user pause from QMP or HMP will only trigger block_job_pause once
      until it's resumed, this is achieved by adding a user_paused flag in
      BlockJob.

      One occurrence of block_job_resume in mirror_complete is replaced with
      block_job_enter which does what is necessary.

      In block_job_cancel, the cancel flag is good enough to instruct
      coroutines to quit loop, so use block_job_enter to replace the unpaired
      block_job_resume.

      Upon block job IO error, user is notified about the entering to the
      pause state, so this pause belongs to user pause, set the flag
      accordingly and expect a matching QMP resume.

      [Extended doc comments as suggested by Paolo Bonzini
      <pbonzini@redhat.com>.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 199667a8c843d268f0fe80f09041b8c7193f1ba5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:40 2015 +0800

      MAINTAINERS: Add Fam Zheng as Null block driver maintainer

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1c2b49a17282f3abd9ccf71b65d0be62d3b3192e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:39 2015 +0800

      block/null: Support reopen

      Reopen is used in block-commit. With this always-succeed operation, it
      is now possible to test committing to a null drive, by specifying
      "null-aio://" or "null-co://" as the backing image when creating the
      qcow2 image.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e5e51dd3af6a0872dedce290ee41437b5aeed109
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:38 2015 +0800

      block/null: Latency simulation by adding new option "latency-ns"

      Aio context switch should just work because the requests will be
      drained, so the scheduled timer(s) on the old context will be freed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9eddd6a4b3b187ba50038800b6e4aeda4973b365
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 26 22:42:34 2015 +0000

      scripts: add 'qemu coroutine' command to qemu-gdb.py

      The 'qemu coroutine <coroutine-address>' GDB command prints the
      backtrace for a CoroutineUContext.  This is useful for peeking inside
      yielded coroutines that are waiting for file descriptor events, timers,
      etc.

      For example:

        $ gdb tests/test-coroutine
        (gdb) b test_yield
        (gdb) r
        (gdb) b qemu_coroutine_enter
        (gdb) c
        (gdb) c
        Continuing.

        Breakpoint 2, qemu_coroutine_enter (co=0x555555c66520, opaque=0x0) at qemu-coroutine.c:103
        103	{
        (gdb) source scripts/qemu-gdb.py
        (gdb) qemu coroutine 0x555555c66520
        #0  0x000055555557a740 in qemu_coroutine_switch (from_=<optimized out>, to_=0x7ffff7f90a70, action=COROUTINE_YIELD) at coroutine-ucontext.c:177
        #1  0x0000555555566af9 in yield_5_times (opaque=0x7fffffffdbb7) at tests/test-coroutine.c:107
        #2  0x000055555557a7aa in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at coroutine-ucontext.c:80
        #3  0x00007ffff08de000 in __start_context () at /lib64/libc.so.6

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427409754-8556-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1faa5bb73247339bf3d797433a9ade990ef0fb32
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Apr 2 17:39:22 2015 +0100

      thread-pool: clean up thread_pool_completion_bh()

      This patch simplifies thread_pool_completion_bh().

      The function first checks elem->state:

        if (elem->state != THREAD_DONE) {
            continue;
        }

      It then goes on to check elem->state == THREAD_DONE although we already
      know this must be the case.

      The QLIST_REMOVE() is duplicated down both branches of an if-else
      statement so that can be lifted out as well.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1427992762-10126-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d1a126c53ddc563b7b731cee013e0362f7a5f22f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 14 16:36:16 2015 +0200

      vhdx: Fix zero-fill iov length

      Fix the length of the zero-fill for the back, which was accidentally
      using the same value as for the front. This is caught by qemu-iotests
      033.

      For consistency, change the code for the front as well to use the length
      stored in the iov (it is the same value, copied four lines above).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Acked-by: Jeff Cody <jcody@redhat.com>

  commit 8eedfbd4a50299f03b3630659c34ad1b01f69370
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 14 16:32:45 2015 +0200

      blkdebug: Add bdrv_truncate()

      This is, amongst others, required for qemu-iotests 033 to run as
      intended on VHDX, which uses explicit bdrv_truncate() calls to bs->file
      when allocating new blocks.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>

  commit e4f587492331df0ac50bad6131ea273d527af796
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:33 2015 +0100

      qemu-iotests: Some qemu-img convert tests

      This adds a regression test for some problems that the qemu-img convert
      rewrite just fixed.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 690c7301600162421b928c7f26fd488fd8fa464e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:32 2015 +0100

      qemu-img convert: Rewrite copying logic

      The implementation of qemu-img convert is (a) messy, (b) buggy, and
      (c) less efficient than possible. The changes required to beat some
      sense into it are massive enough that incremental changes would only
      make my and the reviewers' life harder. So throw it away and reimplement
      it from scratch.

      Let me give some examples what I mean by messy, buggy and inefficient:

      (a) The copying logic of qemu-img convert has two separate branches for
          compressed and normal target images, which roughly do the same -
          except for a little code that handles actual differences between
          compressed and uncompressed images, and much more code that
          implements just a different set of optimisations and bugs. This is
          unnecessary code duplication, and makes the code for compressed
          output (unsurprisingly) suffer from bitrot.

          The code for uncompressed ouput is run twice to count the the total
          length for the progress bar. In the first run it just takes a
          shortcut and runs only half the loop, and when it's done, it toggles
          a boolean, jumps out of the loop with a backwards goto and starts
          over. Works, but pretty is something different.

      (b) Converting while keeping a backing file (-B option) is broken in
          several ways. This includes not writing to the image file if the
          input has zero clusters or data filled with zeros (ignoring that the
          backing file will be visible instead).

          It also doesn't correctly limit every iteration of the copy loop to
          sectors of the same status so that too many sectors may be copied to
          in the target image. For -B this gives an unexpected result, for
          other images it just does more work than necessary.

          Conversion with a compressed target completely ignores any target
          backing file.

      (c) qemu-img convert skips reading and writing an area if it knows from
          metadata that copying isn't needed (except for the bug mentioned
          above that ignores a status change in some cases). It does, however,
          read from the source even if it knows that it will read zeros, and
          then search for non-zero bytes in the read buffer, if it's possible
          that a write might be needed.

      This reimplementation of the copying core reorganises the code to remove
      the duplication and have a much more obvious code flow, by essentially
      splitting the copy iteration loop into three parts:

      1. Find the number of contiguous sectors of the same status at the
         current offset (This can also be called in a separate loop before the
         copying loop in order to determine the total sectors for the progress
         bar.)

      2. Read sectors. If the status implies that there is no data there to
         read (zero or unallocated cluster), don't do anything.

      3. Write sectors depending on the status. If it's data, write it. If
         we want the backing file to be visible (with -B), don't write it. If
         it's zeroed, skip it if you can, otherwise use bdrv_write_zeroes() to
         optimise the write at least where possible.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0df89e8e6f62aea32a7302e73a86b7bfe5821018
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:31 2015 +0100

      block-backend: Expose bdrv_write_zeroes()

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit a0710f7995f914e3044e5899bd8ff6c43c62f916
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:52 2015 +0100

      iothread: release iothread around aio_poll

      This is the first step towards having fine-grained critical sections in
      dataplane threads, which resolves lock ordering problems between
      address_space_* functions (which need the BQL when doing MMIO, even
      after we complete RCU-based dispatch) and the AioContext.

      Because AioContext does not use contention callbacks anymore, the
      unit test has to be changed.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 49110174f8835ec3d5ca7fc076ee1f51c18564fe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:51 2015 +0100

      AioContext: acquire/release AioContext during aio_poll

      This is the first step in pushing down acquire/release, and will let
      rfifolock drop the contention callback feature.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e98ab097092e54999f046e9efa1ca1dd52f0c9e5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:50 2015 +0100

      aio-posix: move pollfds to thread-local storage

      By using thread-local storage, aio_poll can stop using global data during
      g_poll_ns.  This will make it possible to drop callbacks from rfifolock.

      [Moved npfd = 0 assignment to end of walking_handlers region as
      suggested by Paolo.  This resolves the assert(npfd == 0) assertion
      failure in pollfds_cleanup().
      --Stefan]

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit de50a20a4cc368d241d67c600f8c0f667186a8b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Mar 25 15:27:26 2015 +0800

      block: Switch to host monotonic clock for IO throttling

      Currently, throttle timers won't make any progress when VCPU is not
      running, which would stall the request queue in utils, qtest, vm
      suspending, and live migration, without special handling.

      Block jobs are confusingly inconsistent between with and without
      throttling: if user sets a bps limit, stops the vm, then start a block
      job, the block job will not make any progress; in contrary, if user
      unsets the bps limit, or if it's not set, the block job will run
      normally.

      After this patch, with the host clock, even if the VCPUs are stopped,
      the throttle queues will be processed.

      This patch also enables potential to add throttle to bdrv_drain_all.
      Currently all requests are drained immediately. In other words whenever
      it is called, IO throttling goes ineffective (examples: system reset,
      migration and many block job operations.). This is a loophole that guest
      could exploit. If we use the host clock, we can later just trust the
      nested poll. This could be done on top.

      Note that for qemu-iotests case 093, which uses qtest, we still keep vm
      clock so the script can control the clock stepping in order to be
      deterministic.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427268446-6426-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8b6ee9aeb3f0508ed2a41381cde13bdb8707b7be
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:31 2015 +0000

      checkpatch: complain about ffs(3) calls

      The ffs(3) family of functions is not portable.  MinGW doesn't always
      provide the function.

      Use ctz32() or ctz64() instead.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-10-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f450a85899585776ccd0913d2361dd8f82666e44
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:30 2015 +0000

      os-win32: drop ffs(3) prototype

      The lack of ffs(3) in the MinGW headers is a hint that we shouldn't rely
      on it.  MinGW 4.9.2 does not make it available for linking when QEMU's
      ./configure --enable-debug is used (release builds are fine though).

      Now that all QEMU code has been switched to ctz32() there is no need for
      ffs(3).

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-9-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 41074f3d3ff0e9a3c6f638627c12ebbf6d757cea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 15:29:29 2015 +0000

      omap_intc: convert ffs(3) to ctz32() in omap_inth_sir_update()

      Rewrite the loop using level &= level - 1 to clear the least significant
      bit after each iteration.  This simplifies the loop and makes it easy to
      replace ffs(3) with ctz32().

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-8-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c9d933185181cb1cf81bc4c9e5c3a10a5934b017
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:28 2015 +0000

      sd: convert sd_normal_command() ffs(3) call to ctz32()

      ffs() cannot be replaced with ctz32() when the argument might be zero,
      because ffs(0) returns 0 while ctz32(0) returns 32.

      The ffs(3) call in sd_normal_command() is a special case though.  It can
      be converted to ctz32() + 1 because the argument is never zero:

        if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
            ~~~~~~~~~~~~~~~
                  ^--------------- req.arg cannot be zero

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-7-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd2a88840e2496e29442f333c8fdd6491e831a35
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:27 2015 +0000

      Convert ffs() != 0 callers to ctz32()

      There are a number of ffs(3) callers that do roughly:

        bit = ffs(val);
        if (bit) {
            do_something(bit - 1);
        }

      This pattern can be converted to ctz32() like this:

        zeroes = ctz32(val);
        if (zeroes != 32) {
            do_something(zeroes);
        }

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-6-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 786a4ea82ec9c87e3a895cf41081029b285a5fe5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:26 2015 +0000

      Convert (ffs(val) - 1) to ctz32(val)

      This commit was generated mechanically by coccinelle from the following
      semantic patch:

      @@
      expression val;
      @@
      - (ffs(val) - 1)
      + ctz32(val)

      The call sites have been audited to ensure the ffs(0) - 1 == -1 case
      never occurs (due to input validation, asserts, etc).  Therefore we
      don't need to worry about the fact that ctz32(0) == 32.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-5-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5863d374a32c98a7adb4c5e49d62de3cdc16d2ea
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:25 2015 +0000

      uninorth: convert ffs(3) to ctz32()

      It is not clear from the code how a 0 parameter should be handled by the
      hardware.  Keep the same behavior as ffs(0) - 1 == -1.

      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-4-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ad5f5fdca83cccd1a4c269b1fd8ba2fce8d1ba26
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:24 2015 +0000

      hw/arm/nseries: convert ffs(3) to ctz32()

      It is not clear from the code how a 0 parameter should be handled by the
      hardware.  Keep the same behavior as ffs(0) - 1 == -1.

      Cc: Andrzej Zaborowski <balrog@zabor.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 588ef9d411339012fc3c94bfad8911e9d0a517a2
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:23 2015 +0000

      bt-sdp: fix broken uuids power-of-2 calculation

      The binary search in sdp_uuid_match() only works when the number of
      elements to search is a power of two.

        lo = record->uuid;
        hi = record->uuids;
        while (hi >>= 1)
            if (lo[hi] <= val)
                lo += hi;

        return *lo == val;

      I noticed that the record->uuids calculation in
      sdp_service_record_build() was suspect:

        record->uuids = 1 << ffs(record->uuids - 1);

      Unlike most ffs(val) - 1 users, the expression is ffs(val - 1)!

      Actually ffs() is the wrong function to use for power-of-2.  Use
      pow2ceil() to achieve the correct effect.  Now the record->uuid[] array
      is sized correctly and the binary search in sdp_uuid_match() should
      work.

      I'm not sure how to run/test this code.

      Cc: Andrzej Zaborowski <balrog@zabor.org>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ecdda9e03d73d2cc1c82c00cccc02f087741b6a5
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Mar 16 18:22:05 2015 +0200

      MAINTAINERS: Add myself as the maintainer of the Quorum driver

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1426522925-14444-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 407bc15033b2a8faeb7ca42aab63b7bcede76e10
  Author: Yi Wang <up2wing@gmail.com>
  Date:   Thu Mar 12 22:54:42 2015 +0800

      savevm: create snapshot failed when id_str already exists

      The command "virsh create" will fail in such condition: vm has two
      disks: vda and vdb. vda has snapshot s1 with id "1", vdb doesn't have
      s1 but has snapshot s2 with id "1".  When we want to run command "virsh
      create s1", del_existing_snapshots() only deletes s1 in vda, and
      bdrv_snapshot_create() tries to create vdb's snapshot s1 with id "1",
      but id "1" alreay exists in vdb with name "s2"!

      The simplest way is call find_new_snapshot_id() unconditionally.

      Signed-off-by: Yi Wang <up2wing@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 84cbd63f87c1d246f51ec8eee5367a5588f367fd
  Merge: 54965ee 726a8ff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 12:22:20 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-04-27 (v2)

      # gpg: Signature made Mon Apr 27 19:42:39 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Remove AMD feature flag aliases from CPU model table
        target-i386: X86CPU::xlevel2 QOM property
        target-i386: Make "level" and "xlevel" properties static
        qemu-config: Accept empty option values
        MAINTAINERS: Change status of X86 to Maintained
        MAINTAINERS: Add myself to X86

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54965ee61dbc114e98777f456b7cd6a778fbb412
  Merge: da378d0 2f54eb9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 11:33:47 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-04-27

      # gpg: Signature made Mon Apr 27 19:02:19 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        MAINTAINERS: Add myself as NUMA code maintainer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da378d014d27fe3a243bd8e7e060e9eb8c1a272b
  Merge: 3d27b09 4eb2764
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 10:31:03 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150427' into staging

      target-arm queue:
       * memory system updates to support transaction attributes
       * set user-mode and secure attributes for accesses made by ARM CPUs
       * rename c1_coproc to cpacr_el1
       * adjust id_aa64pfr0 when has_el3 CPU property disabled
       * allow ARMv8 SCR.SMD updates

      # gpg: Signature made Mon Apr 27 16:14:30 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150427:
        Allow ARMv8 SCR.SMD updates
        target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled
        target-arm: rename c1_coproc to cpacr_el1
        target-arm: Check watchpoints against CPU security state
        target-arm: Use attribute info to handle user-only watchpoints
        target-arm: Add user-mode transaction attribute
        target-arm: Use correct memory attributes for page table walks
        target-arm: Honour NS bits in page tables
        Switch non-CPU callers from ld/st*_phys to address_space_ld/st*
        exec.c: Capture the memory attributes for a watchpoint hit
        exec.c: Add new address_space_ld*/st* functions
        exec.c: Make address_space_rw take transaction attributes
        exec.c: Convert subpage memory ops to _with_attrs
        Add MemTxAttrs to the IOTLB
        Make CPU iotlb a structure rather than a plain hwaddr
        memory: Replace io_mem_read/write with memory_region_dispatch_read/write
        memory: Define API for MemoryRegionOps to take attrs and return status

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7824df3889499acc7466317175a3fb24a0824002
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Tue Apr 21 11:26:12 2015 +0300

      acpi: add a missing backslash to the \_SB scope.

      A predefined scope in the ACPI specs is precede with a backslash.

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit bc09e06113e79e5d70cf2b37015a26f2102cc03e
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:22 2015 +0800

      qmp-event: add event notification for memory hot unplug error

      When memory hot unplug fails, this patch adds support to send
      QMP event to notify mgmt about this failure.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c06b2ffb02bfcc642c67300d2c4dffd5aa54932b
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:21 2015 +0800

      acpi: add hardware implementation for memory hot unplug

      - implements QEMU hardware part of memory hot unplug protocol
        described at "docs/spec/acpi_mem_hotplug.txt"
      - handles memory remove notification event
      - handles device eject notification

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 660e8ec70065c8b1fd68b2cb137de16d831959f4
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:20 2015 +0800

      acpi: fix "Memory device control fields" register

      0 bit in Memory device control fields must be cleared before writing to
      register. But now this field isn't cleared when other fields are written.

      To solve this bug, This patch fixes UpdateRule to WriteAsZeros in "Memory
      device control fields" register.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af5098973136029211848b4999ad5d38bc90180f
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:19 2015 +0800

      acpi: extend aml_field() to support UpdateRule

      The flags field is declared with default update rule 'Preserve',
      this patch extends aml_field() to support UpdateRule so that we
      can specify different values per field.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f7d3e29db5a5900a1f0ed10f8313f7c3f28e5b59
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:18 2015 +0800

      acpi, mem-hotplug: add unplug cb for memory device

      This patch adds unplug cb for memory device. It resets memory status
      "is_enabled" in acpi_memory_unplug_cb(), removes the corresponding
      memory region, unregisters vmstate, and unparents the object.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 64fec58e8ab62490edd2638e4214d8c9f84518c9
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:17 2015 +0800

      acpi, mem-hotplug: add unplug request cb for memory device

      This patch adds unplug request cb for memory device, and adds the
      is_removing boolean field to MemStatus. This field is used to indicate
      whether the memory device in slot has been requested to be ejected.
      This field is set to true in acpi_memory_unplug_request_cb().

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4aae99b63333e71b2097b106bb15a6fde7f9b55b
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:16 2015 +0800

      acpi, mem-hotplug: add acpi_memory_slot_status() to get MemStatus

      Add a new API named acpi_memory_slot_status() to obtain a single memory
      slot status. Doing this is because this procedure will be used by other
      functions in the next coming patches.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4fccb4834d0455519ff6d7a81551a8dfd360fefa
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:15 2015 +0800

      docs: update documentation for memory hot unplug

      Add specification about how to use memory hot unplug, and add
      a flow diagram to explain memory hot unplug process.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 850d00700ba787988b6c5404e8c1a3add7141db1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Apr 27 21:01:20 2015 +0200

      virtio: coding style tweak

      no space needed after *.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a0ccd2123ee2f83a1f081e4c39013c3316f9ec7a
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:49 2015 +0800

      pci: remove hard-coded bar size in msix_init_exclusive_bar()

      This patch lets msix_init_exclusive_bar() can calculate the bar and
      pba size based on the number of MSI-X vectors other than using a
      hard-coded limit 4096. This is needed to allow device to have more
      than 128 MSI_X vectors. To keep migration compatibility, keep using
      4096 as bar size and 2048 for pba offset.

      Notes: We don't care about the case that using vectors > 128 for
      legacy machine type. Since we limit the queue max to 64, so vectors >=
      65 is meaningless.

      Virtio device will be the first user for this.

      Cc: Keith Busch <keith.busch@intel.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 851c2a75a6e80c8aa5e713864d98cfb512e7229b
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:47 2015 +0800

      virtio-pci: speedup MSI-X masking and unmasking

      This patch tries to speed up the MSI-X masking and unmasking through
      the mapping between vector and queues. With this patch it will there's
      no need to go through all possible virtqueues, which may help to
      reduce the time spent when doing MSI-X masking/unmasking a single
      vector when more than hundreds or even thousands of virtqueues were
      supported.

      Tested with 80 queue pairs virito-net-pci by changing the smp affinity
      in the background and doing netperf in the same time:

      Before the patch:
      5711.70 Gbits/sec
      After the patch:
      6830.98 Gbits/sec

      About 19.6% improvements in throughput.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e0d686bf4b9d018ba5449f057b486bb5e1fa1a0d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:46 2015 +0800

      virtio: introduce vector to virtqueues mapping

      Currently we will try to traverse all virtqueues to find a subset that
      using a specific vector. This is sub optimal when we will support
      hundreds or even thousands of virtqueues. So this patch introduces a
      method which could be used by transport to get all virtqueues that
      using a same vector. This is done through QLISTs and the number of
      QLISTs was queried through a transport specific method. When guest
      setting vectors, the virtqueue will be linked and helpers for traverse
      the list was also introduced.

      The first user will be virtio pci which will use this to speed up
      MSI-X masking and unmasking handling.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 955cc8c9541779e09895a9c5ccbf8ace15d884f5
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:40 2015 +0800

      virtio-ccw: using VIRTIO_NO_VECTOR instead of 0 for invalid virtqueue

      It's a bad idea to need to use vector 0 for invalid virtqueue. So this patch
      changes to using VIRTIO_NO_VECTOR instead.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      CC: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit bcfa4d60144fb879f0ffef0a6d174faa37b2df82
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:39 2015 +0800

      monitor: check return value of qemu_find_net_clients_except()

      qemu_find_net_clients_except() may return a value which is greater
      than the size of array we provided. So we should check this value
      before using it, otherwise this may cause unexpected memory access.

      This patch fixes the net related command completion when we have a
      virtio-net nic with more than 255 queues.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit eaed483c1b3db1ac312116fca5d20c45b4b418b2
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:38 2015 +0800

      monitor: replace the magic number 255 with MAX_QUEUE_NUM

      This patch replace the magic number 255, and increase it to
      MAX_QUEUE_NUM which is maximum number of queues supported by a nic.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d25228e7befac33b665cd9250292de47ae6b78b5
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:37 2015 +0800

      ppc: spapr: add 2.4 machine type

      The following patches will limit the following things to legacy
      machine type:

      - maximum number of virtqueues for virtio-pci were limited to 64

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      Reviewed-by: Alexander Graf <agraf@suse.de>

  commit 3d27b09cf6f62ec61c1330d0a811811a91e7514d
  Merge: 3f9d69b 700cd85
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 20:00:57 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150427-1' into staging

      spice: misc fixes.

      # gpg: Signature made Mon Apr 27 12:03:16 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150427-1:
        spice: learn to hide cursor
        spice: set pointer position on hotspot
        spice: fix mouse cursor position
        spice: fix simple display on bigendian hosts
        monitor: Make client_migrate_info synchronous

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b0e966d0209fa5c93d510d1756a87dd4229b1f8a
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:36 2015 +0800

      spapr: add machine type specific instance init function

      This patches adds machine type specific instance initialization
      functions. Those functions will be used by following patches to compat
      class properties for legacy machine types.

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5cb50e0acc7ba6063b87664404103cce217c0493
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:35 2015 +0800

      pc: add 2.4 machine types

      The following patches will limit the following things to legacy
      machine type:

      - maximum number of virtqueues for virtio-pci were limited to 64
      - auto msix bar size for virtio-net-pci were disabled by default

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 27a46dcf5038e20451101ed2d5414aebf3846e27
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:34 2015 +0800

      virtio-net: fix the upper bound when trying to delete queues

      Virtqueue were indexed from zero, so don't delete virtqueue whose
      index is n->max_queues * 2 + 1.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 294ce717e0f212ed0763307f3eab72b4a1bdf4d0
  Author: Luke Gorrie <luke@snabb.co>
  Date:   Sun Apr 26 15:00:49 2015 +0200

      vhost-user: Send VHOST_RESET_OWNER on vhost stop

      Ensure that the vhost-user slave knows when the vrings are valid and
      when they are invalid, for example during a guest reboot.

      The vhost-user protocol says this of VHOST_RESET_OWNER:

            Issued when a new connection is about to be closed. The Master
            will no longer own this connection (and will usually close it).

      Send this message to tell the vhost-user slave that the vhost session
      has ended and that session state (e.g. vrings) is no longer valid.

      Signed-off-by: Luke Gorrie <luke@snabb.co>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 658c27181bf3b08a9cf2fab00ecce7f76065f6af
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Apr 3 18:03:34 2015 +0800

      hw/i386/acpi-build: move generic acpi building helpers into dedictated file

      Move generic acpi building helpers into dedictated file and this
      can be shared with other machines.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 395e5fb4421a03c9d3a002bbb55d56b74024a568
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Apr 3 18:03:33 2015 +0800

      hw/i386: Move ACPI header definitions in an arch-independent location

      The ACPI related header file acpi-defs.h, includes definitions that
      apply on other architectures as well. Move it in `include/hw/acpi/`
      to sanely include it from other architectures.

      Signed-off-by: Alvise Rigo <a.rigo@virtualopensystems.com>
      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 853cff8e2815c99429d53baa71110416c1de2798
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Apr 15 10:55:46 2015 +0200

      acpi-build: close } in comment

      missing } confuses editors

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 726a8ff68677d8d5fba17eb0ffb85076bfb598dc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Apr 10 14:45:00 2015 -0300

      target-i386: Remove AMD feature flag aliases from CPU model table

      When CPU vendor is AMD, the AMD feature alias bits on
      CPUID[0x80000001].EDX are already automatically copied from CPUID[1].EDX
      on x86_cpu_realizefn(). When CPU vendor is Intel, those bits are
      reserved and should be zero. On either case, those bits shouldn't be set
      in the CPU model table.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 01431f3ce0f31e123172cc99c12c98c0ddbe9917
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 2 17:22:27 2015 -0300

      target-i386: X86CPU::xlevel2 QOM property

      We already have "level" and "xlevel", only "xlevel2" is missing.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b9472b76d273c7796d877c49af50969c0a879c50
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 2 17:21:53 2015 -0300

      target-i386: Make "level" and "xlevel" properties static

      Static properties require only 1 line of code, much simpler than the
      existing code that requires writing new getters/setters.

      As a nice side-effect, this fixes an existing bug where the setters were
      incorrectly allowing the properties to be changed after the CPU was
      already realized.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d9f7e29ee5a6915caa049ba64c0a9f28766351d2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 14:57:31 2015 -0300

      qemu-config: Accept empty option values

      Currently it is impossible to set an option in a config file to an empty
      string, because the parser matches only lines containing non-empty
      strings between double-quotes.

      As sscanf() "[" conversion specifier only matches non-empty strings, add
      a special case for empty strings.

      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b203a4ba93fc25bf1eb49039a8ec4b260b446211
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:36:24 2015 -0300

      MAINTAINERS: Change status of X86 to Maintained

      "Odd Fixes" doesn't reflect the current status of target-i386. We have
      people looking after it, now.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e1a0433956bbe68b56853e6ae633a5004b1f6351
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:34:56 2015 -0300

      MAINTAINERS: Add myself to X86

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3f9d69ba12da6f2874631f6e426a7ef148ba4c82
  Merge: 0d81cdd 1a01716
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 19:06:08 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150427-1' into staging

      gtk: support text consoles without vte, bugfixes.

      # gpg: Signature made Mon Apr 27 14:34:15 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150427-1:
        gtk: Avoid accel key leakage into guest on console switch
        gtk: Fix VTE focus grabbing
        console/gtk: add qemu_console_get_label
        gtk: bind to text terminal consoles too
        gtk: handle switch_surface(NULL) properly

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2f54eb98c3255154dc6bdbb8b38982af9b3f3a8f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:34:33 2015 -0300

      MAINTAINERS: Add myself as NUMA code maintainer

      The "srat" and "numa" keywords will help get_maintainer.pl catch
      NUMA-related code in other files too.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0d81cdddaa40a1988b24657aeac19959cfad0fde
  Merge: e1a5476 2d5a834
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 17:28:41 2015 +0100

      Merge remote-tracking branch 'remotes/qmp-unstable/tags/for-upstream' into staging

      Four little fixes

      # gpg: Signature made Fri Apr 24 19:56:51 2015 BST using RSA key ID E24ED5A7
      # gpg: Good signature from "Luiz Capitulino <lcapitulino@gmail.com>"

      * remotes/qmp-unstable/tags/for-upstream:
        qmp: Give saner messages related to qmp_capabilities misuse
        qmp-commands: fix incorrect uses of ":O" specifier
        qapi: Drop dead genlist parameter
        balloon: improve error msg when adding second device

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 23820dbfc79d1c9dce090b4c555994f2bb6a69b3
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 16 22:35:54 2015 -0700

      exec: Respect as_translate_internal length clamp

      address_space_translate_internal will clamp the *plen length argument
      based on the size of the memory region being queried. The iommu walker
      logic in addresss_space_translate was ignoring this by discarding the
      post fn call value of *plen. Fix by just always using *plen as the
      length argument throughout the fn, removing the len local variable.

      This fixes a bootloader bug when a single elf section spans multiple
      QEMU memory regions.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1426570554-15940-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4080a13c11398d684668d286da27b6f8ee668e44
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:35:00 2015 +0200

      ioport: reserve the whole range of an I/O port in the AddressSpace

      When an I/O port is more than 1 byte long, ioport.c is currently
      creating "short" regions, for example 0x1ce-0x1ce for the 16-bit
      Bochs index port.  When I/O ports are memory mapped, and thus
      accessed via a subpage_ops memory region, subpage_accepts gets
      confused because it finds a hole at 0x1cf and rejects the access.

      In order to fix this, modify registration of the region to cover
      the whole size of the I/O port.  Attempts to access an invalid
      port will be blocked by find_portio returning NULL.

      This only affects the VBE DISPI regions.  For all other cases,
      the MemoryRegionPortio entries for 2- or 4-byte accesses overlap
      an entry for 1-byte accesses, thus the size of the memory region
      is not affected.

      Reported-by: Zoltan Balaton <balaton@eik.bme.hu>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 147ed379838176d4780688157891c06f49403b19
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:49:40 2015 +0200

      ioport: loosen assertions on emulation of 16-bit ports

      Right now, ioport.c assumes that the entire range specified with
      MemoryRegionPortio includes a region with size == 1.  This however
      is not true for the VBE DISPI ports, which are 16-bit only.  The
      next patch will make these regions' length equal to two, which can
      cause the assertions to trigger.  Replace them with simple conditionals.

      Also, ioport.c will emulate a 16-bit ioport with two distinct reads
      or writes, even if one of the two accesses is out of the bounds given
      by the MemoryRegionPortio array.  Do not do this anymore, instead
      discard writes to the incorrect register and read it as all-ones.
      This ensures that the mrp->read and mrp->write callbacks get an
      in-range ioport number.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 30476b2282c69c9ec1e44e33a4c0b5d5f4bc884e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:50:36 2015 +0200

      ioport: remove wrong comment

      ioport.c has not been using an alias since commit b40acf9 (ioport:
      Switch dispatching to memory core layer, 2013-06-24).  Remove the
      obsolete comment.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e477317cce98c399a2299d025bcb6bf0fd69df49
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 13:19:16 2015 +0200

      ide: there is only one data port

      IDE PIO data must be written, for example, at 0x1f0.  You cannot
      do word or dword writes to 0x1f1..0x1f3 to access the data register.
      Adjust the ide_portio_list accordingly.

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 54da54e543eea8e689a625fcb3dada1b296f5d3d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 13:12:32 2015 +0200

      gus: clean up MemoryRegionPortio

      Remove 16-bit reads/writes, since ioport.c is able to synthesize them.
      Remove the two MIDI registers (0x300 and 0x301) from gus_portio_list1,
      and add the second MIDI register (0x301) to gus_portio_list2.

      Tested with Second Reality.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3337d0b2794131425d0b5cb525e67c5989f4a9dd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:34:17 2015 +0200

      sb16: remove useless mixer_write_indexw

      ioport.c is already able to split a 16-bit access into two 8-bit
      accesses to consecutive ports.  Tested with Epic Pinball.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0e1cd6576c55269b6e5251dc739a7fc819f9b4a6
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Apr 2 16:09:30 2015 +0100

      sun4m: fix slavio sysctrl and led register sizes

      These were being incorrectly declared as MISC_SIZE (1 byte) rather than
      4 bytes and 2 bytes respectively. As a result accesses clamped to the
      real register size would unexpectedly fail.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1427987370-15897-1-git-send-email-mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 339240b5cd42bd13d4f6629f2aedf8b4b07459fb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:24:16 2015 +0100

      acpi-build: remove dependency from ram_addr.h

      ram_addr_t is an internal interface, everyone should go through
      MemoryRegion.  Clean it up by making rom_add_blob return a
      MemoryRegion* and using the new qemu_ram_resize infrastructure.

      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 37d7c08413cd4307f53c83d43b1b06cf2701d7a7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:21:46 2015 +0100

      memory: add memory_region_ram_resize

      This is a simple MemoryRegion wrapper for qemu_ram_resize.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e95205e1f9cd2c4262b7a7b1c992a94512c86d0e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:37 2015 +0800

      dma-helpers: Fix race condition of continue_after_map_failure and dma_aio_cancel

      If DMA's owning thread cancels the IO while the bounce buffer's owning thread
      is notifying the "cpu client list", a use-after-free happens:

           continue_after_map_failure               dma_aio_cancel
           ------------------------------------------------------------------
           aio_bh_new
                                                    qemu_bh_delete
           qemu_bh_schedule (use after free)

      Also, the old code doesn't run the bh in the right AioContext.

      Fix both problems by passing a QEMUBH to cpu_register_map_client.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1426496617-10702-6-git-send-email-famz@redhat.com>
      [Remove unnecessary forward declaration. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 33b6c2edf6214f02b9beaea61b169506c01f90aa
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:36 2015 +0800

      exec: Notify cpu_register_map_client caller if the bounce buffer is available

      The caller's workflow is like

          if (!address_space_map()) {
              ...
              cpu_register_map_client();
          }

      If bounce buffer became available after address_space_map() but before
      cpu_register_map_client(), the caller could miss it and has to wait for the
      next bounce buffer notify, which may never happen in the worse case.

      Just notify the list in cpu_register_map_client().

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-5-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 38e047b50d2bfd1df99fbbca884c9f1db0785ff4
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:35 2015 +0800

      exec: Protect map_client_list with mutex

      So that accesses from multiple threads are safe.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-4-git-send-email-famz@redhat.com>
      [Remove #if from cpu_exec_init_all. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 02f4035c47b4d34cdc61780292ee288f400b9c49
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:34 2015 +0800

      linux-user, bsd-user: Remove two calls to cpu_exec_init_all

      The function is a nop for user mode, so just remove them.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c2cba0ffe495b60c4cc58080281e99c7a6580d4b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:33 2015 +0800

      exec: Atomic access to bounce buffer

      There could be a race condition when two processes call
      address_space_map concurrently and both want to use the bounce buffer.

      Add an in_use flag in BounceBuffer to sync it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e3a0abfda71db1fa83be894dcff7c4871b36cc8d
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Thu Apr 9 16:07:33 2015 -0400

      translate-all: use glib for all page descriptor allocations

      Since commit

        b7b5233a "bsd-user/mmap.c: Don't try to override g_malloc/g_free"

      the exception we make here for usermode has been unnecessary.
      Get rid of it.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Message-Id: <1428610053-26148-1-git-send-email-cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 700cd855def54c2a9f2b6a016dcebf75fe19c238
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:13 2015 +0100

      spice: learn to hide cursor

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit dc8dceee64f45820c20f3ffa3c3fecd7b6539990
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:12 2015 +0100

      spice: set pointer position on hotspot

      The Spice protocol uses cursor position on hotspot: the client is
      applying hotspot offset when drawing the cursor.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d0df04a1569c75f6442123fdda0b2e9aadc3fcc7
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:11 2015 +0100

      spice: fix mouse cursor position

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c1d37cd353be3ea4c5773fc227ba8459c1f20470
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 08:56:21 2015 +0200

      spice: fix simple display on bigendian hosts

      Denis Kirjanov is busy getting spice run on ppc64 and trapped into this
      one.  Spice wire format is little endian, so we have to explicitly say
      we want little endian when letting pixman convert the data for us.

      Reported-by: Denis Kirjanov <kirjanov@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3b5704b2f80189b2f9fdddf1690998e566eeacab
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 09:30:16 2015 +0100

      monitor: Make client_migrate_info synchronous

      Live migration with spice works like this today:

        (1) client_migrate_info monitor cmd
        (2) spice server notifies client, client connects to target host.
        (3) qemu waits until spice client connect is finished.
        (4) send over vmstate (i.e. main part of live migration).
        (5) spice handover to target host.

      (3) is implemented by making client_migrate_info a async monitor
      command.  This is the only async monitor command we have.

      The original reason to implement this dance was that qemu did not accept
      new tcp connections while the incoming migration was running, so (2) and
      (4) could not be done in parallel.  That issue was fixed long ago though.
      Qemu version 1.3.0 (released Dec 2012) and newer happily accept tcp
      connects while the incoming migration runs.

      Time to drop step (3).  This patch does exactly that, by making the
      monitor command synchronous and removing the code needed to handle the
      async monitor command in ui/spice-core.c

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1a01716a307387e5cf1336f61a96f772dddadc90
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Apr 26 21:04:21 2015 +0200

      gtk: Avoid accel key leakage into guest on console switch

      GTK2 sends the accel key to the guest when switching to the graphic
      console via that shortcut. Resolve this by ignoring any keys until the
      next key-release event. However, do not ignore keys when switching via
      the menu or when on GTK3.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9d677e1c2fa479336fb7a2b90aea78c10d037e98
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Apr 26 21:04:20 2015 +0200

      gtk: Fix VTE focus grabbing

      At least on GTK2, the VTE terminal has to be specified as target of
      gtk_widget_grab_focus. Otherwise, switching from one VTE terminal to
      another causes the focus to get lost.

      CC: John Snow <jsnow@redhat.com>
      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

      [ kraxel: fixed build with CONFIG_VTE=n ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4eb276408363aef5435a72a8e818f24220b5edd0
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Sun Apr 26 16:49:26 2015 +0100

      Allow ARMv8 SCR.SMD updates

      Updated scr_write to always allow updates to the SCR.SMD bit on ARMv8
      regardless of whether virtualization (EL2) is enabled or not.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1429888797-4378-1-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d5c84ff21a8a7a3bfb3a75154be8905e62f51db
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Sun Apr 26 16:49:26 2015 +0100

      target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1429669112-29835-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ebd5f2e03a00889619bb97e83062d27066d4a26
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: rename c1_coproc to cpacr_el1

      Rename the field holding CPACR_EL1 system register state in AArch64
      naming style.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      [PMM: also fixed a couple of missed occurrences in cpu.c]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ef7bab8d73580b48bda83b8d16b5eea8a3ac43fe
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Check watchpoints against CPU security state

      Fix a TODO in bp_wp_matches() now that we have a function for
      testing whether the CPU is currently in Secure mode or not.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 9e1fc5bdfdf94564abf7621c0ef644599196360f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Use attribute info to handle user-only watchpoints

      Now that we have memory access attribute information in the watchpoint
      checking code, we can correctly implement handling of watchpoints
      which should match only on userspace accesses, where LDRT/STRT/LDT/STT
      from EL1 are treated as userspace accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 0995bf8cd91b81ec9c1078e37b808794080dc5c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Add user-mode transaction attribute

      Add a transaction attribute indicating that a memory access is being
      done from user-mode (unprivileged). This corresponds to an equivalent
      signal in ARM AMBA buses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit ebca90e4c3aaaae5ed1ee7c569dea00d5d6ed476
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Use correct memory attributes for page table walks

      Factor out the page table walk memory accesses into their own function,
      so that we can specify the correct S/NS memory attributes for them.
      This will also provide a place to use the correct endianness and
      handle the need for a stage-2 translation when virtualization is
      supported.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 8bf5b6a9c1911d2c8473385fc0cebfaaeef42dbc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Honour NS bits in page tables

      Honour the NS bit in ARM page tables:
       * when adding entries to the TLB, include the Secure/NonSecure
         transaction attribute
       * set the NS bit in the PAR when doing ATS operations

      Note that we don't yet correctly use the NSTable bit to
      cause the page table walk itself to use the right attributes.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 42874d3a8c6267ff7789a0396843c884b1d0933a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      Switch non-CPU callers from ld/st*_phys to address_space_ld/st*

      Switch all the uses of ld/st*_phys to address_space_ld/st*,
      except for those cases where the address space is the CPU's
      (ie cs->as). This was done with the following script which
      generates a Coccinelle patch.

      A few over-80-columns lines in the result were rewrapped by
      hand where Coccinelle failed to do the wrapping automatically,
      as well as one location where it didn't put a line-continuation
      '\' when wrapping lines on a change made to a match inside
      a macro definition.

      ===begin===
      #!/bin/sh -e
      # Usage:
      # ./ldst-phys.spatch.sh > ldst-phys.spatch
      # spatch -sp_file ldst-phys.spatch -dir . | sed -e '/^+/s/\t/        /g' > out.patch
      # patch -p1 < out.patch

      for FN in ub uw_le uw_be l_le l_be q_le q_be uw l q; do
      cat <<EOF
      @ cpu_matches_ld_${FN} @
      expression E1,E2;
      identifier as;
      @@

      ld${FN}_phys(E1->as,E2)

      @ other_matches_ld_${FN} depends on !cpu_matches_ld_${FN} @
      expression E1,E2;
      @@

      -ld${FN}_phys(E1,E2)
      +address_space_ld${FN}(E1,E2, MEMTXATTRS_UNSPECIFIED, NULL)

      EOF

      done

      for FN in b w_le w_be l_le l_be q_le q_be w l q; do
      cat <<EOF
      @ cpu_matches_st_${FN} @
      expression E1,E2,E3;
      identifier as;
      @@

      st${FN}_phys(E1->as,E2,E3)

      @ other_matches_st_${FN} depends on !cpu_matches_st_${FN} @
      expression E1,E2,E3;
      @@

      -st${FN}_phys(E1,E2,E3)
      +address_space_st${FN}(E1,E2,E3, MEMTXATTRS_UNSPECIFIED, NULL)

      EOF

      done
      ===endit===

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 66b9b43c42049bcae37668e890fedde9a72c8167
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Capture the memory attributes for a watchpoint hit

      Capture the memory attributes for the transaction which triggered
      a watchpoint; this allows CPU specific code to implement features
      like ARM's "user-mode only WPs also hit for LDRT/STRT accesses
      made from privileged code". This change also correctly passes
      through the memory attributes to the underlying device when
      a watchpoint access doesn't hit.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 500131154d677930fce35ec3a6f0b5a26bcd2973
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Add new address_space_ld*/st* functions

      Add new address_space_ld*/st* functions which allow transaction
      attributes and error reporting for basic load and stores. These
      are named to be in line with the address_space_read/write/rw
      buffer operations.

      The existing ld/st*_phys functions are now wrappers around
      the new functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 5c9eb0286c819c1836220a32f2e1a7b5004ac79a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Make address_space_rw take transaction attributes

      Make address_space_rw take transaction attributes, rather
      than always using the 'unspecified' attributes.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit f25a49e0057bbfcc2b1111f60785d919b6ddaeea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Convert subpage memory ops to _with_attrs

      Convert the subpage memory ops to _with_attrs; this will allow
      us to pass the attributes through to the underlying access
      functions. (Nothing uses the attributes yet.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit fadc1cbe85c6b032d5842ec0d19d209f50fcb375
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      Add MemTxAttrs to the IOTLB

      Add a MemTxAttrs field to the IOTLB, and allow target-specific
      code to set it via a new tlb_set_page_with_attrs() function;
      pass the attributes through to the device when making IO accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit e469b22ffda40188954fafaf6e3308f58d50f8f8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      Make CPU iotlb a structure rather than a plain hwaddr

      Make the CPU iotlb a structure rather than a plain hwaddr;
      this will allow us to add transaction attributes to it.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 3b6434953934e6d4a776ed426d8c6d6badee176f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      memory: Replace io_mem_read/write with memory_region_dispatch_read/write

      Rather than retaining io_mem_read/write as simple wrappers around
      the memory_region_dispatch_read/write functions, make the latter
      public and change all the callers to use them, since we need to
      touch all the callsites anyway to add MemTxAttrs and MemTxResult
      support. Delete io_mem_read and io_mem_write entirely.

      (All the callers currently pass MEMTXATTRS_UNSPECIFIED
      and convert the return value back to bool or ignore it.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit cc05c43ad942165ecc6ffd39e41991bee43af044
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      memory: Define API for MemoryRegionOps to take attrs and return status

      Define an API so that devices can register MemoryRegionOps whose read
      and write callback functions are passed an arbitrary pointer to some
      transaction attributes and can return a success-or-failure status code.
      This will allow us to model devices which:
       * behave differently for ARM Secure/NonSecure memory accesses
       * behave differently for privileged/unprivileged accesses
       * may return a transaction failure (causing a guest exception)
         for erroneous accesses

      This patch defines the new API and plumbs the attributes parameter through
      to the memory.c public level functions io_mem_read() and io_mem_write(),
      where it is currently dummied out.

      The success/failure response indication is also propagated out to
      io_mem_read() and io_mem_write(), which retain the old-style
      boolean true-for-error return.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit e1a5476354d396773e4c555f126d752d4ae58fa9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Apr 25 22:05:07 2015 +0100

      Open 2.4 development tree

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2d5a8346a484250934526a15b3a522bdba7e6772
  Author: Eric Blake <eblake@redhat.com>
  Date:   Wed Apr 15 09:19:23 2015 -0600

      qmp: Give saner messages related to qmp_capabilities misuse

      Pretending that QMP doesn't understand a command merely because
      we are not in the right mode doesn't help first-time users figure
      out what to do to correct things.  Although the documentation for
      QMP calls out capabilities negotiation, we should also make it
      clear in our error messages what we were expecting.  With this
      patch, I now get the following transcript:

      $ ./x86_64-softmmu/qemu-system-x86_64 -qmp stdio -nodefaults
      {"QMP": {"version": {"qemu": {"micro": 93, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
      {"execute":"huh"}
      {"error": {"class": "CommandNotFound", "desc": "The command huh has not been found"}}
      {"execute":"quit"}
      {"error": {"class": "CommandNotFound", "desc": "Expecting capabilities negotiation with 'qmp_capabilities' before command 'quit'"}}
      {"execute":"qmp_capabilities"}
      {"return": {}}
      {"execute":"qmp_capabilities"}
      {"error": {"class": "CommandNotFound", "desc": "Capabilities negotiation is already complete, command 'qmp_capabilities' ignored"}}
      {"execute":"quit"}
      {"return": {}}
      {"timestamp": {"seconds": 1429110729, "microseconds": 181935}, "event": "SHUTDOWN"}

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Tested-By: Kashyap Chamarthy <kchamart@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 43d0a2c1af5bc77ed067636db956209779351dfe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 15 13:30:04 2015 +0200

      qmp-commands: fix incorrect uses of ":O" specifier

      As far as the QMP parser is concerned, neither the 'O' nor the 'q' format specifiers
      put any constraint on the command.  However, there are two differences:

      1) from a documentation point of view 'O' says that this command takes
      a dictionary.  The dictionary will be converted to QemuOpts in the
      handler to match the corresponding HMP command.

      2) 'O' sets QMP_ACCEPT_UNKNOWNS, resulting in the command accepting invalid
      extra arguments.  For example the following is accepted:

         { "execute": "send-key",
              "arguments": { "keys": [ { "type": "qcode", "data": "ctrl" },
                                       { "type": "qcode", "data": "alt" },
                                       { "type": "qcode", "data": "delete" } ], "foo": "bar" } }

      Neither send-key nor migrate-set-capabilities take a QemuOpts-like
      dictionary; they take an array of dictionaries.  And neither command
      really wants to have extra unknown arguments.  Thus, the right
      specifier to use in this case is 'q'; with this patch the above
      command fails with

         {"error": {"class": "GenericError", "desc": "Invalid parameter 'foo'"}}

      as intended.

      Reported-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6540e9f35bfeea2baf4509745516172070dca412
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri Apr 10 15:07:59 2015 -0600

      qapi: Drop dead genlist parameter

      Defaulting a parameter to True, then having all callers omit or
      pass an explicit True for that parameter, is pointless. Looks
      like it has been dead since introduction in commit 06d64c6, more
      than 4 years ago.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 46abb8124006887d071921c5e657eeec3c50a9e2
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Tue Mar 31 13:00:26 2015 -0400

      balloon: improve error msg when adding second device

      A VM supports only one balloon device, but due to several changes
      in infrastructure the error message got messed up when trying
      to add a second device. Fix it.

      Before this fix

      Command-line:

      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Another balloon device already registered
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Adding balloon handler failed
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Device 'virtio-balloon-pci' could not be initialized

      HMP:

      Another balloon device already registered
      Adding balloon handler failed
      Device 'virtio-balloon-pci' could not be initialized

      QMP:

      { "execute": "device_add", "arguments": { "driver": "virtio-balloon-pci", "id": "balloon0" } }
      {
      	"error": {
      		"class": "GenericError",
      		"desc": "Adding balloon handler failed"
      	}
      }

      After this fix

      Command-line:

      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Only one balloon device is supported
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Device 'virtio-balloon-pci' could not be initialized

      HMP:

      (qemu) device_add virtio-balloon-pci,id=balloon0
      Only one balloon device is supported
      Device 'virtio-balloon-pci' could not be initialized
      (qemu)

      QMP:

      { "execute": "device_add",
                "arguments": { "driver": "virtio-balloon-pci", "id": "balloon0" } }
      {
          "error": {
              "class": "GenericError",
              "desc": "Only one balloon device is supported"
          }
      }

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e5b3a24181ea0cebf1c5b20f44d016311b7048f0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 24 15:05:06 2015 +0100

      Update version for v2.3.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 779ce88fbd3f977112bc77ccb028b0ace762105e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 10:41:08 2015 +0100

      console/gtk: add qemu_console_get_label

      Add a new function to get a nice label for a given QemuConsole.
      Drop the labeling code in gtk.c and use the new function instead.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f8c223f69ac58488ea830597281b7ddd33037c4c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu May 22 11:08:54 2014 +0200

      gtk: bind to text terminal consoles too

      This way gtk has text terminal consoles even when building without vte.
      Most notably you'll get a monitor tab on windows now.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f98f43eab0fcc536c5f95df3a94943d5dff5ccdc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Feb 27 14:36:09 2015 +0100

      gtk: handle switch_surface(NULL) properly

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f2a581010cb8e3a2564a45a2863a33a732cc2fc7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 20 17:13:16 2015 +0100

      Update version for v2.3.0-rc4 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e05ca8200216149008fa1b1d1d847bf16691f6b4
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Fri Apr 17 17:13:24 2015 +0200

      vhost: fix log base address

      VHOST_SET_LOG_BASE got an incorrect address, causing
      migration errors and potentially even memory corruption.

      Reported-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Message-id: 1429283565-32265-1-git-send-email-mst@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 638b8366200130cc7cf7a026630bc6bfb63b0c4c
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Apr 17 15:44:48 2015 +0300

      hmp: fix crash in 'info block -n -v'

      The image field in BlockDeviceInfo should never be null, however
      bdrv_block_device_info() is not filling it in.

      This makes the 'info block -n -v' command crash QEMU.

      The proper solution is probably to move the relevant code from
      bdrv_query_info() to bdrv_block_device_info(), but since we're too
      close to the release for that this simpler workaround solves the
      crash.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1429274688-8115-1-git-send-email-berto@igalia.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 87a8adc0876c11a434d3ecdfb10cd797259ddaaa
  Merge: b6df74c 0ca4f94
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 17 12:54:46 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150417-2' into staging

      MIPS patches 2015-04-17

      Changes:
      * fix broken fulong2e

      # gpg: Signature made Fri Apr 17 12:14:37 2015 BST using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150417-2:
        mips: fix broken fulong2e machine

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b6df74c46528646f3163890cf16b74af551c3494
  Merge: 993ebe4 6cec43e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 17 12:37:38 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-fwcfg-20150414-1' into staging

      fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      # gpg: Signature made Tue Apr 14 12:22:20 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-fwcfg-20150414-1:
        fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ca4f94195cce77b624edc6d9abcf14a3bf01f06
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 16 21:11:23 2015 +0100

      mips: fix broken fulong2e machine

      After commit 5312bd8 the bonito_readl() and bonito_writel() have been
      accessing incorrect addresses. Consequently QEMU is crashing when trying
      to boot Linux kernel on fulong2e machine.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 993ebe4a0be9aa4e4821818a81fab00b1ab1a79a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri Apr 17 08:16:49 2015 +0100

      target-ppc: don't invalidate msr MSR_HVB bit in cpu_post_load

      The invalidation code introduced in commit 2360b works by inverting most bits
      of env->msr to ensure that hreg_store_msr() will forcibly update the CPU env
      state to reflect the new msr value post-migration. Unfortunately
      hreg_store_msr() is called with alter_hv set to 0 which preserves the MSR_HVB
      state from the CPU env which is now the opposite value to what it should be.

      Ensure that we don't invalidate the msr MSR_HVB bit during cpu_post_load so
      that the correct value is restored. This fixes suspend/resume for PPC64.

      Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1429255009-12751-1-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cec43e178cde38a3eac43a2cd741ce741b10f36
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Thu Apr 9 10:40:01 2015 -0400

      fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      This document covers the guest-side hardware interface, as
      well as the host-side programming API of QEMU's firmware
      configuration (fw_cfg) device.

      Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b8df9208f357d2b36e1b19634aea973618dc7ba8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 13 17:35:44 2015 +0100

      Update version for v2.3.0-rc3 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ae6e8ef11e6cb43ec83a5846e8f3b266834cf280
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 10 13:58:01 2015 +0100

      Revert seccomp tests that allow it to be used on non-x86 architectures

      Unfortunately it turns out that libseccomp 2.2 still does not work
      correctly on non-x86 architectures; return to the previous configure
      setup of insisting on libseccomp 2.1 or better and i386/x86_64 and
      disabling seccomp support in all other situations.

      This reverts the two commits:
       * "seccomp: libseccomp version varying according to arch"
         (commit 896848f0d3e2393905845ef2b244bb2601f9df0c)
       * "seccomp: update libseccomp version and remove arch restriction"
         (commit 8e27fc200457e3f2473d0069263774d4ba17bd85)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1428670681-23032-1-git-send-email-peter.maydell@linaro.org

  commit 4d0ecde44ae6dab3aa9d10c23e61d9d43789731a
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu Apr 9 15:32:45 2015 +0200

      pci: Fix crash with illegal "-net nic, model=xxx" option

      Current QEMU crashes when specifying an illegal model with the
      "-net nic,model=xxx" option, e.g.:

       $ qemu-system-x86_64 -net nic,model=n/a
       qemu-system-x86_64: Unsupported NIC model: n/a

       Program received signal SIGSEGV, Segmentation fault.

      The gdb backtrace looks like this:

      0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
      152	    return err->msg;
      (gdb) bt
       0  0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
       1  0x0000555555965ffd in error_report_err (err=0x0) at util/error.c:157
       2  0x0000555555809c90 in pci_nic_init_nofail (nd=0x555555e49860 <nd_table>, rootbus=0x5555564409b0,
          default_model=0x55555598c37b "e1000", default_devaddr=0x0) at hw/pci/pci.c:1663
       3  0x0000555555691e42 in pc_nic_init (isa_bus=0x555556f71900, pci_bus=0x5555564409b0)
          at hw/i386/pc.c:1506
       4  0x000055555569396b in pc_init1 (machine=0x5555562abbf0, pci_enabled=1, kvmclock_enabled=1)
          at hw/i386/pc_piix.c:248
       5  0x0000555555693d27 in pc_init_pci (machine=0x5555562abbf0) at hw/i386/pc_piix.c:310
       6  0x000055555572ddf5 in main (argc=3, argv=0x7fffffffe018, envp=0x7fffffffe038) at vl.c:4226

      The problem is that pci_nic_init_nofail() does not check whether the err
      parameter from pci_nic_init has been set up and thus passes a NULL pointer
      to error_report_err(). Fix it by correctly checking the err parameter.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 342b0711cd62ddc08d334d879eac57b68f925fd5
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Apr 10 16:37:56 2015 +0200

      stm32f205: Fix SoC type name

      The type name for the SoC device, unlike those of its sub-devices,
      did not follow the QOM naming conventions. While the usage is internal
      only, this is exposed through QMP and HMP, so fix it before release.

      Cc: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Alistair Francis <alistair@alistair23.me>
      Message-id: 1428676676-23056-1-git-send-email-afaerber@suse.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c0c8584142a13e728178e51f2477c23a84ce74b4
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:15:10 2015 +0200

      cris: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 58c24a4775ef7ccf16cfcd695753dfdf149fe29d
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:14:14 2015 +0200

      alpha: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Acked-by: Richard Henderson <rth@twiddle.net>
      Message-id: CAL5wTH64_ykF17cw2T1Axq8P3vCWm=6WbUJ3qJrLF-u+-MmzUw@mail.gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7ccb83f44eca09e48c61866a090425c762598f0
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:16:18 2015 +0200

      lm32: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Acked-by: Michael Walle <michael@walle.cc>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 81b23ef82cd1be29ca3d69ab7e98b5b5e55926ce
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Mar 31 15:18:03 2015 +0100

      xen: limit guest control of PCI command register

      Otherwise the guest can abuse that control to cause e.g. PCIe
      Unsupported Request responses (by disabling memory and/or I/O decoding
      and subsequently causing [CPU side] accesses to the respective address
      ranges), which (depending on system configuration) may be fatal to the
      host.

      This is CVE-2015-2756 / XSA-126.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Ian Campbell <ian.campbell@citrix.com>
      Message-id: alpine.DEB.2.02.1503311510300.7690@kaball.uk.xensource.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a460ed18a3fda0eb2d9c96b8b01817b4dcbded4
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Apr 9 14:52:18 2015 +0100

      configure: disable Archipelago by default and warn about libxseg GPLv3 license

      libxseg has changed license to GPLv3.  QEMU includes GPL "v2 only" code
      which is not compatible with GPLv3.  This means the resulting binaries
      may not be redistributable!

      Disable Archipelago (libxseg) by default to prevent accidental license
      violations.  Also warn if linking against libxseg is enabled to remind
      the user.

      Note that this commit does not constitute any advice about software
      licensing.  If you have doubts you should consult a lawyer.

      Cc: Chrysostomos Nanakos <cnanakos@grnet.gr>
      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Reported-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1428587538-8765-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a6f2cb037a82fb8679e70e175cfbc879dd829e06
  Merge: cf811ff 05b685f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 9 12:05:00 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Apr  9 10:55:11 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block/iscsi: handle zero events from iscsi_which_events
        aio: strengthen memory barriers for bottom half scheduling
        virtio-blk: correctly dirty guest memory
        qcow2: Fix header update with overridden backing file

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cf811fff2ae20008f00455d0ab2212a4dea0b56f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 8 20:57:09 2015 +0100

      tcg/tcg-op.c: Fix ld/st of 64 bit values on 32-bit bigendian hosts

      Commit 951c6300f7 out-of-lined the 32-bit-host versions of
      tcg_gen_{ld,st}_i64, but in the process it inadvertently changed
      an #ifdef HOST_WORDS_BIGENDIAN to #ifdef TCG_TARGET_WORDS_BIGENDIAN.
      Since the latter doesn't get defined anywhere this meant we always
      took the "LE host" codepath, and stored the two halves of the value
      in the wrong order on BE hosts. This typically breaks any 64-bit
      guest on a 32-bit BE host completely, and will have possibly more
      subtle effects even for 32-bit guests.

      Switch the ifdef back to HOST_WORDS_BIGENDIAN.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1428523029-13620-1-git-send-email-peter.maydell@linaro.org

  commit 05b685fbabb7fdcab72cb42b27db916fd74b2265
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Apr 7 22:08:15 2015 +0200

      block/iscsi: handle zero events from iscsi_which_events

      newer libiscsi versions may return zero events from iscsi_which_events.

      In this case iscsi_service will return immediately without any progress.
      To avoid busy waiting for iscsi_which_events to change we deregister all
      read and write handlers in this case and schedule a timer to periodically
      check iscsi_which_events for changed events.

      Next libiscsi version will introduce async reconnects and zero events
      are returned while libiscsi is waiting for a reconnect retry.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1428437295-29577-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e8d3b1a25f284cdf9705b7cf0412281cc9ee3a36
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Apr 7 17:16:19 2015 +0200

      aio: strengthen memory barriers for bottom half scheduling

      There are two problems with memory barriers in async.c.  The fix is
      to use atomic_xchg in order to achieve sequential consistency between
      the scheduling of a bottom half and the corresponding execution.

      First, if bh->scheduled is already 1 in qemu_bh_schedule, QEMU does
      not execute a memory barrier to order any writes needed by the callback
      before the read of bh->scheduled.  If the other side sees req->state as
      THREAD_ACTIVE, the callback is not invoked and you get deadlock.

      Second, the memory barrier in aio_bh_poll is too weak.  Without this
      patch, it is possible that bh->scheduled = 0 is not "published" until
      after the callback has returned.  Another thread wants to schedule the
      bottom half, but it sees bh->scheduled = 1 and does nothing.  This causes
      a lost wakeup.  The memory barrier should have been changed to smp_mb()
      in commit 924fe12 (aio: fix qemu_bh_schedule() bh->ctx race condition,
      2014-06-03) together with qemu_bh_schedule()'s.  Guess who reviewed
      that patch?

      Both of these involve a store and a load, so they are reproducible on
      x86_64 as well.  It is however much easier on aarch64, where the
      libguestfs test suite triggers the bug fairly easily.  Even there the
      failure can go away or appear depending on compiler optimization level,
      tracing options, or even kernel debugging options.

      Paul Leveille however reported how to trigger the problem within 15
      minutes on x86_64 as well.  His (untested) recipe, reproduced here
      for reference, is the following:

         1) Qcow2 (or 3) is critical – raw files alone seem to avoid the problem.

         2) Use “cache=directsync” rather than the default of
         “cache=none” to make it happen easier.

         3) Use a server with a write-back RAID controller to allow for rapid
         IO rates.

         4) Run a random-access load that (mostly) writes chunks to various
         files on the virtual block device.

            a. I use ‘diskload.exe c:25’, a Microsoft HCT load
               generator, on Windows VMs.

            b. Iometer can probably be configured to generate a similar load.

         5) Run multiple VMs in parallel, against the same storage device,
         to shake the failure out sooner.

         6) IvyBridge and Haswell processors for certain; not sure about others.

      A similar patch survived over 12 hours of testing, where an unpatched
      QEMU would fail within 15 minutes.

      This bug is, most likely, also the cause of failures in the libguestfs
      testsuite on AArch64.

      Thanks to Laszlo Ersek for initially reporting this bug, to Stefan
      Hajnoczi for suggesting closer examination of qemu_bh_schedule, and to
      Paul for providing test input and a prototype patch.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reported-by: Paul Leveille <Paul.Leveille@stratus.com>
      Reported-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1428419779-26062-1-git-send-email-pbonzini@redhat.com
      Suggested-by: Paul Leveille <Paul.Leveille@stratus.com>
      Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c8623c0215e18eb4a8ec73eba014d97e51ed707e
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:24:38 2015 +0200

      arm: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-id: CAL5wTH4UHYKpJF=dLJfFzxpufjY189chnCow47-ySuLf8GLbug@mail.gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a6cdd6d35158bc7a6aacd92b5b0302f28ec480e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 2 19:50:44 2015 +0200

      virtio-blk: correctly dirty guest memory

      After qemu_iovec_destroy, the QEMUIOVector's size is zeroed and
      the zero size ultimately is used to compute virtqueue_push's len
      argument.  Therefore, reads from virtio-blk devices did not
      migrate their results correctly.  (Writes were okay).

      Save the size in virtio_blk_handle_request, and use it when the request
      is completed.

      Based on a patch by Wen Congyang.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Message-id: 1427997044-392-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4603fe139e2161464d7e75faa3a650e31f057fc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 15:03:16 2015 +0200

      qcow2: Fix header update with overridden backing file

      In recent qemu versions, it is possible to override the backing file
      name and format that is stored in the image file with values given at
      runtime. In such cases, the temporary override could end up in the
      image header if the qcow2 header was updated, while obviously correct
      behaviour would be to leave the on-disk backing file path/format
      unchanged.

      Fix this and add a test case for it.

      Reported-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1428411796-2852-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5a24f20a7208a58fb80d78ca0521bba6f4d7b145
  Merge: f2155a0 9be6e69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 7 14:33:46 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-04-04' into staging

      trivial patches for 2015-04-04

      # gpg: Signature made Sat Apr  4 08:07:49 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-04-04:
        vhost: fix typo in vq_index description
        gitignore: Ignore more .pod files.
        target-tricore: Fix check which was always false
        target-i386: remove superfluous TARGET_HAS_SMC macro
        pcspk: Fix I/O port name

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9be6e69f12bc65e9c43ee5b8eb026412f11b8b71
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Mar 26 12:10:29 2015 +0100

      vhost: fix typo in vq_index description

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Acked-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 085feb61dbc6130bfd2e6c3f59d03220ff9e1bb3
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri Mar 20 10:30:44 2015 -0600

      gitignore: Ignore more .pod files.

      kvm_stat.{1,pod} started showing up as untracked files in my
      directory, and I nearly accidentally merged them into a commit
      with my usual habit of 'git add .'.  Rather than spelling out
      each such file, just ignore the entire pattern.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7b4b0b5795e934a9b7efb916af86715b68555be9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 21 14:44:58 2015 +0100

      target-tricore: Fix check which was always false

      With a mask value of 0x00400000, the result will never be 1.
      This fixes a Coverity warning.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c04146ad4696b20c440bfbb4a6ab27ea254e7ca
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Sat Mar 21 13:29:09 2015 -0400

      target-i386: remove superfluous TARGET_HAS_SMC macro

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ecf2e5a46d7559f258a2c914131ba25d3c5326bf
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Mar 19 13:08:40 2015 +0100

      pcspk: Fix I/O port name

      Probably a copy&paste bug. Fixing it helps identifying the device model
      behind port 0x61.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f2155a089600e80cf7bcdc814520ef3304882cc4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 18:02:02 2015 +0100

      Update version for v2.3.0-rc2 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 14655e9a18276d67eebad62a9c388ca5964bb353
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Apr 2 17:17:45 2015 +0200

      glib-compat: fix problems with not-quite glib 2.22

      Commit 89b516d8b9444ece8ccabb322a9389587c7a7b83 ("glib: add
      compatibility interface for g_get_monotonic_time()") aimed
      at making qemu build with old glib versions. At least SLES11SP3,
      however, contains a backport of g_get_monotonic_time() while
      keeping the reported glib version at 2.22.

      Let's work around this by a strategically placed #define.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-id: 1427987865-433-2-git-send-email-cornelia.huck@de.ibm.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8a7ef145d6e97853ce4ecc9277475e1726ff757
  Merge: 913fbe9 fb8597b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 15:53:16 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Another round of small fixes.  I am not including the
      virtio-blk fix, because Wen only posted a prototype and the changes
      I made were pretty large.  It definitely needs another pair of eyes
      (but it is a 2.3 regression and a blocker).

      # gpg: Signature made Thu Apr  2 14:59:56 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        Use $(MAKE) for recursive make
        kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap
        util/qemu-config: fix regression of qmp_query_command_line_options
        target-i386: clear bsp bit when designating bsp
        qga: fitering out -fstack-protector-strong
        target-i386: save 64-bit CR3 in 64-bit SMM state save area

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb8597bb65eff5c868db52668d21888e4fe7c27a
  Author: Ed Maste <emaste@freebsd.org>
  Date:   Wed Apr 1 13:58:38 2015 -0400

      Use $(MAKE) for recursive make

      On BSDs "make" is typically BSD make, while "gmake" is GNU make.

      Signed-off-by: Ed Maste <emaste@freebsd.org>
      Message-Id: <1427911118-21905-1-git-send-email-emaste@freebsd.org>
      [Fix $(INSTALLER) too as reported by Fam Zheng. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4cc856fabae1447d53890e707c70f257a7691174
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Apr 2 19:26:31 2015 +0000

      kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap

      Sometimes, we destroy the dirty_bitmap in kvm_memory_slot before any sync action
      occur, this bit in dirty_bitmap will be missed, and which will lead the corresponding
      dirty pages to be missed in migration.

      This usually happens when do migration during VM's Start-up or Reboot.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      [Use s->migration_log instead of exec.c's in_migration. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0a7cf217d81161e36af2344e911d56d4f9fef9c5
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Apr 1 19:47:21 2015 +0300

      util/qemu-config: fix regression of qmp_query_command_line_options

      Commit 49d2e64 (machine: remove qemu_machine_opts global list)
      made machine options specific to machine sub-type, leaving
      the qemu_machine_opts desc array empty. Sadly this is the place
      qmp_query_command_line_options is looking for supported options.

      As a fix for for 2.3 the machine_qemu_opts (the generic ones)
      are restored only for qemu-config scope.
      We need to find a better fix for 2.4.

      Reported-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Message-Id: <1427906841-1576-1-git-send-email-marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9cb11fd7539b5b787d8fb3834004804a58dd16ae
  Author: Nadav Amit <namit@cs.technion.ac.il>
  Date:   Thu Apr 2 02:58:36 2015 +0300

      target-i386: clear bsp bit when designating bsp

      Since the BSP bit is writable on real hardware, during reset all the CPUs which
      were not chosen to be the BSP should have their BSP bit cleared. This fix is
      required for KVM to work correctly when it changes the BSP bit.

      An additional fix is required for QEMU tcg to allow software to change the BSP
      bit.

      Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
      Message-Id: <1427932716-11800-1-git-send-email-namit@cs.technion.ac.il>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 420957a5982113416c5e442687de5e1ffaffeafc
  Author: Joseph Hindin <jhindin@daynix.com>
  Date:   Wed Apr 1 19:38:57 2015 +0300

      qga: fitering out -fstack-protector-strong

      configure script may add -fstack-protector-strong option instead
      of -fstack-protector-all, depending on availability ( see
      commit 63678e17c ). Both options have to by filtered out for
      qga-vss.dll, otherwise MinGW cross-compilation fails at linking
      stage.

      Signed-off-by: Joseph Hindin <jhindin@daynix.com>
      Message-Id: <1427906337-20805-2-git-send-email-jhindin@daynix.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cbea0c26e718191b57783f847ad2c805670439e8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 2 14:13:55 2015 +0200

      target-i386: save 64-bit CR3 in 64-bit SMM state save area

      The x86_64 CR3 register is 64 bits wide, save all of them!

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 913fbe9a6a05296132b5fab431bf1c377a0bbf1a
  Merge: 11f10cf 9f9bdf4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 14:36:57 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-hw-2015-04-02' into staging

      hw: Contain drive, serial, parallel, net misuse

      # gpg: Signature made Thu Apr  2 14:32:00 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-hw-2015-04-02:
        sysbus: Make devices picking up backends unavailable with -device
        sdhci: Make device "sdhci-pci" unavailable with -device
        hw: Mark device misusing nd_table[] FIXME
        hw: Mark devices picking up char backends actively FIXME
        hw: Mark devices picking up block backends actively FIXME

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f9bdf43cac28251f8cb33b77fed5e19225375c4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:34:40 2015 +0100

      sysbus: Make devices picking up backends unavailable with -device

      Device models aren't supposed to go on fishing expeditions for
      backends.  They should expose suitable properties for the user to set.
      For onboard devices, board code sets them.

      A number of sysbus devices pick up block backends in their init() /
      instance_init() methods with drive_get_next() instead: sl-nand,
      milkymist-memcard, pl181, generic-sdhci.

      Likewise, a number of sysbus devices pick up character backends in
      their init() / realize() methods with qemu_char_get_next_serial():
      cadence_uart, digic-uart, etraxfs,serial, lm32-juart, lm32-uart,
      milkymist-uart, pl011, stm32f2xx-usart, xlnx.xps-uartlite.

      All these mistakes are already marked FIXME.  See the commit that
      added these FIXMEs for a more detailed explanation of what's wrong.

      Fortunately, only machines ppce500 and pseries-* support -device with
      sysbus devices, and none of the devices above is supported with these
      machines.

      Set cannot_instantiate_with_device_add_yet to preserve our luck.

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: Antony Pavlov <antonynpavlov@gmail.com>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19109131ca2701de1b4e083bd51172f376f7a5ef
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:22:10 2015 +0100

      sdhci: Make device "sdhci-pci" unavailable with -device

      Device models aren't supposed to go on fishing expeditions for
      backends.  They should expose suitable properties for the user to set.
      For onboard devices, board code sets them.

      "sdhci-pci" picks up its block backend in its realize() method with
      drive_get_next() instead.  Already marked FIXME.  See the commit that
      added the FIXME for a more detailed explanation of what's wrong.

      We can't fix this in time for the release, but since the device is new
      in 2.3, we can set cannot_instantiate_with_device_add_yet to disable
      it before this mistake becomes ABI, and we have to support command
      lines like

          $ qemu -drive if=sd -drive if=sd,file=sd.img -device sdhci-pci -device sdhci-pci

      forever.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19f33f16890fc5ec0d43841625ca44ef28767d1a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 11:35:25 2015 +0100

      hw: Mark device misusing nd_table[] FIXME

      NICs defined with -net nic are for board initialization to wire up.
      Board code examines nd_table[] to find them, and creates devices with
      their qdev NIC properties set accordingly.

      Except "allwinner-a10" goes on a fishing expedition for NIC
      configuration instead of exposing the usual NIC properties for board
      code to set: it uses nd_table[0] in its instance_init() method.

      Picking up the first -net nic option's configuration that way works
      when the device is created by board code.  But it's inappropriate for
      -device and device_add.  Not only is it inconsistent with how the
      other block device models work (they get their configuration from
      properties "mac", "vlan", "netdev"), it breaks when nd_table[0] has
      been picked up by the board or a previous -device / device_add
      already.

      Example:

          $ qemu-system-arm -S -M cubieboard -device allwinner-a10
          qemu-system-arm: -device allwinner-a10: Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use
          Aborted (core dumped)

      It also breaks in other entertaining ways:

          $ qemu-system-arm -M highbank -device allwinner-a10
          qemu-system-arm: -device allwinner-a10: Unsupported NIC model: xgmac
          $ qemu-system-arm -M highbank -net nic,model=allwinner-emac -device allwinner-a10
          qemu-system-arm: Unsupported NIC model: allwinner-emac

      Mark the mistake with a FIXME comment.

      Cc: Li Guang <lig.fnst@cn.fujitsu.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d71b22bb6ae281e66dfa17733105468f830a8c6a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 09:29:20 2015 +0100

      hw: Mark devices picking up char backends actively FIXME

      Character devices defined with -serial and -parallel are for board
      initialization to wire up.  Board code examines serial_hds[] and
      parallel_hds[] to find them, and creates devices with their qdev
      chardev properties set accordingly.

      Except a few devices go on a fishing expedition for a suitable backend
      instead of exposing a chardev property for board code to set: they use
      serial_hds[] (often via qemu_char_get_next_serial()) or parallel_hds[]
      in their realize() or init() method to connect to a backend.

      Picking up backends that way works when the devices are created by
      board code.  But it's inappropriate for -device or device_add.  Not
      only is it inconsistent with how the other characrer device models
      work (they connect to a backend explicitly identified by a "chardev"
      property), it breaks when the backend has been picked up by the board
      or a previous -device / device_add already.

      Example:

          $ qemu-system-ppc64 -M bamboo -S -device i82378 -device pc87312 -device pc87312
          qemu-system-ppc64: -device pc87312: Property 'isa-parallel.chardev' can't take value 'parallel0', it's in use

      Mark them with suitable FIXME comments.

      Cc: Li Guang <lig.fnst@cn.fujitsu.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: Antony Pavlov <antonynpavlov@gmail.com>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: "Andreas Färber" <andreas.faerber@web.de>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit af9e40aa8f36e30e89f16323b3d341ee59309b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:03:13 2015 +0100

      hw: Mark devices picking up block backends actively FIXME

      Drives defined with if!=none are for board initialization to wire up.
      Board code calls drive_get() or similar to find them, and creates
      devices with their qdev drive properties set accordingly.

      Except a few devices go on a fishing expedition for a suitable backend
      instead of exposing a drive property for board code to set: they call
      driver_get() or drive_get_next() in their realize() or init() method
      to implicitly connect to the "next" backend with a certain interface
      type.

      Picking up backends that way works when the devices are created by
      board code.  But it's inappropriate for -device or device_add.  Not
      only is this inconsistent with how the other block device models work
      (they connect to a backend explicitly identified by a "drive"
      property), it breaks when the "next" backend has been picked up by the
      board already.

      Example:

          $ qemu-system-arm -S -M connex -pflash flash.img -device ssi-sd
          Aborted (core dumped)

      Mark them with suitable FIXME comments.

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: "Andreas Färber" <andreas.faerber@web.de>
      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 11f10cf8057dd5392171da061381f6c890b1e21d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 10:52:14 2015 +0100

      hw/arm/vexpress: Don't double-free flash filename

      Commits 6e05a12f8f7f and db25a1581 both attempt to fix the
      same "failed to free memory containing flash filename" bug,
      with the effect that when they were both applied we ended
      up freeing the memory twice. Delete the spurious extra free.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1427968334-14527-1-git-send-email-peter.maydell@linaro.org

  commit c408d27a42318227092128b04cca555f78cf703d
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu Apr 2 11:07:06 2015 +0800

      hw/arm/virt: Fix corruption due to double free

      As 4de9a88(hw/arm/virt: Fix memory leak reported by Coverity)
      and 6e05a12(arm: fix memory leak) both handle the memory leak
      reported by Coverity, this cause qemu corruption due to
      double free.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1427944026-8968-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 289494da25c5d6270e66a40267fd761ee8f54a90
  Merge: fde069f 25b9fb1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 18:13:21 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150401' into staging

      target-arm:
       * Fix broken migration on AArch64 KVM
       * Fix minor memory leaks in virt, vexpress, highbank
       * Honour requested filename when loading highbank rom image

      # gpg: Signature made Wed Apr  1 18:06:09 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150401:
        target-arm: kvm64 fix save/restore of SPSR regs
        target-arm: kvm64 sync FP register state
        hw/intc: arm_gic_kvm.c restore config first
        target-arm: kvm: save/restore mp state
        target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)
        hw/arm/virt: Fix memory leak reported by Coverity
        hw/arm/vexpress: Fix memory leak reported by Coverity
        hw/arm/highbank: Fix resource leak and wrong image loading

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25b9fb107bc1f6735fdb3fce537792f5db95f78d
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm64 fix save/restore of SPSR regs

      The current code was negatively indexing the cpu state array and not
      synchronizing banked spsr register state with the current mode's spsr
      state, causing occasional failures with migration.

      Some munging is done to take care of the aarch64 mapping and also to
      ensure the most current value of the spsr is updated to the banked
      registers (relevant for KVM<->TCG migration).

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0e4b586932768107448f342ae4a314beedfa8f11
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm64 sync FP register state

      For migration to work we need to sync all of the register state. This is
      especially noticeable when GCC starts using FP registers as spill
      registers even with integer programs.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 74fdb781c19ef4b781cb6fda48f1f9ebd11257fe
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      hw/intc: arm_gic_kvm.c restore config first

      As there is logic to deal with the difference between edge and level
      triggered interrupts in the kernel we must ensure it knows the
      configuration of the IRQs before we restore the pending state.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a1753f747544d20b999d466b1017721668bfb82
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm: save/restore mp state

      This adds the saving and restore of the current Multi-Processing state
      of the machine. While the KVM_GET/SET_MP_STATE API exposes a number of
      potential states for x86 we only use two for ARM. Either the process is
      running or not. We then save this state into the cpu_powered TCG state
      to avoid changing the serialisation format.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)

      The AArch64 SPSR_EL1 register is architecturally mandated to
      be mapped to the AArch32 SPSR_svc register. This means its
      state should live in QEMU's env->banked_spsr[1] field.
      Correct the various places in the code that incorrectly
      put it in banked_spsr[0].

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4de9a883be653f02f8c1d5dcd1066f614d9606b6
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/virt: Fix memory leak reported by Coverity

      As the conditional statement had to be split anyway, we can also
      add a better error report message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426877982-3603-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit db25a15817f98c46c5f0eea4f414249d8fbb96b1
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/vexpress: Fix memory leak reported by Coverity

      As the conditional statement had to be split anyway, we can also
      add a better error report message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426877963-3556-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 60ff4e63e2ea4738f114cbaf1f17e6e0184fc09c
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/highbank: Fix resource leak and wrong image loading

      Coverity reports a resource leak for sysboot_filename which is allocated
      by qemu_find_file.

      In addition, that name is used to get the size of the image, but a
      different image name was used to load it.

      In addition, instead of passing the maximum allowed image size the actual
      image size was passed to load_image_targphys.

      Fix all three issues.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426326781-2488-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fde069f751a9aa7e597c9d297a9995eca418a403
  Merge: b8a86c4 2cdb5e1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 17:18:51 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2015-1779-20150401-2' into staging

      vnc: fix websocket security issues (cve-2015-1779).

      # gpg: Signature made Wed Apr  1 16:14:34 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-cve-2015-1779-20150401-2:
        CVE-2015-1779: limit size of HTTP headers from websockets clients
        CVE-2015-1779: incrementally decode websocket frames

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2cdb5e142fb93e875fa53c52864ef5eb8d5d8b41
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Mon Mar 23 22:58:22 2015 +0000

      CVE-2015-1779: limit size of HTTP headers from websockets clients

      The VNC server websockets decoder will read and buffer data from
      websockets clients until it sees the end of the HTTP headers,
      as indicated by \r\n\r\n. In theory this allows a malicious to
      trick QEMU into consuming an arbitrary amount of RAM. In practice,
      because QEMU runs g_strstr_len() across the buffered header data,
      it will spend increasingly long burning CPU time searching for
      the substring match and less & less time reading data. So while
      this does cause arbitrary memory growth, the bigger problem is
      that QEMU will be burning 100% of available CPU time.

      A novnc websockets client typically sends headers of around
      512 bytes in length. As such it is reasonable to place a 4096
      byte limit on the amount of data buffered while searching for
      the end of HTTP headers.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2bebfd6e09d285aa793cae3fb0fc3a39a9fee6e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Mon Mar 23 22:58:21 2015 +0000

      CVE-2015-1779: incrementally decode websocket frames

      The logic for decoding websocket frames wants to fully
      decode the frame header and payload, before allowing the
      VNC server to see any of the payload data. There is no
      size limit on websocket payloads, so this allows a
      malicious network client to consume 2^64 bytes in memory
      in QEMU. It can trigger this denial of service before
      the VNC server even performs any authentication.

      The fix is to decode the header, and then incrementally
      decode the payload data as it is needed. With this fix
      the websocket decoder will allow at most 4k of data to
      be buffered before decoding and processing payload.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

      [ kraxel: fix frequent spurious disconnects, suggested by Peter Maydell ]

        @@ -361,7 +361,7 @@ int vncws_decode_frame_payload(Buffer *input,
        -        *payload_size = input->offset;
        +        *payload_size = *payload_remain;

      [ kraxel: fix 32bit build ]

        @@ -306,7 +306,7 @@ struct VncState
        -    uint64_t ws_payload_remain;
        +    size_t ws_payload_remain;

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b8a86c4ac4d04c106ba38fbd707041cba334a155
  Merge: 033a203 4025446
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 11:31:31 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Fix for object_del of in-use memory, pvpanic
      regression, PPC regression and bogus error message with
      Oxygen theme.

      # gpg: Signature made Wed Apr  1 09:08:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        Revert "exec: Respect as_tranlsate_internal length clamp"
        rcu: do not create thread in pthread_atfork callback
        pc: acpi: fix pvpanic regression
        hostmem: Prevent removing an in-use memory backend
        qom: Add can_be_deleted callback to UserCreatableClass

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4025446f0ac6213335c22ec43f3c3d8362ce7286
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 1 09:57:45 2015 +0200

      Revert "exec: Respect as_tranlsate_internal length clamp"

      This reverts commit c3c1bb99d1c11978d9ce94d1bdcf0705378c1459.
      It causes problems with boards that declare memory regions shorter
      than the registers they contain.

      Reported-by: Zoltan Balaton <balaton@eik.bme.hu>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a59629fcc6f603e19b516dc08f75334e5c480bd0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 13:01:05 2015 +0200

      rcu: do not create thread in pthread_atfork callback

      If QEMU forks after the CPU threads have been created, qemu_mutex_lock_iothread
      will not be able to do qemu_cpu_kick_thread.  There is no solution other than
      assuming that forks after the CPU threads have been created will end up in an
      exec.  Forks before the CPU threads have been created (such as -daemonize)
      have to call rcu_after_fork manually.

      Notably, the oxygen theme for GTK+ forks and shows a "No such process" error
      without this patch.

      This patch can be reverted once the iothread loses the "kick the TCG thread"
      magic.

      User-mode emulation does not use the iothread, so it can also call
      rcu_after_fork.

      Reported by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e65bef6954415b24ee17184b959333d9456bece8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Mar 30 14:18:27 2015 +0200

      pc: acpi: fix pvpanic regression

      Commit cd61cb2  pc: acpi-build: generate pvpanic device description dynamically

      introduced regression changing pvpanic device HID from
      QEMU0001 to QEMU0002.
      Fix AML generated code so that pvpanic device
      would keep its original HID. i.e. QEMU0001

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reported-by: Gal Hammer <ghammer@redhat.com>
      Message-Id: <1427717907-25027-1-git-send-email-imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 36bce5ca5da7a7dbdc5001dc65b40b7439472106
  Author: Lin Ma <lma@suse.com>
  Date:   Mon Mar 30 16:36:29 2015 +0800

      hostmem: Prevent removing an in-use memory backend

      showing a memory device whose memdev is removed leads an assert:

      (qemu) object_add memory-backend-ram,id=ram0,size=128M
      (qemu) device_add pc-dimm,id=d0,memdev=ram0
      (qemu) object_del ram0
      (qemu) info memory-devices
      **
      ERROR:qom/object.c:1274:object_get_canonical_path_component:\
                                  assertion failed: (obj->parent != NULL)
      Aborted

      The patch prevents removing an in-use mem backend and error out.

      Signed-off-by: Lin Ma <lma@suse.com>
      Message-Id: <1427704589-7688-3-git-send-email-lma@suse.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d6edb15576643ab348a9f73e115c2e037edf7460
  Author: Lin Ma <lma@suse.com>
  Date:   Mon Mar 30 16:36:28 2015 +0800

      qom: Add can_be_deleted callback to UserCreatableClass

      If backends implement the can_be_deleted and it returns false,
      Then the qmp_object_del won't delete the given backends.

      Signed-off-by: Lin Ma <lma@suse.com>
      Message-Id: <1427704589-7688-2-git-send-email-lma@suse.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 033a20359aaf93f4d8aa2be12558901e8e028baa
  Merge: 9e0ad34 a18bb41
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 12:12:22 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Fix for adding alias properties with [*]

      # gpg: Signature made Tue Mar 31 11:59:00 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qom: Fix object_property_add_alias() with [*]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a18bb417e954ceea0a30b46c38b0d58c3a7ca6a1
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Mar 27 17:34:10 2015 +0100

      qom: Fix object_property_add_alias() with [*]

      Commit 8074264 (qom: Add description field in ObjectProperty struct)
      introduced property descriptions and copied them for alias properties.

      Instead of using the caller-supplied property name, use the returned
      property name for setting the description. This avoids an Error when
      setting a property description for a property with literal "[*]" that
      doesn't exist due to automatic property naming in object_property_add().

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable@nongnu.org (v2.2+)
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 9e0ad3472dae5236052d455948396d8579bfc904
  Merge: adbeb45 6ca90ff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 10:55:33 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qtest-for-2.3' into staging

      QTest cleanups

      * Change fw_cfg-test and i440fx-test GTester paths
      * Extend libqtest API as necessary

      # gpg: Signature made Mon Mar 30 18:29:39 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qtest-for-2.3:
        i440fx-test: Fix test paths to include architecture
        qtest: Add qtest_add() wrapper macro
        qtest: Add qtest_add_data_func() wrapper function
        fw_cfg-test: Fix test path to include architecture

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adbeb458eece2263039e5a1f6501b87ae3713319
  Merge: d4892d9 f1fdaf5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 09:56:48 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150330' into staging

      TriCore bugfixes

      # gpg: Signature made Mon Mar 30 12:40:50 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150330:
        target-tricore: fix CACHEA/I_POSTINC/PREINC using data register..

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4892d935b035c2220827145524d0cf0573d1fea
  Merge: 627f91b fa92e21
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 30 22:55:51 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150330' into staging

      s390x fixes:
      - virtqueue index issues in virtio-ccw
      - cleanup and sign extension fix for the ipl device

      # gpg: Signature made Mon Mar 30 08:52:54 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150330:
        s390x/ipl: avoid sign extension
        s390x: do not include ram_addr.h
        virtio-ccw: range check in READ_VQ_CONF
        virtio-ccw: fix range check for SET_VQ

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6ca90ffeec8e3b4e306be32efd930d75a6d0b295
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 24 19:35:22 2015 +0100

      i440fx-test: Fix test paths to include architecture

      Replace g_test_add_func() with new qtest_add_func() and g_test_add()
      macro with qtest_add() macro. This effectively changes GTester paths:

        /i440fx/foo -> /x86_64/i440fx/foo etc.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 45b0f830dd1817277eeb97032ce64b3103fe0b6c
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Mar 25 16:52:45 2015 +0100

      qtest: Add qtest_add() wrapper macro

      It extends g_test_add() macro with the architecture path.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7949c0e39f7638a85515a1dcbd8bc96d13fca6de
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 24 19:33:34 2015 +0100

      qtest: Add qtest_add_data_func() wrapper function

      It calls g_test_add_data_func() with a path supplemented by the
      architecture, like qtest_add_func() does.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 53850b8894cfca3cbe405979ba8a55539cd17516
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 19 18:35:23 2015 +0100

      fw_cfg-test: Fix test path to include architecture

      Use qtest_add_func() instead of g_test_add_func() to reflect
      the architecture tested, changing GTester paths as follows:

        /fw_cfg/foo -> /x86_64/fw_cfg/foo etc.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f1fdaf552974ee2ef6ec1ba3cf1e18c2951533e1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Mar 27 14:55:22 2015 +0100

      target-tricore: fix CACHEA/I_POSTINC/PREINC using data register..

      ..for address calculation instead address registers.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit fa92e218df1d7fcc01e1e5d8bbd77acdaf53c18b
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Mar 26 10:41:45 2015 +0100

      s390x/ipl: avoid sign extension

      Make s390_update_iplstate() return uint32_t to avoid sign extensions
      for cssids > 127. While this doesn't matter in practice yet (as
      nobody supports MCSS-E and thus won't see the real cssid), play safe.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f65025caab916aa8a5b8de270a59078e0b6e2866
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 15:56:29 2015 +0100

      s390x: do not include ram_addr.h

      ram_addr.h is an internal interface and it is not needed anyway by
      hw/s390x/ipl.c.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1427295389-5054-1-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d03a363054f1cc58d4e6653ff09fbbe8121a0302
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 13:16:20 2015 +0100

      virtio-ccw: range check in READ_VQ_CONF

      Processing for READ_VQ_CONF needs to check whether the requested queue
      value is actually in the supported range and post a channel program
      check if not.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 590fe5722b522e492a9c78adadae4def35b137dd
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 13:08:36 2015 +0100

      virtio-ccw: fix range check for SET_VQ

      VIRTIO_PCI_QUEUE_MAX is already too big; a malicious guest would be
      able to trigger a write beyond the VirtQueue structure.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 627f91b1f80fecc73d00727181a9ddb6162cc30e
  Merge: b27e767 fc3d8e1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Mar 28 10:10:04 2015 +0000

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Mar 27 22:19:31 2015 GMT using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        AHCI: Protect cmd register
        AHCI: Do not (re)map FB/CLB buffers while not running

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc3d8e1138cd0c843d6fd75272633a31be6554ef
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Mar 27 15:48:11 2015 -0400

      AHCI: Protect cmd register

      Many bits in the CMD register are supposed to be strictly read-only.
      We should not be deleting them on every write.

      As a side-effect: pay explicit attention to when a guest marks off
      the FIS Receive or Start bits, and disable the status bits ourselves,
      instead of letting them implicitly fall off.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426283454-15590-3-git-send-email-jsnow@redhat.com

  commit a13ab5a35bc0435fcfdacb3e171ceedcc077573d
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Mar 27 15:48:11 2015 -0400

      AHCI: Do not (re)map FB/CLB buffers while not running

      The FIS Receive Buffer and Command List Buffer pointers
      should not be edited while the FIS receive engine or
      Command Receive engines are running.

      Currently, we attempt to re-map the buffers every time they
      are adjusted, but while the AHCI engines are off, these registers
      may contain stale values, so we should not attempt to re-map these
      values until the engines are reactivated.

      Reported-by: Jordan Hargrave <jharg93@gmail.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426283454-15590-2-git-send-email-jsnow@redhat.com

  commit b27e767e8c8d56cb7c9d0b78eadd89521bdf836c
  Merge: 500d76a 4e60a25
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 27 12:12:27 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri Mar 27 11:59:41 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        hw/net/e1000: fix integer endianness

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 500d76a093b81f0aa9a368039518ab333d5dbf7a
  Merge: 4ad9e2b da2cf4e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 27 10:30:48 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri Mar 27 10:13:35 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block: Document blockdev-add's immaturity
        qemu-iotests: Test unaligned 4k zero write
        block: Fix unaligned zero write
        nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e60a250d395ef0d04eb8b6489cc5f7615a8909b
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Fri Mar 13 13:21:59 2015 +0800

      hw/net/e1000: fix integer endianness

      It's detected by coverity.In is_vlan_packet s->mac_reg[VET] is
      unsigned int but is dereferenced as a narrower unsigned short.
      This may lead to unexpected results depending on machine
      endianness.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1426224119-8352-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da2cf4e80355e42fbaeb8bcfa2b07f5bceddd323
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 20 14:32:17 2015 +0100

      block: Document blockdev-add's immaturity

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426858337-21423-1-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 61815d6e0aa1a549ad55f6621b6816aa6b1ab757
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Mar 24 09:23:50 2015 +0800

      qemu-iotests: Test unaligned 4k zero write

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427160230-4489-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Mar 24 09:23:49 2015 +0800

      block: Fix unaligned zero write

      If the zero write is not aligned, bdrv_co_do_pwritev will segfault
      because of accessing to the NULL qiov passed in by bdrv_co_write_zeroes.
      Fix this by allocating a local qiov in bdrv_co_do_pwritev if the request
      is not aligned. (In this case the padding iovs are necessary anyway, so
      it doesn't hurt.)

      Also add a check at the end of bdrv_co_do_pwritev to clear the zero flag
      if padding is involved.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427160230-4489-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2115f2a1d8c77c2a735add1ed02ae0c1feae0d9a
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 17:00:44 2015 +0100

      nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

      The shift operation on nlb gives a 32 bit result if no type cast is
      applied. This bug was reported by Coverity.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426348844-8793-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4ad9e2b36e1e00fe5b96c3448ecd673e11c4d6d8
  Merge: f75d4f8 4cdfc93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 18:35:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150326-1' into staging

      gtk: do not call gtk_widget_get_window if drawing area is not initialized

      # gpg: Signature made Thu Mar 26 16:59:55 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150326-1:
        gtk: do not call gtk_widget_get_window if drawing area is not initialized

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f75d4f82950c9e74c7202081f1cb97ae94b7c7d8
  Merge: 896848f 4020db0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 17:33:35 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Bugfixes and making SCSI adapters IOMMU-friendly.

      # gpg: Signature made Thu Mar 26 13:24:05 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring
        misc: fix typos in copyright declaration
        exec: avoid possible overwriting of mmaped area in qemu_ram_remap
        sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        nbd: Fix up comment after commit e140177
        vmw_pvscsi: use PCI DMA APIs
        megasas: use PCI DMA APIs
        cpus: Don't kick un-realized cpus.
        i6300esb: Fix signed integer overflow
        i6300esb: Correct endiannness
        fw_cfg: factor out initialization of FW_CFG_ID (rev. number)
        rcu tests: fix compilation on 32-bit ppc

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 896848f0d3e2393905845ef2b244bb2601f9df0c
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Thu Mar 26 16:56:25 2015 +0100

      seccomp: libseccomp version varying according to arch

      Libseccomp dependency was mandating version 2.2.0 on all architectures
      and this was causing configure and virt-test to break on non-updates
      distros. This patch works-around it and give a more flexible way to
      check the version, giving more time for other distros to update
      libseccomp version.

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Reported-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Tested-by: Juan Quintela <quintela@redhat.com>
      Message-id: 1427385385-30571-1-git-send-email-eduardo.otubo@profitbricks.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4cdfc93526364bc9b20a21c9edd802d737cec85f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Tue Mar 24 20:08:48 2015 +0100

      gtk: do not call gtk_widget_get_window if drawing area is not initialized

      This prevents gtk_widget_get_window to return a NULL pointer.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 99b7f47c54ae7932715a1f58ed9a128451fb2b85
  Merge: 1ee76e5 43edc0e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 14:47:53 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150326' into staging

      migration/next for 20150326

      # gpg: Signature made Thu Mar 26 14:31:55 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150326:
        migration:  remove last_sent_block from save_page_header
        rdma: Fix cleanup in error paths
        Avoid crashing on multiple -incoming

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43edc0ed11a4d25f2fe67bb9d89a8a6a0a43b1e0
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Mar 17 12:56:13 2015 +0100

      migration:  remove last_sent_block from save_page_header

      Compression code (still not on tree) want to call this funtion from
      outside the migration thread, so we can't write to last_sent_block.

      Instead of reverting full patch:

      [PULL 07/11] save_block_hdr: we can recalculate

      Just revert the parts that touch last_sent_block.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 80b262e1439a22708e1c535b75363d4b90c3b41d
  Author: Padmanabh Ratnakar <padmanabh.ratnakar@Emulex.Com>
  Date:   Thu Mar 26 07:38:04 2015 +0530

      rdma: Fix cleanup in error paths

      As part of commit e325b49a320b493cc5d69e263751ff716dc458fe,
      order in which resources are destroyed was changed for fixing
      a seg fault. Due to this change, CQ will never get destroyed as
      CQ should be destroyed after QP destruction. Seg fault is caused
      improper cleanup when connection fails. Fixing cleanup after
      connection failure and order in which resources are destroyed
      in qemu_rdma_cleanup() routine.

      Signed-off-by: Meghana Cheripady <meghana.cheripady@emulex.com>
      Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7c76235a3e6e24f596ab4b157157bd62f44b80f5
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:16:06 2015 +0000

      Avoid crashing on multiple -incoming

      Passing multiple -incoming options used to crash qemu (due to
      an invalid state transition incoming->incoming).  Instead we now
      take the last -incoming option, e.g.:

      qemu-system-x86_64 -nographic -incoming tcp::4444 -incoming defer

      ends up doing the defer.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1ee76e5191e4275bf2f7ad251385c96d6ce47b86
  Merge: 087c4c9 c6e7650
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 13:30:41 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for 2.3 ppc - 2015-03-25

      Just a few bug fixes before 2.3 gets released:

        - pseries: Firmware update, bugfixes
        - remove POWER5+ v0.0 that we incorrectly introduced in 2.3
        - Fix -machine usb=no
        - Fix -boot once=foo in pseries
        - Add NULL pointer check in pseries machine init

      # gpg: Signature made Wed Mar 25 21:53:20 2015 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream:
        powerpc: fix -machine usb=no for newworld and pseries machines
        PPC: pseries: Implement boot once=foo
        target-ppc: Remove POWER5+ v0.0 that never existed
        spapr: Add missing checks for NULL pointers and report failures
        pseries: Update SLOF firmware image to qemu-slof-20150313

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4020db0475b3e527b3bdc97dff873c2be9da2698
  Author: Ting Wang <kathy.wangting@huawei.com>
  Date:   Thu Mar 26 15:42:32 2015 +0800

      virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring

      VirtIOSCSIVring which allocated in virtio_scsi_vring_init
      should be free when dataplane has been stopped or failed to start.

      Signed-off-by: Ting Wang <kathy.wangting@huawei.com>
      Message-Id: <1427355752-25844-1-git-send-email-kathy.wangting@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fe75270cb619549b2aa1ba59bd202faf306204a1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 26 20:57:43 2015 +0800

      misc: fix typos in copyright declaration

      Add a space after comma.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1427374663-10168-1-git-send-email-arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 087c4c9419d3086ac0a920899e4fed8ceaf9bb2b
  Merge: 37a518a 7e0e736
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 12:18:44 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, virtio bugfixes for 2.3

      Several bugfixes, nothing stands out especially.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 25 12:42:10 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio-net: validate backend queue numbers against bus limitation
        virtio-serial: fix virtio config size
        acpi: Add missing GCC_FMT_ATTR to local function

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 37a518ae5dc22415a642ce05423d71f8d7b25cac
  Merge: 054903a 8e27fc2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 11:10:54 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150325' into staging

      seccomp branch queue

      # gpg: Signature made Wed Mar 25 10:09:29 2015 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150325:
        seccomp: update libseccomp version and remove arch restriction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f18c69cfc554cf9776eb3c35b7510e17541afacb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 14:14:56 2015 +0100

      exec: avoid possible overwriting of mmaped area in qemu_ram_remap

      It is not necessary to munmap an area before remapping it with MAP_FIXED;
      if the memory region specified by addr and len overlaps pages of any
      existing mapping, then the overlapped part of the existing mapping will
      be discarded.

      On the other hand, if QEMU does munmap the pages, there is a small
      probability that another mmap sneaks in and catches the just-freed
      portion of the address space.  In effect, munmap followed by
      mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it
      as such.  Fix it.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c6e765035bc5e0d73231c2c0fbd54620201d6655
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 18:05:28 2015 +0100

      powerpc: fix -machine usb=no for newworld and pseries machines

      Capture the explicit setting of "usb=no" into a separate bool, and
      use it to skip the update of machine->usb in the board init function.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5b2128d27051fe036ac36e8e860e72490b27a369
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Mar 18 13:30:44 2015 +0100

      PPC: pseries: Implement boot once=foo

      On sPAPR we haven't supported boot once ever since it emerged, but
      recently grew need for it. This patch implements boot once logic
      to it.

      While at it, we also move to the new bootdevice handling that got
      introduced to the tree recently.

      Reported-by: Dinar Valeev <dvaleev@suse.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fda276c7aafe2bfc9df808e61abd25cb834a0254
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Wed Mar 18 14:11:21 2015 +1100

      target-ppc: Remove POWER5+ v0.0 that never existed

      IBM uses low 16bits to specify the chip version of a POWER CPU.
      So there has never been an actual silicon with PVR = 0x003B0000.
      The first silicon would have PVR 0x003B0100 but it is very unlikely
      to find it in any machine shipped to any customer as it was too raw.

      This removes CPU_POWERPC_POWER5P_v00 definition and changes
      POWER5+ and POWERgs aliases (which are synonyms) to point to
      POWER5+_v2.1 which can still be found in real machines.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      [agraf: fix commit message]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4c56440d6754b45c2d82969e029a3c2a72864b30
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 16:29:09 2015 +0100

      spapr: Add missing checks for NULL pointers and report failures

      This fixes potential runtime crashes and two warnings from Coverity.

      The new error message does not add  a prefix "qemu:" because that is
      already done in function hw_error. It also starts with an uppercase
      letter because that seems to be the mostly used form.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      [agraf: fix typo]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0d2f830255c758240dccbeb732a2c21f4eea995c
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Mar 13 22:45:13 2015 +1100

      pseries: Update SLOF firmware image to qemu-slof-20150313

      The changelog is:
        > virtio: Fix vring allocation
        > helpers: Fix SLOF_alloc_mem_aligned to meet callers expectation
        > Set default palette according to "16-color Text Extension" document
        > Fix rectangle drawing functions to work also with higher bit depths
        > Fix the x86emu patch file
        > Silence compiler warning when building the biosemu
        > Use device-type Forth word to set up the corresponding property
        > Improve /openprom node
        > pci-properties: Remove redundant call to device-type
        > cas: reconfigure memory nodes
        > pci: use 64bit bar ranges

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8e7ba4ed3a0b68ab35736c7859fd950f6705e0cf
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 22:30:13 2015 +0100

      sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH7o8uA59Ep0n41i0M19VFWa73n9m172j2W3fjz6=PSVBA@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6a926fbc6fff58598cce9404019204090a8e8361
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 22:28:15 2015 +0100

      mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH4-=HJUvwBu+2o6jGanJesJOyNf3sL8-5+d_-6C3cWBfA@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1d5bfde1b978b57156d851d140b99eac8b2adbe4
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 23:11:03 2015 +0100

      m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH6X-GsT1AA8kEtP_e7oZWGZgi=fCcDfSs3wLgJN30DbUw@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7e0e736ecdfeac6d3517513d3a702304e4f6cf59
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Mar 20 14:07:50 2015 +0800

      virtio-net: validate backend queue numbers against bus limitation

      We don't validate the backend queue numbers against bus limitation,
      this will easily crash qemu if it exceeds the limitation which will
      hit the abort() in virtio_del_queue(). An example is trying to
      starting a virtio-net device with 256 queues. E.g:

      ./qemu-system-x86_64 -netdev tap,id=hn0,queues=256 -device
      virtio-net-pci,netdev=hn0

      Fixing this by doing the validation and fail early.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7976a6d23151c780474bdac106f3cf1343a2d6ca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 25 12:33:55 2015 +0100

      virtio-serial: fix virtio config size

      commit 9b70c1790acacae54d559d38ca69186a85040bb8
          virtio-serial: switch to standard-headers

      changes virtio_console_config size from 8 to 12 bytes:
      it adds an optional 4 byte emerg_wr field.

      As this crosses a power of two boundary, this changes the PCI BAR size,
      which breaks migration compatibility with old qemu machine types.
      It's probably a problem for other transports as well.

      As a temporary fix, as we don't yet support this new field anyway,
      simply make the config size smaller at init time.

      Long terms we probably want something along the lines
      of virtio_net_set_config_size.

      Reported-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Cole Robinson <crobinso@redhat.com>

  commit c167e2e7eda609bbbb58650c1b82e8168106e40e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Mar 20 18:11:58 2015 +0100

      acpi: Add missing GCC_FMT_ATTR to local function

      This fixes these gcc warnings (not enabled in default build):

      hw/acpi/aml-build.c:83:5: warning:
       function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]
      hw/acpi/aml-build.c:88:5: warning:
       function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 78fa62ff1bc0d66f0115b7147c4eb260ad22022a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 09:18:48 2015 +0100

      nbd: Fix up comment after commit e140177

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1427271528-11624-1-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0dc40f28518dee8aa95abd330a53f06179e71995
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 17:28:13 2015 +0100

      vmw_pvscsi: use PCI DMA APIs

      It is wrong to use address_space_memory directly, because there could be an
      IOMMU in the middle.  Passing the entire PVSCSIRingInfo to RS_GET_FIELD
      and RS_SET_FIELD makes it easy to go back to the PVSCSIState.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 16578c6ffe8c4ee5207ccb9b0c994c1b18bb322d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 17:15:17 2015 +0100

      megasas: use PCI DMA APIs

      It is wrong to use address_space_memory directly, because there could be an
      IOMMU in the middle.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdd459a00a206772185970efbc38c455dc43167e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 23 03:48:09 2015 -0700

      cpus: Don't kick un-realized cpus.

      following a464982499b2f637f6699e3d03e0a9d2e0b5288b, it's now possible for
      there to be attempts to take the BQL before CPUs have been realized in
      cases where a machine model inits peripherals before the first CPU.

      BQL lock aquisition kicks the first_cpu, leading to a segfault if this
      happens pre-realize. Guard the CPU kick routine to perform no action for
      a CPU that doesn't exist or doesn't have a thread yet.

      There was a fix to this with commit
      6b49809c597331803ea941eadda813e5bb4e8fe2, but the check there misses
      the case where the CPU has been inited and not realized. Strengthen the
      check to make sure that the first_cpu has a thread (i.e. it is
      realized) before allowing the kick.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1427107689-6946-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4bc7b4d56657ebf75b986ad46e959cf7232ff26a
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Mar 23 12:51:48 2015 +1100

      i6300esb: Fix signed integer overflow

      If the guest programs a sufficiently large timeout value an integer
      overflow can occur in i6300esb_restart_timer().  e.g. if the maximum
      possible timer preload value of 0xfffff is programmed then we end up with
      the calculation:

      timeout = get_ticks_per_sec() * (0xfffff << 15) / 33000000;

      get_ticks_per_sec() returns 1000000000 (10^9) giving:

           10^9 * (0xfffff * 2^15) == 0x1dcd632329b000000 (65 bits)

      Obviously the division by 33MHz brings it back under 64-bits, but the
      overflow has already occurred.

      Since signed integer overflow has undefined behaviour in C, in theory this
      could be arbitrarily bad.  In practice, the overflowed value wraps around
      to something negative, causing the watchdog to immediately expire, killing
      the guest, which is still fairly bad.

      The bug can be triggered by running a Linux guest, loading the i6300esb
      driver with parameter "heartbeat=2046" and opening /dev/watchdog.  The
      watchdog will trigger as soon as the device is opened.

      This patch corrects the problem by using muldiv64(), which effectively
      allows a 128-bit intermediate value between the multiplication and
      division.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1427075508-12099-3-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 06b82e2d8ead4d1f9441dbf2b03c31369a8f27bd
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Mar 23 12:51:47 2015 +1100

      i6300esb: Correct endiannness

      The IO operations for the i6300esb watchdog timer are marked as
      DEVICE_NATIVE_ENDIAN.  This is not correct, and - as a PCI device - should
      be DEVICE_LITTLE_ENDIAN.

      This allows i6300esb to work on ppc targets (yes, using an Intel ICH
      derived device on ppc is a bit odd, but the driver exists on the guest
      and there's no more obviously suitable watchdog device).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1427075508-12099-2-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a5c76baf312d83cb77c8faa72c5f7a477effed0
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Thu Mar 19 14:20:44 2015 -0400

      fw_cfg: factor out initialization of FW_CFG_ID (rev. number)

      The fw_cfg documentation says this of the revision key (0x0001, FW_CFG_ID):

      > A 32-bit little-endian unsigned int, this item is used as an interface
      > revision number, and is currently set to 1 by all QEMU architectures
      > which expose a fw_cfg device.

      arm/virt doesn't.  It could be argued that that's an error in
      "hw/arm/virt.c"; on the other hand, all of the other fw_cfg providing
      boards set the interface version to 1 manually, despite the device
      coming from the same, shared implementation. Therefore, instead of
      adding

          fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1);

      to arm/virt, consolidate all such existing calls in the fw_cfg
      initialization code.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Message-Id: <1426789244-26318-1-git-send-email-somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8a5956ad6392f115521dad774055c737c49fb0dd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Mar 21 16:32:05 2015 +0100

      rcu tests: fix compilation on 32-bit ppc

      32-bit PPC cannot do atomic operations on long long.  Inside the loops,
      we are already using local counters that are summed at the end of
      the run---with some exceptions (rcu_stress_count for rcutorture,
      n_nodes for test-rcu-list): fix them to use the same technique.
      For test-rcu-list, remove the mostly unused member "val" from the
      list.  Then, use a mutex to protect the global counts.

      Performance does not matter there because every thread will only enter
      the critical section once.

      Remaining uses of atomic instructions are for ints or pointers.

      Reported-by: Andreas Faerber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8e27fc200457e3f2473d0069263774d4ba17bd85
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Tue Mar 17 12:03:30 2015 +0100

      seccomp: update libseccomp version and remove arch restriction

      Libseccomp version updated to 2.2.0 and arch restriction to x86/x86_64
      is now removed. It's supposed to work on armv7l as well.

      Related bug: https://bugs.launchpad.net/qemu/+bug/1363641

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit 054903a832b865eb5432d79b5c9d1e1ff31b58d7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 24 16:34:16 2015 +0000

      Update version for v2.3.0-rc1 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 549c4e49788bbb16bdac3fb5480a2177019899e2
  Merge: 362ca92 f69c24e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 24 09:52:19 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150324' into staging

      TriCore bugfixes for 2.3-rc1

      # gpg: Signature made Tue Mar 24 08:48:33 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150324:
        target-tricore: properly fix dvinit_b/h_13
        target-tricore: fix RRPW_DEXTR using wrong reg
        target-tricore: fix DVINIT_HU/BU calculating overflow before result
        target-tricore: Fix two helper functions (clang warnings)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f69c24e4584f2161f90ee7caba38728aa77f937f
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Mar 23 18:24:42 2015 +0100

      target-tricore: properly fix dvinit_b/h_13

      The TriCore documentation was wrong on how to calculate ovf bits for those two
      instructions, which I confirmed with real hardware (TC1796 chip). An ovf
      actually happens, if the result (without remainder) does not fit into 8/16 bits.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 00e1754ff1f6294a29e08398a120663eac723216
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Feb 10 18:12:31 2015 +0000

      target-tricore: fix RRPW_DEXTR using wrong reg

      RRPW_DEXTR used r1 for the low part and r2 for the high part. It should be the
      other way round. This also fixes that the result of the first shift was not
      saved in a temp and could overwrite registers that were needed for the second
      shift.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 2b9d09bb3c44de934de03864d56ddd8a38ed863a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Mar 19 15:36:14 2015 +0000

      target-tricore: fix DVINIT_HU/BU calculating overflow before result

      dvinit_hu/bu for ISA v1.3 calculate the higher part of the result, that is needed
      for the overflow bits, after calculating the overflow bits.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 30a0d72f949fc46e54a180cf703e89b6d3df157d
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 15:43:32 2015 +0100

      target-tricore: Fix two helper functions (clang warnings)

      clang report:

      target-tricore/op_helper.c:1247:24: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1248:25: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1249:19: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1297:24: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1298:25: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1299:19: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]

      Fix also the divisor which was taken from the wrong register
      (thanks to Peter Maydell for this hint).

      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1425739412-8144-1-git-send-email-sw@weilnetz.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 362ca922eea03240916287a8a6267801ab095d12
  Merge: e7aab6d 54fced0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 23 17:02:12 2015 +0000

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Mon Mar 23 16:51:45 2015 GMT using RSA key ID AAFC390E
      # gpg: Can't check signature: public key not found

      * remotes/jnsnow/tags/ide-pull-request:
        ahci-test: improve rw buffer patterns
        ahci: Fix sglist offset manipulation for BE machines
        ide: fix cmd_read_pio when nsectors > 1
        ide: fix cmd_write_pio when nsectors > 1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54fced034e4d32d8ba6d1e27ecb7e2e2fb2f45d4
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:16 2015 -0400

      ahci-test: improve rw buffer patterns

      My pattern was cyclical every 256 bytes, so it missed a fairly obvious
      failure case. Add some rand() pepper into the test pattern, and for large
      patterns that exceed 256 sectors, start writing an ID per-sector so that
      we never generate identical sector patterns.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-5-git-send-email-jsnow@redhat.com

  commit ac38123609742ce3fbdf53774a797ac230cbf118
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:15 2015 -0400

      ahci: Fix sglist offset manipulation for BE machines

      This does not bother DMA, because DMA generally transfers
      the entire SGList in one shot if it can.

      PIO, on the other hand, tries to transfer just one sector
      at a time, and will make multiple visits to the sglist
      to fetch memory addresses.

      Fix the memory address calculaton when we have an offset
      by moving the offset addition OUTSIDE of the le64_to_cpu
      calculation.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-4-git-send-email-jsnow@redhat.com

  commit dd0bf7baab2201bd8f834be9eb87766662f50b19
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:14 2015 -0400

      ide: fix cmd_read_pio when nsectors > 1

      Similar to the cmd_write_pio fix, update the nsector count and
      ide sector before we invoke ide_transfer_start.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-3-git-send-email-jsnow@redhat.com

  commit 6aff22c013ab6f5f711665e7031fd555086d4464
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:13 2015 -0400

      ide: fix cmd_write_pio when nsectors > 1

      We need to adjust the sector being written to
      prior to calling ide_transfer_start, otherwise
      we'll write to the same sector again.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-2-git-send-email-jsnow@redhat.com

  commit e7aab6d6e3f6c29406e77210b9d8654e4d11340b
  Merge: 3c6c9fe 61c7480
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 23 15:11:29 2015 +0000

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150323' into staging

      linux-user patches for 2.3-rc1

      # gpg: Signature made Mon Mar 23 13:51:56 2015 GMT using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150323:
        linux-user: fix broken cpu_copy()
        linux-user: fix emulation of splice syscall
        linux-user/main.c: Remove redundant end_exclusive() in arm_kernel_cmpxchg64_helper()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 61c7480fa36775cc2baa2f8141f0c64a15f827b5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 23 12:55:52 2015 +0000

      linux-user: fix broken cpu_copy()

      New threads always point at the same env which is incorrect and usually
      leads to a crash.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 17644b362746c400f45b0d2b0a3ce8a52fed13fb
  Author: Andreas Schwab <schwab@suse.de>
  Date:   Tue Mar 10 17:11:35 2015 +0100

      linux-user: fix emulation of splice syscall

      The second and fourth argument are in/out parameters, store them back
      after the syscall.  Also, the fourth argument was mishandled, and EFAULT
      handling was missing.

      Signed-off-by: Andreas Schwab <schwab@suse.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 92bed463d12ab9e1e34cdd44673ab9c4315ad1d2
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 19:03:29 2015 +0800

      linux-user/main.c: Remove redundant end_exclusive() in arm_kernel_cmpxchg64_helper()

      start/end_exclusive() need be pairs, except the start_exclusive() in
      stop_all_tasks() which is only used by force_sig(), which will be abort.
      So at present, start_exclusive() in stop_all_task() need not be paired.

      queue_signal() may call force_sig(), or return after kill pid (or queue
      signal). If could return from queue_signal(), stop_all_task() would not
      be called in time, the next end_exclusive() would be issue.

      So in arm_kernel_cmpxchg64_helper() for ARM, need remove end_exclusive()
      after queue_signal(). The related commit: "97cc756 linux-user: Implement
      new ARM 64 bit cmpxchg kernel helper".

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 3c6c9fe034c0c07b77f272e4a53d7735220a16a4
  Merge: 4eef864 a356850
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 12:26:09 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue 2015-03-19

      # gpg: Signature made Thu Mar 19 19:40:17 2015 GMT using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Haswell-noTSX and Broadwell-noTSX
        Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell"

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4eef86486d4090d7587e94d3f1a2203b94899989
  Merge: e7e9b49 549fc54
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 10:37:03 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/work/numa-verify-cpus-pull-request' into staging

      NUMA queue 2015-03-19

      # gpg: Signature made Thu Mar 19 19:25:53 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/work/numa-verify-cpus-pull-request:
        numa: Print warning if no node is assigned to a CPU
        pc: fix default VCPU to NUMA node mapping
        numa: introduce machine callback for VCPU to node mapping
        numa: Reject configuration if CPU appears on multiple nodes
        numa: Reject CPU indexes > max_cpus
        numa: Fix off-by-one error at MAX_CPUMASK_BITS check

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e7e9b49f8e9ea4c5c9d07f6d8c9071c64dae816a
  Merge: 3e5f623 4e289b1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 09:50:08 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150320-1' into staging

      usb: bugfix collection.

      # gpg: Signature made Fri Mar 20 07:51:19 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150320-1:
        ehci: fix segfault when hot-unplugging ehci controller
        ohci: fix resource cleanup leak
        uhci: fix segfault when hot-unplugging uhci controller
        hw/usb: Include USB files only if necessary
        usb/dev-storage: Avoid qerror_report_err() outside QMP handlers
        usb/dev-storage: Fix QMP device_add missing encryption key failure
        monitor usb: Inline monitor_read_bdrv_key_start()'s first part
        monitor: Plug memory leak in monitor_read_bdrv_key_start()
        monitor: Drop dead QMP check from monitor_read_password()
        uhci: Convert to realize
        ohci: Complete conversion to realize
        usb: Improve companion configuration error messages
        usb: Propagate errors through usb_register_companion()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e289b1b62c8e271e3400317b4c3d98909093bc4
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:47 2015 +0800

      ehci: fix segfault when hot-unplugging ehci controller

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Reported-by: Lidonglin <lidonglin@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88dd1b8d0063ff16c54dc19c8b52508a00108f50
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:48 2015 +0800

      ohci: fix resource cleanup leak

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Ohci does't support hotplugging/hotunplugging yet, but
      existing resource cleanup leak logic likes ehci/uhci.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 537e572a7f807d7371a73ea5ffd9ce8d2487ff0c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:46 2015 +0800

      uhci: fix segfault when hot-unplugging uhci controller

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Reported-by: Lidonglin <lidonglin@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a356850b80b3d13b2ef737dad2acb05e6da03753
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Mar 13 15:58:09 2015 -0300

      target-i386: Haswell-noTSX and Broadwell-noTSX

      With the Intel microcode update that removed HLE and RTM, there will be
      different kinds of Haswell and Broadwell CPUs out there: some that still
      have the HLE and RTM features, and some that don't have the HLE and RTM
      features. On both cases people may be willing to use the pc-*-2.3
      machine-types.

      So, to cover both cases, introduce Haswell-noTSX and Broadwell-noTSX CPU
      models, for hosts that have Haswell and Broadwell CPUs without TSX support.

      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 1ee9159882f6687d6bc1f2207e97ada1eeccaa7c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Mar 13 15:39:43 2015 -0300

      Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell"

      This reverts commit 13704e4c455770d500d6b87b117e32f0d01252c9.

      With the Intel microcode update that removed HLE and RTM, there will be
      different kinds of Haswell and Broadwell CPUs out there: some that still
      have the HLE and RTM features, and some that don't have the HLE and RTM
      features. On both cases people may be willing to use the pc-*-2.3
      machine-types.

      So instead of making the CPU model results confusing by making it depend
      on the machine-type, keep HLE and RTM on the existing Haswell and
      Broadwell CPU models. The plan is to introduce "Haswell-noTSX" and
      "Broadwell-noTSX" CPU models later, for people who have CPUs that don't
      have TSX feature available.

      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 549fc54b8cfe16a475d8f6b8f838e53b45452b4a
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:35:04 2015 -0200

      numa: Print warning if no node is assigned to a CPU

      We need all possible CPUs (including hotplug ones) to be present in the
      SRAT when QEMU starts. QEMU already does that correctly today, the only
      problem is that when a CPU is omitted from the NUMA configuration, it is
      silently assigned to node 0.

      Check if all CPUs up to max_cpus are present in the NUMA configuration
      and warn about missing CPUs.

      Make it just a warning, to allow management software to be updated if
      necessary. In the future we may make it a fatal error instead.

      Command-line examples:

      * Correct, no warning:

        $ qemu-system-x86_64 -smp 2,maxcpus=4
        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0-3

      * Incomplete, with warnings:

        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0
        qemu-system-x86_64: warning: CPU(s) not present in any NUMA nodes: 1 2 3
        qemu-system-x86_64: warning: All CPU(s) up to maxcpus should be described in NUMA config

        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0-2
        qemu-system-x86_64: warning: CPU(s) not present in any NUMA nodes: 3
        qemu-system-x86_64: warning: All CPU(s) up to maxcpus should be described in NUMA config

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      ---
      v1 -> v2: (no changes)

      v2 -> v3:
       * Use enumerate_cpus() and error_report() for error message
       * Simplify logic using bitmap_full()

      v3 -> v4:
       * Clarify error message, mention that all CPUs up to
         maxcpus need to be described in NUMA config

      v4 -> v5:
       * Commit log update, to make problem description clearer

  commit fb43b73b9225ff2d19cf5350c68112aade7eec13
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Thu Mar 19 17:09:22 2015 +0000

      pc: fix default VCPU to NUMA node mapping

      Since commit
         dd0247e0 pc: acpi: mark all possible CPUs as enabled in SRAT
      Linux kernel actually tries to use CPU to Node mapping from
      QEMU provided SRAT table instead of discarding it, and that
      in some cases breaks build_sched_domains() which expects
      sane mapping where cores/threads belonging to the same socket
      are on the same NUMA node.

      With current default round-robin mapping of VCPUs to nodes
      guest ends-up with cores/threads belonging to the same socket
      being on different NUMA nodes.

      For example with following CLI:

         qemu-system-x86_64 -m 4G \
               -cpu Opteron_G3,vendor=AuthenticAMD \
               -smp 5,sockets=1,cores=4,threads=1,maxcpus=8 \
               -numa node,nodeid=0 -numa node,nodeid=1

      2.6.32 based kernels will hang on boot due to incorrectly built
      sched_group-s list in update_sd_lb_stats()

      Replacing default mapping with a manual, where VCPUs belonging to
      the same socket are on the same NUMA node, fixes the issue for
      guests which can't handle nonsense topology i.e. changing CLI to:
        -numa node,nodeid=0,cpus=0-3 -numa node,nodeid=1,cpus=4-7

      So instead of simply scattering VCPUs around nodes, provide
      callback to map the same socket VCPUs to the same NUMA node,
      which is what guests would expect from a sane hardware/BIOS.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 57924bcd87cb03cc21ebd7efed880d16ca048dce
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Thu Mar 19 17:09:21 2015 +0000

      numa: introduce machine callback for VCPU to node mapping

      Current default round-robin way of distributing VCPUs among
      NUMA nodes might be wrong in case on multi-core/threads
      CPUs. Making guests confused wrt topology where cores from
      the same socket are on different nodes.

      Allow a machine to override default mapping by providing
       MachineClass::cpu_index_to_socket_id()
      callback which would allow it group VCPUs from a socket
      on the same NUMA node.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3ef7197505e483e2f28c5fbd6ed54b4061221200
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:32:04 2015 -0200

      numa: Reject configuration if CPU appears on multiple nodes

      Each CPU can appear in only one NUMA node on the NUMA config. Reject
      configuration if a CPU appears in multiple nodes.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8979c945c1a7ffd20edbd5da2513c04baccfd7de
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:28:52 2015 -0200

      numa: Reject CPU indexes > max_cpus

      CPU index is always less than max_cpus, as documented at sysemu.h:

      > The following shall be true for all CPUs:
      >   cpu->cpu_index < max_cpus <= MAX_CPUMASK_BITS

      Reject configuration which uses invalid CPU indexes.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit ed26b92290768818371fbfd4317988eab6009ad5
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 12 15:23:48 2015 -0200

      numa: Fix off-by-one error at MAX_CPUMASK_BITS check

      Fix the CPU index check to ensure we don't go beyond the size of the
      node_cpu bitmap.

      CPU index is always less than MAX_CPUMASK_BITS, as documented at
      sysemu.h:

      > The following shall be true for all CPUs:
      >   cpu->cpu_index < max_cpus <= MAX_CPUMASK_BITS

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3e5f6234b4f45a11b7c357dde2d6da36641bc6f6
  Merge: 33a8d5b 5b347c5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 17:47:08 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3.0-rc1

      # gpg: Signature made Thu Mar 19 15:03:26 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block: Fix blockdev-backup not to use funky error class
        raw-posix: Deprecate aio=threads fallback without O_DIRECT
        raw-posix: Deprecate host floppy passthrough

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 33a8d5b72d63fe44f08614408284fa934dee1edd
  Merge: 7a9a5e7 4add73a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 16:46:32 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/vser-for-2.3-3' into staging

      virtio-serial api: guest_writable callback for users

      # gpg: Signature made Thu Mar 19 12:06:55 2015 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/vser-for-2.3-3:
        virtio: serial: expose a 'guest_writable' callback for users

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5b347c541017b9ced10e8e9bce02d25bcf04c7af
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 08:36:14 2015 +0100

      block: Fix blockdev-backup not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit
      b7b9d39..7c6a4ab added uses of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace
      them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7a9a5e72e8a62395649a46c53c3c224cc73ca52f
  Merge: d88aec8 8ce1ee4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 14:10:20 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-03-19' into staging

      trivial patches for 2015-03-19

      # gpg: Signature made Thu Mar 19 08:57:54 2015 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-03-19: (24 commits)
        qga/commands-posix: Fix resource leak
        elf-loader: Add missing error handling for call of lseek
        elf-loader: Fix truncation warning from coverity
        hmp: Fix texinfo documentation
        Fix typos in comments
        qtest/ahci: Fix a bit mask expression
        vl: fix resource leak with monitor_fdset_add_fd
        smbios: add max speed comdline option for type-17 (meory device) structure
        pc-dimm: Add description for device list.
        configure: enable kvm on x32
        error: Replace error_report() & error_free() with error_report_err()
        arm: fix memory leak
        qmp: Drop unused .user_print from command definitions
        hmp: Fix definition of command quit
        target-moxie: Fix warnings from Sparse (one-bit signed bitfield)
        block/qapi: Fix Sparse warning
        Fix remaining warnings from Sparse (void return)
        qom: Fix warning from Sparse
        target-mips: Fix warning from Sparse
        arm/nseries: Fix warnings from Sparse
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d88aec88cdd2cdb1939b88a8cdab0a5da3c4559b
  Merge: 1cfa7e0 0af7a37
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 13:04:07 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150318' into staging

      MIPS patches 2015-03-18

      Changes:
      * bug fixes

      # gpg: Signature made Wed Mar 18 10:06:00 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150318:
        target-mips: save cpu state before calling MSA load and store helpers
        target-mips: fix hflags modified in delay / forbidden slot
        target-mips: fix CP0.BadVAddr by stopping translation on Address Error

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1cfa7e0ab223198b8b5449508d37613003d954a4
  Merge: 2259c16 4a48aaa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 12:12:21 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150318-1' into staging

      vnc: fix websockets & QMP.

      # gpg: Signature made Wed Mar 18 13:12:35 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150318-1:
        ui: ensure VNC websockets server checks the ACL if requested
        ui: remove separate gnutls_session for websockets server
        ui: enforce TLS when using websockets server
        ui: fix setup of VNC websockets auth scheme with TLS
        ui: split setup of VNC auth scheme into separate method
        ui: report error if user requests VNC option that is unsupported
        ui: replace printf() calls with VNC_DEBUG
        ui: remove unused 'wiremode' variable in VncState struct
        vnc: Fix QMP change not to use funky error class

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4add73aa601ab42b7a9863d483fa313b06105b34
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Thu Jul 17 20:02:45 2014 +0530

      virtio: serial: expose a 'guest_writable' callback for users

      Users of virtio-serial may want to know when a port becomes writable.  A
      port can stop accepting writes if the guest port is open but not being
      read from.  In this case, data gets queued up in the virtqueue, and
      after the vq is full, writes to the port do not succeed.

      When the guest reads off a vq element, and adds a new one for the host
      to put data in, we can tell users the port is available for more writes,
      via the new ->guest_writable() callback.

      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 965182549cee6fa337f0e72cde4d5787f35f33ac
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Mar 17 13:45:21 2015 +0100

      raw-posix: Deprecate aio=threads fallback without O_DIRECT

      Currently, if the user requests aio=native, but forgets to choose a
      cache mode that sets O_DIRECT, that request is silently ignored and raw
      falls back to aio=threads.

      Deprecate that behaviour so we can make it an error in future qemu
      versions.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 2259c16dc21aa55cd3fbc26f9be602949105d249
  Merge: 1f35009 ce39494
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 11:12:21 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, virtio bugfixes for 2.3

      Just a bunch of bugfixes. Should be nothing remarkable here.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 18 12:31:03 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
      #      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

      * remotes/mst/tags/for_upstream:
        pcie_aer: fix comment to match pcie spec
        pci: fix several trivial typos in comment
        aer: fix a wrong init PCI_ERR_COR_STATUS w1cmask type register
        pcie_aer: fix typos in pcie_aer_inject_error comment
        aer: fix wrong check on expose aer tlp prefix log
        pcie: correct mistaken register bit for End-End TLP Prefix Blocking
        virtio: Fix memory leaks reported by Coverity
        virtio: validate the existence of handle_output before calling it

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 92a539d22e0da14d5395eb2c2c8bee162ebdb0b8
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 17:02:20 2015 +0100

      raw-posix: Deprecate host floppy passthrough

      Raise your hand if you have a physical floppy drive in a computer
      you've powered on in 2015.  Okay, I see we got a few weirdos in the
      audience.  That's okay, weirdos are welcome here.

      Kidding aside, media change detection doesn't fully work, isn't going
      to be fixed, and floppy passthrough just isn't earning its keep
      anymore.

      Deprecate block driver host_floppy now, so we can drop it after a
      grace period.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1f3500976d3d9d77718ba9b0e69cd4e32239ebfc
  Merge: cd232ac c3c1bb9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 10:07:23 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - kvm: ioeventfd fix for PPC64LE
      - virtio-scsi: misc fixes
      - fix for --enable-profiler
      - nbd: fixes from Max
      - build: fix for scripts/make_device_config.sh
      - exec: fix for address_space_translate

      # gpg: Signature made Wed Mar 18 11:11:08 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: Respect as_tranlsate_internal length clamp
        virtio-scsi-dataplane: fix memory leak in virtio_scsi_vring_init
        profiler: Reenable built-in profiler
        kvm: fix ioeventfd endianness on bi-endian architectures
        virtio-scsi: Fix assert in virtio_scsi_push_event
        build: pass .d file name to scripts/make_device_config.sh, fix makefile target
        coroutine-io: Return -errno in case of error
        nbd: Drop unexpected data for NBD_OPT_LIST
        nbd: Fix interpretation of the export flags
        nbd: Fix nbd_receive_options()
        nbd: Set block size to BDRV_SECTOR_SIZE
        nbd: Fix potential signed overflow issues
        qemu-nbd: fork() can fail
        nbd: Handle blk_getlength() failure
        nbd: Pass return value from nbd_handle_list()
        nbd: Fix nbd_establish_connection()'s return value
        qemu-nbd: Detect unused partitions by system == 0
        util/uri: Add overflow check to rfc3986_parse_port
        nbd: Fix overflow return value

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ce1ee4618f4a557959f5a5731f6726b30416df5
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Sat Mar 14 17:52:15 2015 +0800

      qga/commands-posix: Fix resource leak

      It's detected by coverity. Close the dirfd.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 23bf2e76806390bf12798c2234a23c5c8a15c35d
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 16:42:01 2015 +0100

      elf-loader: Add missing error handling for call of lseek

      This fixes a warning from Coverity.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6cbfb86f4c0ea7cbe852c7bc62a4ef523887c143
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 09:37:08 2015 +0100

      elf-loader: Fix truncation warning from coverity

      Coverity reports a truncation due to cast operation on operand
      reltab->sh_size from 64 bits to 32 bits for calls of load_at.

      Fix the types of the function arguments to match their use in
      function load_at: the offset is used for lseek which takes an
      off_t parameter, the size is used for g_malloc and read.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b76d799ea5ba233a768939c3192105099f84798d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 10 13:23:04 2015 +0100

      hmp: Fix texinfo documentation

      Several issues:

      * Commands i and o lack @item.  Their one-liner documentation gets
        squashed into the preceding command print.  Add the obvious @item.

      * Commands i, o and cpu-add lack @findex.  The function index doesn't
        have them.  Add the obvious @findex.

      * Commit 727f005 put block_set_io_throttle was added in the middle of
        block_passwd.  Move it.

      * Correct spelling of commands chardev-add and chardev-remove in @item
        and @findex.

      * Some commands have a blank line between @item/@findex and the text,
        most don't.  Normalize to no blank line.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit de7ad4ce1f13ea59dfb35fc9985a1c90966646a8
  Author: Viswesh <visweshn92@gmail.com>
  Date:   Tue Mar 17 22:53:08 2015 +0800

      Fix typos in comments

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Viswesh <visweshn92@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e7d49d68bb165ddfdf29929e0a487264085ca51
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Mar 17 16:58:19 2015 -0400

      qtest/ahci: Fix a bit mask expression

      A thinko that clang 3.5.0 caught.
      Thankfully does not introduce any new failures.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 636a30a890c50f734c90ee929e16492fbc6c73e3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sun Mar 15 10:16:28 2015 +0100

      vl: fix resource leak with monitor_fdset_add_fd

      monitor_fdset_add_fd returns an AddfdInfo struct (used by the QMP
      command add_fd).  Free it.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3ebd6cc8d30374da8b72909960f4426e82e5f6ef
  Author: Gabriel L. Somlo <gsomlo@gmail.com>
  Date:   Wed Mar 11 13:58:01 2015 -0400

      smbios: add max speed comdline option for type-17 (meory device) structure

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bdd09778a0649639130aff21a361732a715a0a4f
  Author: Paulo Vital <paulo.vital@profitbricks.com>
  Date:   Tue Mar 10 12:25:51 2015 +0100

      pc-dimm: Add description for device list.

      The pc-dimm option presented on device list (by argument "-device \?")
      is the unique option that don't have any information about it. This
      patch adds a description for the pc-dimm device to help users to
      identify it.

      Signed-off-by: Paulo Vital <paulo.vital@profitbricks.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 18b8263e4ee72697876b081a7520d4ec86b2aab1
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:13:45 2015 +0300

      configure: enable kvm on x32

      Here's a trivial change to enable kvm on x32 architecture.
      I'm not 100% sure the result works correctly in all cases,
      but this is a good start and in theory everything should
      work.

      Signed-off-by: Adam Borowski <kilobyte@angband.pl>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 198675491fcec79f6ebb5d85ccaa52beecd56e43
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Wed Mar 4 18:25:54 2015 +0800

      error: Replace error_report() & error_free() with error_report_err()

      This is a continuation of the work started in commit 565f65d27:
      "error: Use error_report_err() where appropriate"

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6e05a12f8f7f32a3fecbeb0c572d549a5f6e9177
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 5 10:58:32 2015 +0800

      arm: fix memory leak

      Cc: Michael Tokarev <mjt@tls.msk.ru>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 293811f6c1630e3b37aa9d214c6596ce854ab2c7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:09:58 2015 +0100

      qmp: Drop unused .user_print from command definitions

      .user_print isn't used with QMP commands, only with HMP commands.
      Copied over when QMP got its own command table in commit 82a56f0.
      Most of them have been dropped since, but a few stragglers remain.
      Drop them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 46db7b862ab66d14679bb96563092e7ef76f1cfb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:09:57 2015 +0100

      hmp: Fix definition of command quit

      The command handler is a union of two function types.  If
      cmd->user_print is set, handle_user_command() calls
      cmd->mhandler.cmd_new(), else cmd->mhandler.cmd().

      Command definitions must therefore either set both user_print() and
      mhandler.cmd_new(), or only mhandler.cmd().

      quit's sets user_print and mhandler.cmd().  handle_user_command()
      calls hmp_quit() through mhandler.cmd_new() rather than
      mhandler.cmd(), i.e. through a function pointer with a different type.
      Broken in commit 7a7f325, v1.0.

      Works in practice because hmp_quit() doesn't use its arguments, and
      handle_user_command() ignores its function value.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6093d01194edd74e24d46028b84d9d4a0a5cba17
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:44:02 2015 +0100

      target-moxie: Fix warnings from Sparse (one-bit signed bitfield)

      Report from Sparse:

      target-moxie/mmu.h:9:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:10:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:11:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:12:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:13:12: error: dubious one-bit signed bitfield

      Cc: Anthony Green <green@moxielogic.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c20fa2cc26fd203a1260bb5251a523320faa905
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 23:16:21 2015 +0100

      block/qapi: Fix Sparse warning

      Sparse reports this warning:

      block/qapi.c:417:47: warning:
       too long initializer-string for array of char(no space for nul char)

      Replacing the string by an array of characters fixes this warning.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e7ae771f6de2c7b3fa87823f87d6e10caeb91ec6
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:30:01 2015 +0100

      Fix remaining warnings from Sparse (void return)

      Sparse report:

      hw/display/vga.c:2000:5: warning: returning void-valued expression
      hw/intc/arm_gic.c:707:9: warning: returning void-valued expression
      hw/intc/etraxfs_pic.c:138:9: warning: returning void-valued expression
      hw/nvram/fw_cfg.c:475:5: warning: returning void-valued expression
      hw/timer/a9gtimer.c:124:5: warning: returning void-valued expression
      hw/tpm/tpm_tis.c:794:5: warning: returning void-valued expression
      hw/usb/hcd-musb.c:558:9: warning: returning void-valued expression
      hw/usb/hcd-musb.c:776:13: warning: returning void-valued expression
      hw/usb/hcd-musb.c:867:5: warning: returning void-valued expression
      hw/usb/hcd-musb.c:932:5: warning: returning void-valued expression
      include/qom/cpu.h:584:5: warning: returning void-valued expression
      monitor.c:4686:13: warning: returning void-valued expression
      monitor.c:4690:13: warning: returning void-valued expression

      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Andreas Färber <afaerber@suse.de>
      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fbe95bfb654f5f79778c9f292e55a67f91f5cc37
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:23:32 2015 +0100

      qom: Fix warning from Sparse

      Sparse report:

      qom/cpu.c:99:5: warning: returning void-valued expression

      Cc: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 327e9759f11a001545f2fbbf796a85d3d55f1b15
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:23:13 2015 +0100

      target-mips: Fix warning from Sparse

      Sparse report:

      target-mips/dsp_helper.c:3681:5: warning: returning void-valued expression

      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 30d76f13be4eac5499b5ce017f47d5f26ef743af
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:22:48 2015 +0100

      arm/nseries: Fix warnings from Sparse

      Sparse report:

      arm/nseries.c:1406:5: warning: returning void-valued expression
      arm/nseries.c:1411:5: warning: returning void-valued expression

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 77a8257ed711dd7c2ae73c741c93a68aaf0f3391
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:21:13 2015 +0100

      omap: Fix warnings from Sparse

      Sparse report:

      arm/omap1.c:1015:9: warning: returning void-valued expression
      arm/omap1.c:1084:9: warning: returning void-valued expression
      arm/omap1.c:1178:9: warning: returning void-valued expression
      arm/omap1.c:1287:9: warning: returning void-valued expression
      arm/omap1.c:1382:9: warning: returning void-valued expression
      arm/omap1.c:1650:9: warning: returning void-valued expression
      arm/omap1.c:1778:9: warning: returning void-valued expression
      arm/omap1.c:1985:9: warning: returning void-valued expression
      arm/omap1.c:210:9: warning: returning void-valued expression
      arm/omap1.c:2213:9: warning: returning void-valued expression
      arm/omap1.c:2352:9: warning: returning void-valued expression
      arm/omap1.c:2447:9: warning: returning void-valued expression
      arm/omap1.c:2640:9: warning: returning void-valued expression
      arm/omap1.c:317:9: warning: returning void-valued expression
      arm/omap1.c:3413:13: warning: returning void-valued expression
      arm/omap1.c:3414:13: warning: returning void-valued expression
      arm/omap1.c:3415:14: warning: returning void-valued expression
      arm/omap1.c:3589:9: warning: returning void-valued expression
      arm/omap1.c:443:9: warning: returning void-valued expression
      arm/omap1.c:588:9: warning: returning void-valued expression
      arm/omap1.c:860:9: warning: returning void-valued expression
      arm/omap2.c:1362:9: warning: returning void-valued expression
      arm/omap2.c:450:9: warning: returning void-valued expression
      arm/omap2.c:695:9: warning: returning void-valued expression
      arm/omap2.c:760:9: warning: returning void-valued expression
      hw/char/omap_uart.c:115:9: warning: returning void-valued expression
      hw/display/omap_dss.c:1019:9: warning: returning void-valued expression
      hw/display/omap_dss.c:215:9: warning: returning void-valued expression
      hw/display/omap_dss.c:380:9: warning: returning void-valued expression
      hw/display/omap_dss.c:739:9: warning: returning void-valued expression
      hw/display/omap_dss.c:931:9: warning: returning void-valued expression
      hw/dma/omap_dma.c:139:5: warning: returning void-valued expression
      hw/dma/omap_dma.c:1505:9: warning: returning void-valued expression
      hw/dma/omap_dma.c:1860:9: warning: returning void-valued expression
      hw/gpio/omap_gpio.c:116:9: warning: returning void-valued expression
      hw/misc/omap_gpmc.c:627:9: warning: returning void-valued expression
      hw/misc/omap_l4.c:85:9: warning: returning void-valued expression
      hw/misc/omap_sdrc.c:95:9: warning: returning void-valued expression
      hw/misc/omap_tap.c:98:9: warning: returning void-valued expression
      hw/sd/omap_mmc.c:409:9: warning: returning void-valued expression
      hw/ssi/omap_spi.c:229:9: warning: returning void-valued expression
      hw/timer/omap_gptimer.c:447:9: warning: returning void-valued expression

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0289a412e8e41bfddf9e61336ee94e348dcaedfe
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:17:54 2015 +0100

      9pfs: Fix warnings from Sparse

      Sparse report:

      9pfs/virtio-9p.c:1953:9: warning: returning void-valued expression
      9pfs/virtio-9p-handle.c:143:5: warning: returning void-valued expression
      9pfs/virtio-9p-handle.c:160:5: warning: returning void-valued expression
      9pfs/virtio-9p-local.c:384:5: warning: returning void-valued expression
      9pfs/virtio-9p-local.c:415:5: warning: returning void-valued expression
      9pfs/virtio-9p-proxy.c:672:5: warning: returning void-valued expression
      9pfs/virtio-9p-proxy.c:689:5: warning: returning void-valued expression

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c80d953b2fd839d36795c7a55a4c525ec6e0cc8
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:14:47 2015 +0100

      backends: Fix warning from Sparse

      Sparse report:

      backends/tpm.c:39:5: warning: returning void-valued expression

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 302cb24addd18213c615dfa57de22dcae4776d2a
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Tue Mar 10 08:31:30 2015 +0300

      cris: remove unused cris_cond15 declarations

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>

  commit ce394947a75296fc10f1676932473e92aa8be11a
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 18 12:45:53 2015 +0100

      pcie_aer: fix comment to match pcie spec

      Code comment says "table 6-2" but in fact it's is not a table, it is
      "Figure 6-2" on page 479.

      Cc: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reported-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 98a2f30a1b5b8b7b35229a705149f020b4918ab8
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:52:23 2015 +0800

      pci: fix several trivial typos in comment

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 310e91f7d0aaec27f55969597ccbb4e83612695e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:49:49 2015 +0800

      aer: fix a wrong init PCI_ERR_COR_STATUS w1cmask type register

      Error Status Register, so this patch fix a wrong definition
      for PCI_ERR_COR_STATUS register with w1cmask type.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b01738c23da718678469cbe85c0a4a82b19652d4
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:49:48 2015 +0800

      pcie_aer: fix typos in pcie_aer_inject_error comment

      Refer to "PCI Express Base Spec3.0", this comments can't
      fit the description in spec, so we should fix them.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 77a3c1d730a14c86f3f5692be9906b206afc3d3e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Fri Mar 13 11:18:04 2015 +0800

      aer: fix wrong check on expose aer tlp prefix log

      when specify TLP Prefix log as using pcie_aer_inject_error,
      the TLP prefix log is always discarded. because the check
      is incorrect, the End-End TLP Prefix Supported bit
      (PCI_EXP_DEVCAP2_EETLPP) should be in Device Capabilities 2 Register.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 30b04f8711c5191929af4ed03a779646ced3456e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Fri Mar 13 11:18:03 2015 +0800

      pcie: correct mistaken register bit for End-End TLP Prefix Blocking

      from pcie spec 7.8.17, the End-End TLP Prefix Blocking bit local
      is 15(e.g. 0x8000) in device control 2 register.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c3c1bb99d1c11978d9ce94d1bdcf0705378c1459
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 16 22:35:54 2015 -0700

      exec: Respect as_tranlsate_internal length clamp

      address_space_translate_internal will clamp the *plen length argument
      based on the size of the memory region being queried. The iommu walker
      logic in addresss_space_translate was ignoring this by discarding the
      post fn call value of *plen. Fix by just always using *plen as the
      length argument throughout the fn, removing the len local variable.

      This fixes a bootloader bug when a single elf section spans multiple
      QEMU memory regions.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1426570554-15940-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 196d4fc56d824ccbbb58714e9ad0793053ef8260
  Author: Bo Su <subo7@huawei.com>
  Date:   Wed Mar 18 09:42:12 2015 +0000

      virtio-scsi-dataplane: fix memory leak in virtio_scsi_vring_init

      if k->set_host_notifier failed, VirtIOSCSIVring *r will leak

      Signed-off-by: Bo Su <subo7@huawei.com>
      Message-Id: <1426671732-80213-1-git-send-email-subo7@huawei.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 89d5cbddeeaf6bb4aa6a5ca4fbb443115abce4a2
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 16 14:57:38 2015 +1100

      profiler: Reenable built-in profiler

      2ed1ebcf6 "timer: replace time() with QEMU_CLOCK_HOST" broke compile
      when configured with --enable-profiler. Turned out the profiler has been
      broken for a while.

      This does s/qemu_time/tcg_time/ as the profiler only works in a TCG mode.
      This also fixes the compile error.

      This changes profile_getclock() to return nanoseconds rather than
      CPU ticks as the "profile" HMP command prints seconds and there is no
      platform-independent way to get ticks-per-second rate.
      Since TCG is quite slow and get_clock() returns nanoseconds (fine
      enough), this should not affect precision much.

      This removes unused qemu_time_start and tlb_flush_time.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Message-Id: <1426478258-29961-1-git-send-email-aik@ozlabs.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b680c5ba54946ab205cdb5083bc0a17e3f2fb468
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Fri Mar 13 22:23:37 2015 +0100

      kvm: fix ioeventfd endianness on bi-endian architectures

      KVM expects host endian values. Hosts that don't use the default endianness
      need to negate the swap performed in adjust_endianness().

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Message-Id: <20150313212337.31142.3991.stgit@bahia.local>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2034e324dabc55064553aaa07de1536ebf8ea497
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Mar 13 15:55:54 2015 +0800

      virtio-scsi: Fix assert in virtio_scsi_push_event

      Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.

          qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
          Assertion `skip == 0' failed.

      This is introduced by commit 55783a55 (virtio-scsi: work around bug in
      old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
      (the same to in sg). For virtio_scsi_push_event, looking into out_sg
      doesn't make sense because 0 req_size is intended.

      Cc: qemu-stable@nongnu.org
      [Cc'ing qemu-stable because 55783a55 did it too]
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426233354-525-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 15564d85afaf1d7b314c858a5a34bda599f4cd14
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 12 16:00:05 2015 +0100

      build: pass .d file name to scripts/make_device_config.sh, fix makefile target

      The .d file name must match exactly what is used in the SUBDIR_DEVICES_MAK_DEP
      variable.  Instead of making assumptions in the make_device_config.sh script,
      just pass it in.

      Similarly, the makefile target may not match the output file name, because
      Makefile uses a temporary file.  Instead of making assumptions on what the
      Makefile does, emit the config-devices.mak file to stdout, and use the
      passed-in destination as the makefile target

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4adf4180f284caf4ea9cd83ce37085d50a52603b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:28 2015 -0500

      coroutine-io: Return -errno in case of error

      In case qemu_co_sendv_recvv() fails without any data read, there is no
      reason not to return the perfectly fine error number retrieved from
      socket_error().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-16-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0379f474ddebfc69f42fa8231d86687cf29d997b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:34 2015 -0500

      nbd: Drop unexpected data for NBD_OPT_LIST

      When requesting the list of exports, no data should be sent. If data is
      sent, the NBD server should not just inform the client of the invalid
      request, but also drop the data.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-22-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 48c7d80de8863e3436b3b5d5676018b2afaec161
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:32 2015 -0500

      nbd: Fix interpretation of the export flags

      The export flags are a 16 bit value, so be16_to_cpu() has to be used to
      interpret them correctly. This makes discard and flush actually work
      for named NBD exports (they did not work before, because the client
      always assumed them to be unsupported because of the bug fixed by this
      patch).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-20-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9c122adadbf4377eb77195b3944be10a59d9484f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:31 2015 -0500

      nbd: Fix nbd_receive_options()

      The client flags are sent exactly once overall, not once per option.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-19-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3f4726596dafd2e27485e51f4cc4a2363f48d4a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:25 2015 -0500

      nbd: Set block size to BDRV_SECTOR_SIZE

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-13-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ac97393dc7c4761af6104fb8fca5f600899f687b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:23 2015 -0500

      nbd: Fix potential signed overflow issues

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-11-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 70d4739ef200760d8cac3355d05b4252f2f37fec
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:22 2015 -0500

      qemu-nbd: fork() can fail

      It is very unlikely, but it is possible.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-10-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 98f44bbe70bb803e7be2421b7cc92a1c179afb87
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:21 2015 -0500

      nbd: Handle blk_getlength() failure

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-9-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 892f5a5270f9f3cae4f384dffbf70679fa2a57b6
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:19 2015 -0500

      nbd: Pass return value from nbd_handle_list()

      While it does not make a difference in practice, nbd_receive_options()
      generally returns -errno, so it should do that here as well; and the
      easiest way to achieve this is by passing on the value returned by
      nbd_handle_list().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-7-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b1f13b996c3a278ed3d4bf4ce0893f3506fb7cc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:16 2015 -0500

      nbd: Fix nbd_establish_connection()'s return value

      unix_connect_opts() and inet_connect_opts() do not necessarily set errno
      (if at all); therefore, nbd_establish_connection() should not literally
      return -errno on error.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-4-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 453b07b13443713f6a632005977c7ccab17e135d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:15 2015 -0500

      qemu-nbd: Detect unused partitions by system == 0

      Unused partitions do not necessarily have a total sector count of 0
      (although they should have), but they always do have the system field
      set to 0, so use that for testing whether a partition is in use rather
      than the sector count field alone.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-3-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b21233061696feed434317a70e0a8b74f956ec8
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:14 2015 -0500

      util/uri: Add overflow check to rfc3986_parse_port

      And while at it, replace tabs by eight spaces in this function.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-2-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8b2f0abfd61237b301a29e814535b1e36d733aaa
  Author: Yik Fang <eric.fangyi@huawei.com>
  Date:   Thu Feb 12 06:21:51 2015 +0000

      nbd: Fix overflow return value

      The value of reply.error should be the type unsigned int.

      Signed-off-by: Yik Fang <eric.fangyi@huawei.com>
      Message-Id: <1423722111-12902-1-git-send-email-eric.fangyi@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8ffd9f4dd41f0423f0df8bef8f2e25ab4bb1a3f3
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Mar 17 14:52:54 2015 +0100

      hw/usb: Include USB files only if necessary

      Boards that do not include an USB controller should not provide
      USB devices. However, when running "qemu-system-s390x -device help"
      for example, there's still a usb-hub, usb-kbd, usb-mouse and
      usb-tablet in the list of "supported" devices. Let's fix that
      by compiling and linking the USB files only if it is really
      necessary.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0af7a37054310384e00209e0a43efe95b7c19ef0
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 16 16:29:34 2015 +0000

      target-mips: save cpu state before calling MSA load and store helpers

      PC needs to be saved if an exception can be generated by an helper.
      This fixes a problem related to resuming the execution at unexpected address
      after an exception (caused by MSA load/store instruction) has been serviced.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit a5f533909e746ca6e534b232fb42c9c6fd81b468
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Jan 29 16:15:00 2015 +0000

      target-mips: fix hflags modified in delay / forbidden slot

      All instructions which may change hflags terminate tb. However, this doesn't
      work if such an instruction is placed in delay or forbidden slot.
      gen_branch() clears MIPS_HFLAG_BMASK in ctx->hflags and then generates code
      to overwrite hflags with ctx->hflags, consequently we loose any execution-time
      hflags modifications. For example, in the following scenario hflag related to
      Status.CU1 will not be updated:
          /* Set Status.CU1 in delay slot */
          mfc0  $24, $12, 0
          lui   $25, 0x2000
          or    $25, $25, $24
          b     check_Status_CU1
          mtc0  $25, $12, 0

      With this change we clear MIPS_HFLAG_BMASK in execution-time hflags if
      instruction in delay or forbidden slot wants to terminate tb for some reason
      (i.e. ctx->bstate != BS_NONE).

      Also, die early and loudly if "unknown branch" is encountered as this should
      never happen.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 62c688693bf2f0355fc5bad5dcc59c1cd2a51f1a
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 16 16:54:42 2015 +0000

      target-mips: fix CP0.BadVAddr by stopping translation on Address Error

      CP0.BadVAddr is supposed to capture the most recent virtual address that caused
      the exception. Currently this does not work correctly for unaligned instruction
      fetch as translation is not stopped and CP0.BadVAddr is updated with subsequent
      addresses.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4a48aaa9f52dbac148be24f591de2f28c58ccb5d
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:43:00 2015 +0000

      ui: ensure VNC websockets server checks the ACL if requested

      If the x509verify option is requested, the VNC websockets server
      was failing to validate that the websockets client provided an
      x509 certificate matching the ACL rules.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7b45a00d05cc936d28e36b95932864e8cc095968
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:59 2015 +0000

      ui: remove separate gnutls_session for websockets server

      The previous change to the auth scheme handling guarantees we
      can never have nested TLS sessions in the VNC websockets server.
      Thus we can remove the separate gnutls_session instance.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 51941e4695c6f6c1f786bacef7e8c3a477570e04
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:58 2015 +0000

      ui: enforce TLS when using websockets server

      When TLS is required, the primary VNC server considers it to be
      mandatory. ie the server admin decides whether or not TLS is used,
      and the client has to comply with this decision. The websockets
      server, however, treated it as optional, allowing non-TLS clients
      to connect to a server which had setup TLS. Thus enabling websockets
      lowers the security of the VNC server leaving the admin no way to
      enforce use of TLS.

      This removes the code that allows non-TLS fallback in the websockets
      server, so that if TLS is requested for VNC it is now mandatory for
      both the primary VNC server and the websockets VNC server.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f9148c8ae7b1515776699387b4d59864f302c77d
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:57 2015 +0000

      ui: fix setup of VNC websockets auth scheme with TLS

      The way the websockets TLS code was integrated into the VNC server
      made it essentially useless. The only time that the websockets TLS
      support could be used is if the primary VNC server had its existing
      TLS support disabled. ie QEMU had to be launched with:

        # qemu -vnc localhost:1,websockets=5902,x509=/path/to/certs

      Note the absence of the 'tls' flag. This is already a bug, because
      the docs indicate that 'x509' is ignored unless 'tls' is given.

      If the primary VNC server had TLS turned on via the 'tls' flag,
      then this prevented the websockets TLS support from being used,
      because it activates the VeNCrypt auth which would have resulted
      in TLS being run over a TLS session. Of course no websockets VNC
      client supported VeNCrypt so in practice, since the browser clients
      cannot setup a nested TLS session over the main HTTPS connection,
      so it would not even get past auth.

      This patch causes us to decide our auth scheme separately for the
      main VNC server vs the websockets VNC server. We take account of
      the fact that if TLS is enabled, then the websockets client will
      use https, so setting up VeNCrypt is thus redundant as it would
      lead to nested TLS sessions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0dd72e1531f0ea1a62fd016702ea3b868d116bd8
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:56 2015 +0000

      ui: split setup of VNC auth scheme into separate method

      The vnc_display_open method is quite long and complex, so
      move the VNC auth scheme decision logic into a separate
      method for clarity.

      Also update the comment to better describe what we are
      trying to achieve.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d169f04b8b8424ad9c5377bb5391de2f760e3db1
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:55 2015 +0000

      ui: report error if user requests VNC option that is unsupported

      If the VNC server is built without tls, sasl or websocket support
      and the user requests one of these features, they are just silently
      ignored. This is bad because it means the VNC server ends up running
      in a configuration that is less secure than the user asked for.
      It also leads to an tangled mass of preprocessor conditionals when
      configuring the VNC server.

      This ensures that the tls, sasl & websocket options are always
      processed and an error is reported back to the user if any of
      them were disabled at build time.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 153130cd4fa236e29bb6243eebf9439b983ca266
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:54 2015 +0000

      ui: replace printf() calls with VNC_DEBUG

      Handling of VNC audio messages results in printfs to the console.
      This is of no use to anyone in production, so should be using the
      normal VNC_DEBUG macro instead.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2f45bc02ae9be18119d2fb88042ef19e7e9247f
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:53 2015 +0000

      ui: remove unused 'wiremode' variable in VncState struct

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cd232acfa0d70002fed89e9293f04afda577a513
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 18:58:33 2015 +0000

      Update version for v2.3.0-rc0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d8e33fc98081b548b25be9458490c40858480344
  Merge: ac738ea cde63fb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 17:11:33 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150317' into staging

      migration/next for 20150317

      # gpg: Signature made Tue Mar 17 14:21:14 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150317:
        migration: Expose 'cancelling' status to user
        migration: Convert 'status' of MigrationInfo to use an enum type
        hmp: Rename 'MigrationStatus' to 'HMPMigrationStatus'
        migration: Rename abbreviated macro MIG_STATE_* to MIGRATION_STATUS_*
        migration: Remove unused functions
        arch_init: Count the total number of pages by using helper function
        migrate_incoming: Cleanup/clarify error messages
        Warn against the use of the string as uri parameter to migrate-incoming
        migrate_incoming: use hmp_handle_error
        migration: Fix remaining 32 bit compiler errors
        migration: Fix some 32 bit compiler errors
        migration/rdma: clean up qemu_rdma_dest_init a bit
        migration: Avoid qerror_report_err() outside QMP command handlers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac738eadc409813c5fbb37dae8d254cb5664733a
  Merge: 1a87e52 e1570d0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 16:19:12 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * QTest for PC X86CPU
      * Confinement of ICC bridge X86CPU parenting to PC code

      # gpg: Signature made Tue Mar 17 15:23:31 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter:
        target-i386: Remove icc_bridge parameter from cpu_x86_create()
        tests: Add PC CPU test
        pc: Suppress APIC ID compatibility warning for QTest

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a87e52770ca64f5a09e9c46d29ea3b5a5db5ffd
  Merge: 5a49928 88950ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 15:23:23 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Conversion of cadence_uart to QOM realize
      * qom-tree QMP script
      * qom-list and qom-set HMP commands to match their QMP counterparts
      * Basic qom-tree HMP command
      * Cleanups for /machine QOM composition tree

      # gpg: Signature made Tue Mar 17 15:02:57 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qdev: Move owner-less IRQs to /machine/unattached
        memory: Move owner-less MemoryRegions to /machine/unattached
        qom: Implement info qom-tree HMP command
        qom: Implement qom-set HMP command
        qom: Implement qom-list HMP command
        scripts: Add qom-tree script
        cadence_uart: Convert to QOM realize()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cde63fbed86e20dda98bf35025faedd994918f00
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:41 2015 +0800

      migration: Expose 'cancelling' status to user

      'cancelling' status was introduced by commit 51cf4c1a, mainly to avoid a
      possible start of a new migration process while the previous one still exists.
      But we didn't expose this status to user, instead we returned the 'active' state.

      Here, we expose it to the user (such as libvirt), 'cancelling' status only
      occurs for a short window before the migration aborts, so for users,
      if they cancel a migration process, it will observe 'cancelling' status
      occasionally.

      Testing revealed that with older libvirt (anything 1.2.13 or less) will
      print an odd error message if the state is seen, but that the migration
      is still properly cancelled. Newer libvirt will be patched to recognize
      the new state without the odd error message.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Cc: libvir-list@redhat.com
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 24b8c39b5c34b05f1ac870c421e2e61574abbdf9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:40 2015 +0800

      migration: Convert 'status' of MigrationInfo to use an enum type

      The original 'status' is an open-coded 'str' type, convert it to use an
      enum type.
      This conversion is backwards compatible, better documented and
      more convenient for future extensibility.

      In addition, Fix a typo for qapi-schema.json (just remove the typo) :
      s/'completed'. 'comppleted' (since 1.2)/'completed' (since 1.2)

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e49f35bdb4974d6cfd7e5eb5cb9f8c50eef3f3a9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:39 2015 +0800

      hmp: Rename 'MigrationStatus' to 'HMPMigrationStatus'

      We will use the typename 'MigrationStatus' for publicly exported typename,
      So here we rename the internal-only 'MigrationStatus' to
      'HMPMigrationStatus'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3119473166eeac017b249b408b07473aff5a7ca2
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:38 2015 +0800

      migration: Rename abbreviated macro MIG_STATE_* to MIGRATION_STATUS_*

      Rename all macro MIG_STATE_* to  MIGRATION_STATUS_* except "MIG_STATE_ERROR",
      we rename it to "MIGRATION_STATUS_FAILED" which will match the migration status
      string 'failed'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 21cb4924f79579222459c2395f28d1a26d4ef0bd
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:28 2015 +0100

      migration: Remove unused functions

      migrate_rdma_pin_all() and qsb_clone() are completely unused and thus
      can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f54a235f9b15ae59d70b40630417d8aaa88bc4ec
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Mar 9 17:27:38 2015 +0800

      arch_init: Count the total number of pages by using helper function

      There is already a helper function ram_bytes_total(), we can use it to
      help counting the total number of pages used by ram blocks.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4debb5f553d816bf1f2d86bb61e833e79010cb3d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:41 2015 +0000

      migrate_incoming: Cleanup/clarify error messages

      Create a separate error for the case where migrate_incoming is
      used after a succesful migrate_incoming.

      Reword the error in the case where '-incoming defer' is missing
      to omit the command name so it's right for both hmp and qmp.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit d87605347879b67f156af085d772ab88cde40820
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:40 2015 +0000

      Warn against the use of the string as uri parameter to migrate-incoming

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1fa57f5543aaff62a6fff63782e6c7dd54773628
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:39 2015 +0000

      migrate_incoming: use hmp_handle_error

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit fbce8c25d886b207ebb290d911a7d99abd652676
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:43 2015 +0100

      migration: Fix remaining 32 bit compiler errors

      Fix type casts between pointers and 64 bit integers.
      Now 32 bit builds are possible again.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3ac040c0ef525c4cc5ebf881c15421cfa6b095c7
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:42 2015 +0100

      migration: Fix some 32 bit compiler errors

      The current code won't compile on 32 bit hosts because there are lots
      of type casts between pointers and 64 bit integers.

      Fix some of them.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1dbd2fd9cbf29c74131e439ce80fb2efde56ee32
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Feb 16 10:50:25 2015 +0300

      migration/rdma: clean up qemu_rdma_dest_init a bit

      Do not check for rdma->host being empty twice.  This removes a large
      "if" block, so code indentation is changed.  While at it, remove an
      ugly goto from the loop, replacing it with a cleaner if logic.  And
      finally, there's no need to initialize `ret' variable since is always
      has a value.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

      --

      fixed space detected by Dave
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 97baf9d9f768caac57bb98d79a1d878181e8a052
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 18 19:21:52 2015 +0100

      migration: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in
      process_incoming_migration_co().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e1570d0005f29f97d4b1d603b4548591340c57e1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Mar 5 14:26:51 2015 -0300

      target-i386: Remove icc_bridge parameter from cpu_x86_create()

      Instead of passing icc_bridge from the PC initialization code to
      cpu_x86_create(), make the PC initialization code attach the CPU to
      icc_bridge.

      The only difference here is that icc_bridge attachment will now be done
      after x86_cpu_parse_featurestr() is called. But this shouldn't make any
      difference, as property setters shouldn't depend on icc_bridge.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7fe55c3cbac3ffcb1f772dfa8246405bd2328810
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Mar 13 17:21:11 2015 +0100

      tests: Add PC CPU test

      Test non-default -smp core and thread counts and a non-default CPU model
      on all PC machines except for isapc. Note that not all historic versions
      actually supported this particular configuration, ignored for simplicity.

      For machines pc-*-1.5+ test QMP cpu-add with monotonically increasing ID,
      and test for graceful failure otherwise.

      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b1c12027f834d50c0cf22fe8745b5d85bb87ddd0
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Sat Mar 14 14:24:37 2015 +0100

      pc: Suppress APIC ID compatibility warning for QTest

      This avoids cluttering GTester output with irrelevant warnings.

      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 88950eeff59834b3b4bea98b954a3fe854468ae3
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 12 16:09:34 2015 +0100

      qdev: Move owner-less IRQs to /machine/unattached

      Move non-qdev-gpio[*] from /machine into /machine/unattached.
      For the PC this moves 25 nodes from the stable namespace into the unstable.

      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 210eb9364be384e7c7f6ef106e6ac8c996dadffe
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 12 15:37:07 2015 +0100

      memory: Move owner-less MemoryRegions to /machine/unattached

      This cleans up the official /machine namespace. In particular
      /machine/system[0] and /machine/io[0], as well as entries with
      non-sanitized node names such as "/machine/qemu extended regs[0]".

      The actual MemoryRegion names remain unchanged.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a01ff75fcdb4d91809ccdd2b95efda6ee1239cbb
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 17:03:18 2014 +0200

      qom: Implement info qom-tree HMP command

      To complement qdev's bus-oriented info qtree, info qom-tree
      prints a hierarchical view of the QOM composition tree.

      By default, the machine composition tree is shown. This can be overriden
      by supplying a path argument, such as "info qom-tree /".

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c0e6ee9e6f49d4a3183b05f457cc2704a966fce5
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 19:48:15 2014 +0200

      qom: Implement qom-set HMP command

      Re-implemented based on qmp_qom_set() to facilitate argument parsing.

      Warn about ambiguous path arguments.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 89d7fa9eb4a0a75bb1bc1bf24e9e79ebe91fd7b0
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 18:08:29 2014 +0200

      qom: Implement qom-list HMP command

      Implement it as a wrapper for QMP qom-list, but mimic the behavior of
      scripts/qmp/qom-list in making the path argument optional and listing
      the root if absent, to hint users what kind of path to pass.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit eb60aa5737463d9143c0edde0fcd3a1eff44a633
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Feb 5 18:31:06 2014 +0100

      scripts: Add qom-tree script

      Functionally it is a recursive qom-list with qom-get per non-child<>
      property. Some failures needed to be handled, such as trying to read a
      pointer property, which is not representable in QMP. Those print a
      literal "<EXCEPTION>".

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f3cf80e805bc22980733606df15917223f311f4b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 18:43:09 2015 +0100

      vnc: Fix QMP change not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit 1d0d59f
      added a use of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace it.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c326529b74aa37adb216604bb6ca93cd49007012
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:50 2015 +0100

      usb/dev-storage: Avoid qerror_report_err() outside QMP handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      usb_msd_password_cb() is only called from within an HMP command
      handler.  Replace by error_report_err().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7afcc1f9bae3e857834a3bb8247be101e2354998
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:49 2015 +0100

      usb/dev-storage: Fix QMP device_add missing encryption key failure

      When the image is encrypted, QMP device_add creates the device, defers
      actually attaching it to when the key becomes available, then returns
      an error.  This is wrong.  device_add must either create the device
      and succeed, or do nothing and fail.

      The bug is in usb_msd_realize_storage().  It posts an error with
      qerror_report_err(), and returns success.  Device realization relies
      on the return value, and completes.  The QMP monitor, however, relies
      on the posted error, and sends it in an error reply.

      Reproducer:

          $ qemu-system-x86_64 -nodefaults -display none -usb -qmp stdio -drive if=none,id=foo,file=geheim.qcow2
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device_add", "arguments": { "driver": "usb-storage", "id": "bar", "drive": "foo" } }
          {"error": {"class": "DeviceEncrypted", "desc": "'foo' (geheim.qcow2) is encrypted"}}

      Even though we got an error back, the device got created just fine.
      To demonstrate, let's unplug it again:

          {"execute":"device_del","arguments": { "id": "bar" } }
          {"timestamp": {"seconds": 1426003440, "microseconds": 237181}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/bar/bar.0/legacy[0]"}}
          {"timestamp": {"seconds": 1426003440, "microseconds": 238231}, "event": "DEVICE_DELETED", "data": {"device": "bar", "path": "/machine/peripheral/bar"}}
          {"return": {}}

      Fix by making usb_msd_realize_storage() fail properly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9b14e0efcc9a6ea41b7265538f6ec4c53e2ba270
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:48 2015 +0100

      monitor usb: Inline monitor_read_bdrv_key_start()'s first part

      monitor_read_bdrv_key_start() does several things:

      1. If no key is needed, call completion_cb() and succeed

      2. If we're in QMP context, call qerror_report_err() and fail

      3. Start reading the key in the monitor.

      This is two things too many.  Inline 1. and 2. into its callers
      monitor_read_block_device_key() and usb_msd_realize_storage().

      Since monitor_read_block_device_key() only ever runs in HMP context,
      drop 2. there.

      The next commit will clean up the result in usb_msd_realize_storage().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 988e0f06621fde11ec0d319a6fd0ab3ccef0602f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:47 2015 +0100

      monitor: Plug memory leak in monitor_read_bdrv_key_start()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bcf5d19c59a527c91bc29704f3e4956119c050cf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:46 2015 +0100

      monitor: Drop dead QMP check from monitor_read_password()

      Function is only called in HMP context since commit 333a96e "qapi:
      Convert change".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 63216dc78d2d52448afdfbe0e0bacb2c669083b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:05 2015 +0100

      uhci: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 87581feaa112733e8d999ade8a4d08816e908268
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:04 2015 +0100

      ohci: Complete conversion to realize

      Commit 457215ec "ohci: Use QOM realize for OHCI" converted only
      "sysbus-ohci".  Finish the job: convert "pci-ohci".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e269f3d9d806987977b3c76deb26647f2bf33e1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:03 2015 +0100

      usb: Improve companion configuration error messages

      The previous commit broke the additional messages explaining the error
      messages.  Improve the error messages, so they don't need explaining
      so much.  Helps QMP users as well, unlike additional explanations.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f4bbaaf584ed8d0a430b467bace15f338cba4c57
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:02 2015 +0100

      usb: Propagate errors through usb_register_companion()

      This loses the messages explaining the error printed with
      error_printf_unless_qmp().  The next commit will make up for the loss.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 96f209264f642365052983dcb50a0f3d7b688f6b
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri Feb 27 11:48:58 2015 +1000

      cadence_uart: Convert to QOM realize()

      Use DeviceClass::realize() and TypeInfo::instance_init() instead of
      the deprecated SysBusDevice::init().

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a4992834daec85c3913654903fb9f4f954e585a
  Merge: 494a864 906b8ba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 11:43:00 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-03-17' into staging

      coverity: Fix g_malloc_n-like models

      # gpg: Signature made Tue Mar 17 10:17:56 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-03-17:
        coverity: Fix g_malloc_n-like models

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 494a864e055b565182dcdd3807c1f09a211d0fc5
  Merge: 3521f76 b1546f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 10:26:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gl-20150317-1' into staging

      opengl: fix configure test

      # gpg: Signature made Tue Mar 17 10:11:24 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gl-20150317-1:
        opengl: fix configure test

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1546f3210d89662dca3e88e1021a0089f003551
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 16 10:03:53 2015 +0100

      opengl: fix configure test

      Re-add the glx compile test to configure.  We can't use pkg-config to
      probe for glx, and as long as milkymist-tmu2 privately uses glx (due to
      opengl infrastructure in qemu not being ready yet) we must continue to
      test for glx to avoid build failures.

      Reported-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 906b8bab8bbc588f19752ed19e0222330dce31f9
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Mar 12 12:24:26 2015 +0100

      coverity: Fix g_malloc_n-like models

      Allocate the calculated overall size, not only the size of a single
      element.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

  commit 3521f767067feedd06ef6d2efd24c1190c68638c
  Merge: 17b11a1 47aced5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 19:19:03 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3-rc0

      # gpg: Signature made Mon Mar 16 16:11:55 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block/vpc: remove disabled code from get_sector_offset
        block/vpc: rename footer->size -> footer->current_size
        block/vpc: make calculate_geometry spec conform
        vpc: Ignore geometry for large images
        block/vpc: optimize vpc_co_get_block_status
        block: Drop bdrv_find
        blockdev: Convert bdrv_find to blk_by_name
        migration: Convert bdrv_find to blk_by_name
        monitor: Convert bdrv_find to blk_by_name
        iotests: Test non-self-referential qcow2 refblocks
        iotests: Add tests for refcount table growth
        qcow2: Respect new_block in alloc_refcount_block()
        qemu-img: Avoid qerror_report_err() outside QMP handlers, again
        block: Fix block-set-write-threshold not to use funky error class
        block: Deprecate QCOW/QCOW2 encryption
        qemu-img: Fix convert, amend error messages for unknown options
        iotests: Update 051's reference output

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 17b11a1406fdc43b5022f32a6fbfcb005a353b38
  Merge: 9575234 b724b01
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 18:27:13 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150316' into staging

      TriCore RRR1, RRRR, RRRW, and SYS instructions

      # gpg: Signature made Mon Mar 16 15:55:24 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150316:
        target-tricore: Add instructions of SYS opcode format
        target-tricore: Add instructions of RRRW opcode format
        target-tricore: Add instructions of RRRR opcode format
        target-tricore: Add instructions of RRR1 opcode format, which have 0xe3 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x63 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0xa3 as first opcode

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9575234db19df260a3c00f5f947a9c1c823b0f5b
  Merge: bc68d2e 2374c4b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 17:22:32 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/tcg-pull-20150316' into staging

      tcg opt fix for or x,a,a

      # gpg: Signature made Mon Mar 16 15:47:19 2015 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-pull-20150316:
        tcg/optimize: Handle or r,a,a with constant a

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 47aced5078e13d6c1f4fbb59616654e577af8aaa
  Merge: 2867ce4 304ee91
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Mar 16 17:11:12 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        block/vpc: remove disabled code from get_sector_offset
        block/vpc: rename footer->size -> footer->current_size
        block/vpc: make calculate_geometry spec conform
        vpc: Ignore geometry for large images
        block/vpc: optimize vpc_co_get_block_status
        block: Drop bdrv_find
        blockdev: Convert bdrv_find to blk_by_name
        migration: Convert bdrv_find to blk_by_name
        monitor: Convert bdrv_find to blk_by_name
        iotests: Test non-self-referential qcow2 refblocks
        iotests: Add tests for refcount table growth
        qcow2: Respect new_block in alloc_refcount_block()

  commit 304ee9174f4761d3f4da611352a815ab27baba06
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:56 2015 +0100

      block/vpc: remove disabled code from get_sector_offset

      The code to check the bitmap for the allocation status of each sector
      has been "disabled by reason" ever since the vpc driver existed.

      The reason might be that we might end up reading sector by sector
      in vpc_read if we really used it. This would be a performance desaster.

      The current code would furthermore not work if the disabled parts get
      reactivated since vpc_read and vpc_write only use get_sector_offset to
      check the allocation status of the first sector of a read/write operation.
      This might lead to sectors incorrectly treated as zero in vpc_read and
      to sectors getting allocated twice in vpc_write.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-6-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 03671ded3078ebad1f0a701042622fd5e8918bc9
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:55 2015 +0100

      block/vpc: rename footer->size -> footer->current_size

      the field is named current size in the spec. Name it accordingly.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1425379316-19639-5-git-send-email-pl@kamp.de
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 690cbb095a17c429513890d991bc57c98dd83912
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:54 2015 +0100

      block/vpc: make calculate_geometry spec conform

      The VHD spec [1] allows for total_sectors of 65535 x 16 x 255 (~127GB)
      represented by a CHS geometry. If total_sectors is greater
      than 65535 x 16 x 255 this geometry is set as a maximum.

      Qemu, Hyper-V and disk2vhd use this special geometry as an indicator
      to use the image current size from the footer as disk size.

      This patch changes vpc_create to effectively calculate a CxHxS geometry
      for the given image size if possible while rounding up if necessary.
      If the image size is too big to be represented in CHS we set the maximum
      and write the exact requested image size into the footer.

      This partly reverts commit 258d2edb, but leaves support for >127G disks
      intact.

      [1] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-4-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 0444dceee48fed54e8334428fa57f9ff997736e8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Mar 3 11:41:53 2015 +0100

      vpc: Ignore geometry for large images

      The CHS calculation as done per the VHD spec imposes a maximum image
      size of ~127 GB. Real VHD images exist that are larger than that.

      Apparently there are two separate non-standard ways to achieve this:
      You could use more heads than the spec does - this is the option that
      qemu-img create chooses.

      However, other images exist where the geometry is set to the maximum
      (65535/16/255), but the actual image size is larger. Until now, such
      images are truncated at 127 GB when opening them with qemu.

      This patch changes the vpc driver to ignore geometry in this case and
      only trust the size field in the header.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      [PL: Fixed maximum geometry in the commit msg]
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-3-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2ec711dcd45effc8d583dee6ff92d94573aad75b
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:52 2015 +0100

      block/vpc: optimize vpc_co_get_block_status

      *pnum can't be greater than s->block_size / BDRV_SECTOR_SIZE for allocated
      sectors since there is always a bitmap in between.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1425379316-19639-2-git-send-email-pl@kamp.de
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit d51a2427f68a312b676edd0e9efce881649d1767
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:49 2015 +0800

      block: Drop bdrv_find

      All callers are converted, so drop it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-5-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit a0e8544cf84cf193e455a9a3b7d9997dbc268b4b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:48 2015 +0800

      blockdev: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-4-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c9ebaf744ea7785776c358400eb13c256a3c9db6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:47 2015 +0800

      migration: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-3-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 5560625badb9e710577986de65ff4e4b413729a0
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:46 2015 +0800

      monitor: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-2-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 4b4d7b072f0faf9008ca835af101338857b28394
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 5 17:53:32 2014 +0100

      iotests: Test non-self-referential qcow2 refblocks

      It is easy to create only self-referential refblocks, but there are
      cases where that is impossible. This adds a test for two of those cases
      (combined in a single test case).

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417798412-15330-1-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 0e8a371468ce24513b15a9ae362f12822e1973a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:02:32 2015 -0500

      iotests: Add tests for refcount table growth

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1423598552-24301-3-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 14a58a4e0c2e98a7d9232e1c229a531ca231133b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:02:31 2015 -0500

      qcow2: Respect new_block in alloc_refcount_block()

      When choosing a new place for the refcount table, alloc_refcount_block()
      tries to infer the number of clusters used so far from its argument
      cluster_index (which comes from the idea that if any cluster with an
      index greater than cluster_index was in use, the refcount table would
      have to be big enough already to describe cluster_index).

      However, there is a cluster that may be at or after cluster_index, and
      which is not covered by the refcount structures, and that is the new
      refcount block new_block. Therefore, it should be taken into account for
      the blocks_used calculation.

      Also, because new_block already describes (or is intended to describe)
      cluster_index, we may not put the new refcount structures there.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1423598552-24301-2-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2867ce4ab86c77579e94c6bb2b6e44ddfcf67f5d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 16:08:02 2015 +0100

      qemu-img: Avoid qerror_report_err() outside QMP handlers, again

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err().

      Commit 6936f29 cleaned that up in qemu-img.c, but two calls have crept
      in since.  Take care of them the same way.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6ec46ad541b20a1530cedc741d19eea9ffc39ac3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 18:51:38 2015 +0100

      block: Fix block-set-write-threshold not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit e246211
      added a use of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a1f688f4152e65260b94f37543521ceff8bfebe4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 21:09:40 2015 +0100

      block: Deprecate QCOW/QCOW2 encryption

      We've steered users away from QCOW/QCOW2 encryption for a while,
      because it's a flawed design (commit 136cd19 Describe flaws in
      qcow/qcow2 encryption in the docs).

      In addition to flawed crypto, we have comically bad usability, and
      plain old bugs.  Let me show you.

      = Example images =

      I'm going to use a raw image as backing file, and two QCOW2 images,
      one encrypted, and one not:

          $ qemu-img create -f raw backing.img 4m
          Formatting 'backing.img', fmt=raw size=4194304
          $ qemu-img create -f qcow2 -o encryption,backing_file=backing.img,backing_fmt=raw geheim.qcow2 4m
          Formatting 'geheim.qcow2', fmt=qcow2 size=4194304 backing_file='backing.img' backing_fmt='raw' encryption=on cluster_size=65536 lazy_refcounts=off
          $ qemu-img create -f qcow2 -o backing_file=backing.img,backing_fmt=raw normal.qcow2 4m
          Formatting 'normal.qcow2', fmt=qcow2 size=4194304 backing_file='backing.img' backing_fmt='raw' encryption=off cluster_size=65536 lazy_refcounts=off

      = Usability issues =

      == Confusing startup ==

      When no image is encrypted, and you don't give -S, QEMU starts the
      guest immediately:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio normal.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: running

      But as soon as there's an encrypted image in play, the guest is *not*
      started, with no notification whatsoever:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: paused (prelaunch)

      If the user figured out that he needs to type "cont" to enter his
      keys, the confusion enters the next level: "cont" asks for at most
      *one* key.  If more are needed, it then silently does nothing.  The
      user has to type "cont" once per encrypted image:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio -drive if=none,file=geheim.qcow2 -drive if=none,file=geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: paused (prelaunch)
          (qemu) c
          none0 (geheim.qcow2) is encrypted.
          Password: ******
          (qemu) info status
          VM status: paused (prelaunch)
          (qemu) c
          none1 (geheim.qcow2) is encrypted.
          Password: ******
          (qemu) info status
          VM status: running

      == Incorrect passwords not caught ==

      All existing encryption schemes give you the GIGO treatment: garbage
      password in, garbage data out.  Guests usually refuse to mount
      garbage, but other usage is prone to data loss.

      == Need to stop the guest to add an encrypted image ==

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: running
          (qemu) drive_add "" if=none,file=geheim.qcow2
          Guest must be stopped for opening of encrypted image
          (qemu) stop
          (qemu) drive_add "" if=none,file=geheim.qcow2
          OK

      Commit c3adb58 added this restriction.  Before, we could expose images
      lacking an encryption key to guests, with potentially catastrophic
      results.  See also "Use without key is not always caught".

      = Bugs =

      == Use without key is not always caught ==

      Encrypted images can be in an intermediate state "opened, but no key".
      The weird startup behavior and the need to stop the guest are there to
      ensure the guest isn't exposed to that state.  But other things still
      are!

      * drive_backup

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) drive_backup -f ide0-hd0 out.img raw
          Formatting 'out.img', fmt=raw size=4194304

        I guess this writes encrypted data to raw image out.img.  Good luck
        with figuring out how to decrypt that again.

      * commit

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) commit ide0-hd0

        I guess this writes encrypted data into the unencrypted raw backing
        image, effectively destroying it.

      == QMP device_add of usb-storage fails when it shouldn't ==

      When the image is encrypted, device_add creates the device, defers
      actually attaching it to when the key becomes available, then fails.
      This is wrong.  device_add must either create the device and succeed,
      or do nothing and fail.

          $ qemu-system-x86_64 -nodefaults -display none -usb -qmp stdio -drive if=none,id=foo,file=geheim.qcow2
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device_add", "arguments": { "driver": "usb-storage", "id": "bar", "drive": "foo" } }
          {"error": {"class": "DeviceEncrypted", "desc": "'foo' (geheim.qcow2) is encrypted"}}
          {"execute":"device_del","arguments": { "id": "bar" } }
          {"timestamp": {"seconds": 1426003440, "microseconds": 237181}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/bar/bar.0/legacy[0]"}}
          {"timestamp": {"seconds": 1426003440, "microseconds": 238231}, "event": "DEVICE_DELETED", "data": {"device": "bar", "path": "/machine/peripheral/bar"}}
          {"return": {}}

      This stuff is worse than useless, it's a trap for users.

      If people become sufficiently interested in encrypted images to
      contribute a cryptographically sane implementation for QCOW2 (or
      whatever other format), then rewriting the necessary support around it
      from scratch will likely be easier and yield better results than
      fixing up the existing mess.

      Let's deprecate the mess now, drop it after a grace period, and move
      on.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 97a2ca7ae6bccb78b2acf10d6d3eebd1e9f3bbdc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Sat Mar 14 10:23:15 2015 +0100

      qemu-img: Fix convert, amend error messages for unknown options

      Message quality regressed in commit dc523cd.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0c304110bd7092cbabff55b45193e13549b53e40
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Sat Mar 14 10:23:14 2015 +0100

      iotests: Update 051's reference output

      Commit c4bacaf improved error reporting, but neglected to update
      051.out.  Commit 2726958 tried to redress, but didn't get it quite
      right (punctuation difference), and shortly after commit
      ae071cc..master improved error reporting some more, neglecting 051.out
      some more.  Sorry!

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b724b012a4ea9877c5ddad254df63735a945618c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:29:24 2015 +0000

      target-tricore: Add instructions of SYS opcode format

      This adds only the non trap instructions.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 2374c4b8375072da1f401c6daccc68ae76c73e63
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Mar 13 12:26:21 2015 -0700

      tcg/optimize: Handle or r,a,a with constant a

      As seen with ubuntu-5.10-live-powerpc.iso.

      Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit eb989d2545832deff386b23c904fc26f78303637
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:04:45 2015 +0000

      target-tricore: Add instructions of RRRW opcode format

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4d108fe33a3f04c9b9e5af1410b1e835d59de003
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:03:18 2015 +0000

      target-tricore: Add instructions of RRRR opcode format

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 068fac77c81b5d227903d0b7ecd108edff4eb0eb
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:55:52 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xe3 as first opcode

      Add helpers helper_subadr_h/_ssov which subs one halfword and adds one
      halfword, rounds / and saturates each half word independently.

      Add microcode helper functions:
          * gen_msubad_h/ads_h: multiply two halfwords left justified and sub from the
                                first one word and add the second one word
                                / and saturate each resulting word independetly.
          * gen_msubadm_h/adms_h: multiply two halfwords in q-format left justified
                                  and sub from the first one word and add to
                                  the second one word / and saturate each resulting
                                  word independetly.
          * gen_msubadr32_h/32s_h: multiply two halfwords in q-format left justified
                                   and sub from the first one word and add to
                                   the second one word, round both results / and
                                   saturate each resulting word independetly.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 62e47b2e6d17020b78a676e086bf98cfeba595b7
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:46:55 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x63 as first opcode

      Add helpers:
          * msub64_q_ssov: multiply two 32 bit q-format number, sub the result from a
                           64 bit q-format number and saturate.
          * msub32_q_sub_ssov: sub two 64 bit q-format numbers and return a 32 bit
                               result.
          * msubr_q_ssov: multiply two 32 bit q-format numbers, sub the result from a 32 bit
                          q-format number and saturate.
          * msubr_q: multiply two 32 bit q-format numbers and sub the result from a 32 bit
                     q-format number.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit f4aef476afc4cab9bb594975401f6902a57aa9b9
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:34:55 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xa3 as first opcode

      Add helpers:
          * sub64_ssov: subs two 64 bit values and saturates the result.
          * subr_h/_ssov: subs two halfwords from two words in q-format with rounding
                          / and saturates each result independetly.

      Add microcode generator:
          * gen_sub64_d: adds two 64 bit values.
          * gen_msub_h/s_h: multiply four halfwords, sub each result left justfied
                            from two word values / and saturate each result.
          * gen_msubm_h/s_h: multiply four halfwords, sub each result left justfied
                             from two words values in q-format / and saturate each
                             result.
          * gen_msubr32/64_h/s_h: multiply four halfwords, sub each result left
                                  justfied from two halftwords/words values in q-format
                                  / and saturate each result.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit bc68d2e5128284c8beb98b1c5b0331a0ed9f3197
  Merge: dcf848c 54ed388
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 14:45:09 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150316' into staging

      migration/next for 20150316

      # gpg: Signature made Mon Mar 16 13:36:37 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150316:
        pc: Disable vmdesc submission for old machines
        migration: Allow to suppress vmdesc submission
        migration: Read JSON VM description on incoming migration
        rename save_block_hdr to save_page_header
        save_block_hdr: we can recalculate the cont parameter here
        save_xbzrle_page: change calling convention
        ram_save_page: change calling covention
        ram_find_and_save_block:  change calling convention
        ram: make all save_page functions take a uint64_t parameter
        Add migrate_incoming
        Add -incoming defer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6c936b74235c2d920790a0ff9feb00b07db239c9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 11:45:18 2015 +0100

      virtio: Fix memory leaks reported by Coverity

      All four leaks are similar, so fix them in one patch.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9e0f5b8108e248b78444c9a2ec41a8309825736c
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Mar 12 17:50:18 2015 +0800

      virtio: validate the existence of handle_output before calling it

      We don't validate the existence of handle_output which may let a buggy
      guest to trigger a SIGSEV easily. E.g:

      1) write 10 to queue_sel to a virtio net device with only 1 queue
      2) setup an arbitrary pfn
      3) then notify queue 10

      Fixing this by validating the existence of handle_output before.

      Cc: qemu-stable@nongnu.org
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>

  commit dcf848c478dd8765bd4f746fc4e80eaad44cf87d
  Merge: 307146c b8d4328
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 13:56:10 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150316' into staging

      target-arm queue:
       * fix handling of execute-never bits in page table walks
       * tell kernel to initialize KVM GIC in realize function
       * fix handling of STM (user) with r15 in register list
       * ignore low bit of PC in M-profile exception return
       * fix linux-user get/set_tls syscalls on CPUs with TZ

      # gpg: Signature made Mon Mar 16 12:39:04 2015 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150316:
        linux-user: Access correct register for get/set_tls syscalls on ARM TZ CPUs
        target-arm: Ignore low bit of PC in M-profile exception return
        target-arm: Fix handling of STM (user) with r15 in register list
        hw/intc/arm_gic: Initialize the vgic in the realize function
        target-arm: get_phys_addr_lpae: more xn control
        target-arm: fix get_phys_addr_v6/SCTLR_AFE access check
        target-arm: convert check_ap to ap_to_rw_prot

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54ed388b29794ab08089f1b5c7b0a03d075c3b5d
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:43 2015 +0100

      pc: Disable vmdesc submission for old machines

      Older PC machine types might by accident be backwards live migration compatible,
      but with the new vmdesc self-describing blob in our live migration stream we
      would break that compatibility.

      Also users wouldn't expect massive behaviorial differences when updating to a
      new version of QEMU while retaining their old machine type, especially not
      potential breakage in tooling around live migration.

      So disable vmdesc submission for old PC machine types.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 9850c6047b8b4343e91da4780a41bb88faeb018a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:42 2015 +0100

      migration: Allow to suppress vmdesc submission

      We now always send a JSON blob describing the migration file format as part
      of the migration stream. However, some tools built around QEMU have proven
      to stumble over this.

      This patch gives the user the chance to disable said self-describing part of
      the migration stream. To disable vmdesc submission, just add

        -machine suppress-vmdesc=on

      to your QEMU command line.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1925cebc4b12903e3a66106893fd97e35c5d0baf
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:41 2015 +0100

      migration: Read JSON VM description on incoming migration

      One of the really nice things about the VM description format is that it goes
      over the wire when live migration is happening. Unfortunately QEMU today closes
      any socket once it sees VM_EOF coming, so we never give the VMDESC the chance to
      actually land on the wire.

      This patch makes QEMU read the description as well. This way we ensure that
      anything wire tapping us in between will get the chance to also interpret the
      stream.

      Along the way we also fix virt tests that assume that number_bytes_sent on the
      sender side is equal to number_bytes_read which was true before the VMDESC
      patches and is true again with this patch.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f6f14c58d542b306b6a0ff207db793d0aba62aa1
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 21:46:40 2015 +0100

      rename save_block_hdr to save_page_header

      It has always been a page header, not a block header.  Once there, the
      flag argument was only passed to make a bit or with it, just do the or
      on the caller.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 73bab2fc2adeb18b26752937f3cf60afa9658a9c
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 21:41:39 2015 +0100

      save_block_hdr: we can recalculate the cont parameter here

      No need to pass it through all the callers.  Once there, update
      last_sent_block here.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f4be0f75f68ec463d07c65cb2f636e6adf1388e6
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 20:16:33 2015 +0100

      save_xbzrle_page: change calling convention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 87cf878b2ea8d24c78ea3210880538aa31459dfd
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 20:03:45 2015 +0100

      ram_save_page: change calling covention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0fcd8d31402bdc7ef7187f005bee8f0799a4cce0
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 19:33:05 2015 +0100

      ram_find_and_save_block:  change calling convention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 6e1dea46b89e137ee1593ded5566d5371a61d304
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 19:02:42 2015 +0100

      ram: make all save_page functions take a uint64_t parameter

      It used to be an int, but then we can't pass directly the
      bytes_transferred parameter, that would happen later in the series.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>

  commit bf1ae1f4dc348650fb7f32a3fcc278f60a7b1bf6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 19 11:40:28 2015 +0000

      Add migrate_incoming

      Add migrate_incoming/migrate-incoming to start an incoming
      migration.

      Once a qemu has been started with
          -incoming defer

      the migration can be started by issuing:
          migrate_incoming uri

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit adde220a93a0192782243d25580a647004f6dd44
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 19 11:40:27 2015 +0000

      Add -incoming defer

      -incoming defer causes qemu to wait for an incoming migration
      to be specified later.  The monitor can be used to set migration
      capabilities that may affect the incoming connection process.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 307146cb9359ad6d4544e00af073088772d165eb
  Merge: 2dfe7d0 4ed7b2c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 13:04:08 2015 +0000

      Merge remote-tracking branch 'remotes/kvaneesh/for-upstream' into staging

      * remotes/kvaneesh/for-upstream:
        virtio: Fix memory leaks reported by Coverity
        virtfs-proxy: Fix possible overflow
        fsdev/virtfs-proxy-helper: Fix improper use of negative value
        hw/9pfs/virtio-9p-posix-acl: Fix out-of-bounds access
        9pfs-proxy: tiny cleanups in proxy_pwritev and proxy_preadv
        9pfs-local: simplify/optimize local_mapped_attr_path()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b8d43285a4db12156c40ba6fdbd8002c383fcbca
  Author: Mikhail Ilyin <m.ilin@samsung.com>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      linux-user: Access correct register for get/set_tls syscalls on ARM TZ CPUs

      When support was added for TrustZone to ARM CPU emulation, we failed
      to correctly update the support for the linux-user implementation of
      the get/set_tls syscalls. This meant that accesses to the TPIDRURO
      register via the syscalls were always using the non-secure copy of
      the register even if native MRC/MCR accesses were using the secure
      register. This inconsistency caused most binaries to segfault on startup
      if the CPU type was explicitly set to one of the TZ-enabled ones like
      cortex-a15. (The default "any" CPU doesn't have TZ enabled and so is
      not affected.)

      Use access_secure_reg() to determine whether we should be using
      the secure or the nonsecure copy of TPIDRURO when emulating these
      syscalls.

      Signed-off-by: Mikhail Ilyin <m.ilin@samsung.com>
      Message-id: 1426505198-2411-1-git-send-email-m.ilin@samsung.com
      [PMM: rewrote commit message to more clearly explain the issue
       and its consequences.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fcf83ab103dce6d2951f24f48e30820e7dbb3622
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      target-arm: Ignore low bit of PC in M-profile exception return

      For the ARM M-profile cores, exception return pops various registers
      including the PC from the stack. The architecture defines that if the
      lowest bit in the new PC value is set (ie the PC is not halfword
      aligned) then behaviour is UNPREDICTABLE. In practice hardware
      implementations seem to simply ignore the low bit, and some buggy
      RTOSes incorrectly rely on this. QEMU's behaviour was architecturally
      permitted, but bringing QEMU into line with the hardware behaviour
      allows more guest code to run. We log the situation as a guest error.

      This was reported as LP:1428657.

      Reported-by: Anders Esbensen <anders@lyes.dk>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da3e53ddcb0ca924da97ca5a35605fc554aa3e05
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      target-arm: Fix handling of STM (user) with r15 in register list

      The A32 encoding of LDM distinguishes LDM (user) from LDM (exception
      return) based on whether r15 is in the register list. However for
      STM (user) there is no equivalent distinction. We were incorrectly
      treating "r15 in list" as indicating exception return for both LDM
      and STM, with the result that an STM (user) involving r15 went into
      an infinite loop. Fix this; note that the value stored for r15
      in this case is the current PC regardless of our current mode.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426015125-5521-1-git-send-email-peter.maydell@linaro.org

  commit f0bb55890a173cb1e9e87d608647cac70f8f9dd4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      hw/intc/arm_gic: Initialize the vgic in the realize function

      This patch forces vgic initialization in the vgic realize function.
      It uses a new group/attribute that allows such operation:
      KVM_DEV_ARM_VGIC_GRP_CTRL/KVM_DEV_ARM_VGIC_CTRL_INIT

      This earlier initialization allows, for example, to setup VFIO
      signaling and irqfd after vgic initialization, on a reset notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Message-id: 1426094226-8515-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d8e052b387635639a6ba4a09a7874fd2f113b218
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: get_phys_addr_lpae: more xn control

      This patch makes the following changes to the determination of
      whether an address is executable, when translating addresses
      using LPAE.

      1. No longer assumes that PL0 can't execute when it can't read.
         It can in AArch64, a difference from AArch32.
      2. Use va_size == 64 to determine we're in AArch64, rather than
         arm_feature(env, ARM_FEATURE_V8), which is insufficient.
      3. Add additional XN determinants
         - NS && is_secure && (SCR & SCR_SIF)
         - WXN && (prot & PAGE_WRITE)
         - AArch64: (prot_PL0 & PAGE_WRITE)
         - AArch32: UWXN && (prot_PL0 & PAGE_WRITE)
         - XN determination should also work in secure mode (untested)
         - XN may even work in EL2 (currently impossible to test)
      4. Cleans up the bloated PAGE_EXEC condition - by removing it.

      The helper get_S1prot is introduced. It may even work in EL2,
      when support for that comes, but, as the function name implies,
      it only works for stage 1 translations.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Message-id: 1426099139-14463-4-git-send-email-drjones@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d76951b65dfb1be4e41cfae6abebf8db7a1243a3
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: fix get_phys_addr_v6/SCTLR_AFE access check

      Introduce simple_ap_to_rw_prot(), which has the same behavior as
      ap_to_rw_prot(), but takes the 2-bit simple AP[2:1] instead of
      the 3-bit AP[2:0]. Use this in get_phys_addr_v6 when SCTLR_AFE
      is set, as that bit indicates we should be using the simple AP
      format.

      It's unlikely this path is getting used. I don't see CR_AFE
      getting used by Linux, so possibly not. If it had been, then
      the check would have been wrong for all but AP[2:1] = 0b11.
      Anyway, this should fix it up, in case it ever does get used.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426099139-14463-3-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0fbf5238203041f734c51b49778223686f14366b
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: convert check_ap to ap_to_rw_prot

      Instead of mixing access permission checking with access permissions
      to page protection flags translation, just do the translation, and
      leave it to the caller to check the protection flags against the access
      type. Also rename to ap_to_rw_prot to better describe the new behavior.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426099139-14463-2-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2dfe7d07e2f40adb18a0b0cd286f3d327692d0fc
  Merge: f421f05 be0b608
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 11:44:55 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150316' into staging

      Final batch of s390x enhancements/fixes for 2.3:
      - handle TOD clock during migration
      - CPACF key wrap options
      - limit amount of pci device code we build
      - ensure big endian accesses for ccws
      - various fixes and cleanups

      # gpg: Signature made Mon Mar 16 10:01:44 2015 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150316:
        s390x/config: Do not include full pci.mak
        s390x/pci: fix length in sei_nt2 event
        s390x/ipl: remove dead code
        s390x/virtio-bus: Remove unused function s390_virtio_bus_console()
        s390x: CPACF: Handle key wrap machine options
        s390x/kvm: make use of generic vm attribute check
        kvm: encapsulate HAS_DEVICE for vm attrs
        virtio-ccw: assure BE accesses
        s390x/kvm: Guest Migration TOD clock synchronization
        s390x: Replace unchecked qdev_init() by qdev_init_nofail()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f421f05754ac5aabe15f12051390204116408b00
  Merge: a8f1b43 93f7c4f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 10:58:11 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-seabios-1.8.1-20150316-1' into staging

      seabios: update to 1.8.1 stable release

      # gpg: Signature made Mon Mar 16 08:09:25 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-seabios-1.8.1-20150316-1:
        seabios: update to 1.8.1 stable release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8f1b43cb023333098a3ebc2630ce2c3db7f7af6
  Merge: 7ccfb49 37ed3bf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 09:42:40 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/tcg-pull-20150313' into staging

      Pool TCG data, and ALWAYS/NEVER fix

      # gpg: Signature made Fri Mar 13 20:09:09 2015 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-pull-20150313:
        tcg: Complete handling of ALWAYS and NEVER
        tcg: Use tcg_malloc to allocate TCGLabel
        tcg: Change generator-side labels to a pointer
        tcg: Change translator-side labels to a pointer
        tcg-ia64: Use tcg_malloc to allocate TCGLabelQemuLdst
        tcg: Use tcg_malloc to allocate TCGLabelQemuLdst

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be0b608a5463a834df0e19911356ae93660d3677
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 12 15:19:14 2015 +0100

      s390x/config: Do not include full pci.mak

      pci.mak includes a lot of devices - and most of them do not make
      sense on s390x, like USB controllers or audio cards. These devices
      also show up when running "qemu-system-s390x -device help" and thus
      could raise the hope for the users that they could use these kind
      of devices with qemu-system-s390x. To avoid this confusion, we
      should not include pci.mak and rather include the bare minimum
      manually instead.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Message-Id: <1426169954-6062-1-git-send-email-thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d3321fc7557cbd51fd0c9c0416c81dbe3f4dc32e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:54 2015 +0100

      s390x/pci: fix length in sei_nt2 event

      The sei_nt2 event must contain the length of the event.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-7-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7b527b86eb3560d68f41218cec0cdf3d60a38323
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:53 2015 +0100

      s390x/ipl: remove dead code

      load_image_targphys already checks the max size and will return
      an error code. So the follow-on check will never trigger.

      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-6-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit eaec461ccc4b308b5718381739afbf9605e47b00
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:52 2015 +0100

      s390x/virtio-bus: Remove unused function s390_virtio_bus_console()

      The function s390_virtio_bus_console() is completely unused and thus
      can be removed safely.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-5-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2eb1cd0768af18fb2398ee7b590e4b81e0e504f9
  Author: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:51 2015 +0100

      s390x: CPACF: Handle key wrap machine options

      Check for the aes_key_wrap and dea_key_wrap machine options and set the
      appropriate KVM device attribute(s) to tell the kernel to enable or disable
      the AES/DEA protected key functions for the guest domain.

      This patch introduces two new machine options for indicating the state of
      AES/DEA key wrapping functions.  This controls whether the guest will
      have access to the AES/DEA crypto functions.

      aes_key_wrap="on | off" is changed to aes-key-wrap="on | off"
      dea_key_wrap="on | off" is changed to dea-key-wrap="on | off"

      Check for the aes-key-wrap and dea-key-wrap machine options and set the
      appropriate KVM device attribute(s) to tell the kernel to enable or disable
      the AES/DEA protected key functions for the guest domain.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-4-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2b147555f78c3c20080b201fd1506467fa0ddf43
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:50 2015 +0100

      s390x/kvm: make use of generic vm attribute check

      By using the new introduced generic interface we
      can remove redundancies and clean up.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Suggested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d0a073a186e4a81ae81435bd5b7286b657a69bfd
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:49 2015 +0100

      kvm: encapsulate HAS_DEVICE for vm attrs

      More and more virtual machine specifics between kvm and qemu will be
      transferred with vm attributes.
      So we encapsulate the common logic in a generic function.

      Additionally we need only to check during initialization if kvm supports
      virtual machine attributes.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Suggested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-2-git-send-email-jfrei@linux.vnet.ibm.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7d45285fc9f75e0a85533ada8fd3aeda48d5d71a
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Mar 11 10:57:50 2015 +0100

      virtio-ccw: assure BE accesses

      All fields in structures transmitted by ccws are big endian; assure
      we handle them as such.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1426067871-17693-2-git-send-email-cornelia.huck@de.ibm.com>

  commit 3f9e59bb5358cd020c5be919129281d202a24058
  Author: Jason J. Herne <jjherne@us.ibm.com>
  Date:   Mon Mar 9 15:56:08 2015 +0100

      s390x/kvm: Guest Migration TOD clock synchronization

      Synchronizes the guest TOD clock across a migration by sending the guest TOD
      clock value to the destination system. If the guest TOD clock is not preserved
      across a migration then the guest's view of time will snap backwards if the
      destination host clock is behind the source host clock. This will cause the
      guest to hang immediately upon resuming on the destination system.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>

      Message-Id: <1425912968-54387-1-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ae4a2bd759d647dd6146d45e4a59a01cf34d6a4d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:49 2015 +0100

      s390x: Replace unchecked qdev_init() by qdev_init_nofail()

      s390_flic_init() is a helper to create and realize either
      "s390-flic-kvm" or "s390-flic-qemu".  When qdev_init() fails, it
      complains to stderr and succeeds.

      Except it can't actually fail, because the "s390-flic-qemu" is a dummy
      without a realize method, and "s390-flic-kvm"'s realize can't fail,
      even when the kernel device is really unavailable.  Odd.

      Replace qdev_init() by qdev_init_nofail() to make "can't fail" locally
      obvious, and get rid of the unreachable error reporting.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1423128889-18260-4-git-send-email-armbru@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 93f7c4f09f6957244d5af0a35309b8ad4ffb64ed
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 16 09:00:49 2015 +0100

      seabios: update to 1.8.1 stable release

      Carries two bugfixes and support for multiple pci root buses.

      git shortlog rel-1.8.0..rel-1.8.1
      =================================

      Ameya Palande (1):
            x86: add barrier to read{b,w,l} and write{b,w,l} functions

      Kevin O'Connor (1):
            smp: Fix smp race introduced in 0673b787

      Marcel Apfelbaum (2):
            fw/pci: scan all buses if extraroots romfile is present
            fw/pci: map memory and IO regions for multiple pci root buses

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4ed7b2c3a78f785a1bcbe575e08c379b166723e3
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 11:45:18 2015 +0100

      virtio: Fix memory leaks reported by Coverity

      All four leaks are similar, so fix them in one patch.
      Success path was not doing memory free.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 25ee9a7fa3f4e09fde48bb184447ff5651ed5fd8
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Sat Mar 14 10:00:16 2015 +0800

      virtfs-proxy: Fix possible overflow

      It's detected by coverity. The socket name specified
      should fit in the sockadd_un.sun_path. If not abort.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 821c447675728ca06c8d2e4ac8a0e7a1adf775b8
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Mon Mar 16 09:20:29 2015 +0800

      fsdev/virtfs-proxy-helper: Fix improper use of negative value

      It's detected by coverity. Check the return value of proxy_marshal.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 37ed3bf1ee07bb1a26adca0df8718f601f231c0b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 20 11:13:50 2015 -0800

      tcg: Complete handling of ALWAYS and NEVER

      Missing from movcond, and brcondi_i32 (but not brcondi_i64).

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 51e3972c41598adc91fe3f4767057f5198dcc15c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 18:51:05 2015 -0800

      tcg: Use tcg_malloc to allocate TCGLabel

      Pre-allocating 512 of them per TB is a waste.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit bec1631100323fac0900aea71043d5c4e22fc2fa
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 13:39:54 2015 -0800

      tcg: Change generator-side labels to a pointer

      This is less about improved type checking than enabling a
      subsequent change to the representation of labels.

      Acked-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 42a268c241183877192c376d03bd9b6d527407c7
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 12:51:55 2015 -0800

      tcg: Change translator-side labels to a pointer

      This is improved type checking for the translators -- it's no longer
      possible to accidentally swap arguments to the branch functions.

      Note that the code generating backends still manipulate labels as int.

      With notable exceptions, the scope of the change is just a few lines
      for each target, so it's not worth building extra machinery to do this
      change in per-target increments.

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3f626793a2182061e3aa50a9e2ed7a322582a60f
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Sep 30 07:25:30 2014 -0700

      tcg-ia64: Use tcg_malloc to allocate TCGLabelQemuLdst

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 686461c96254f34bcce67a949c72867ab6ec3fcf
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Sep 30 07:18:06 2014 -0700

      tcg: Use tcg_malloc to allocate TCGLabelQemuLdst

      Pre-allocating 640 of them per TB is a waste.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7ccfb495c64e1eef5886dcc4d48523ed6d1d22a4
  Author: Tobias Nygren <tnn@NetBSD.org>
  Date:   Thu Mar 5 22:37:41 2015 +0100

      user-exec.c: fix build on NetBSD/sparc64 and NetBSD/arm

      A couple of #ifdef changes necessary to use NetBSD's ucontext
      structs on sparc64 and arm.

      Signed-off-by: Tobias Nygren <tnn@NetBSD.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1425591461-17550-1-git-send-email-tnn@NetBSD.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dea46359989121b43924cd89acd03795383f54f6
  Merge: f3dd251 43db7c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 14:03:31 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150312-2' into staging

      misc ui patches, mostly sdl related.

      # gpg: Signature made Thu Mar 12 14:51:07 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150312-2:
        pixman: add a bunch of PIXMAN_BE_* defines for 32bpp
        Allow the use of X11 from a non standard location.
        configure: opengl overhaul
        sdl: Fix crash when calling sdl_switch() with NULL surface
        sdl: Refresh debug statements

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3dd251de1f87c1d7492fca742924f004b7091cd
  Merge: 82389dc 09c0772
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 11:51:00 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

      Update OpenBIOS images

      # gpg: Signature made Fri Mar 13 11:04:07 2015 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-openbios-signed:
        Update OpenBIOS images

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 09c0772be9b44e9c6388caac0beb744bc59f6d71
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Mar 12 08:13:07 2015 +0000

      Update OpenBIOS images

      Update OpenBIOS images to SVN r1334 built from submodule.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 82389dcc133d9d6aa3418fbbb59d784dd8d0e88c
  Merge: f9f141b 069bb58
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 11:00:57 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Thu Mar 12 20:06:50 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        tests: rtl8139: test timers and interrupt
        net: synchronize net_host_device_remove with host_net_remove_completion

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9f141b7475acfed1b6a28809687109702295be3
  Merge: 2a5b58e 87b86e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 09:54:23 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Mar 12 19:09:26 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        qcow2: fix the macro QCOW_MAX_L1_SIZE's use
        queue: fix QSLIST_INSERT_HEAD_ATOMIC race

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9005c3b3efb7eb1b140d2ad0385efff6a3af59c4
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Fri Mar 13 13:48:07 2015 +0800

      hw/9pfs/virtio-9p-posix-acl: Fix out-of-bounds access

      It's detected by coverity. Fix out-of-bounds access of the function mp_dacl_listxattr.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 069bb5831faf19d02041569580ad77565776bb1c
  Author: Frediano Ziglio <freddy77@gmail.com>
  Date:   Thu Jan 8 18:38:23 2015 +0000

      tests: rtl8139: test timers and interrupt

      Test behaviour of timers and interrupts related to timeouts.

      Signed-off-by: Frediano Ziglio <freddy77@gmail.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1420742303-3030-1-git-send-email-freddy77@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7fb439115de7354b3ac2becf24457acaf828296b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 17:53:20 2014 +0100

      net: synchronize net_host_device_remove with host_net_remove_completion

      Using net_host_check_device is unnecessary.  qemu_del_net_client asserts
      for the non-peer case that it can only process NIC type NetClientStates,
      and that assertion is valid for the peered case as well, so move it and
      use the same check in net_host_device_remove.  host_net_remove_completion
      is already checking the type.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1419353600-30519-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 87b86e7ef29771a7fa06e3e8e88fa95bbc13a39c
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Mar 11 11:05:21 2015 +0800

      qcow2: fix the macro QCOW_MAX_L1_SIZE's use

      QCOW_MAX_L1_SIZE's unit is byte, and l1_size's unit
      is l1 table entry size(8 bytes).

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-id: 54FFB0F1.5010307@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2120465fbb87a69bd60283ec4034a0963766a7ef
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 10 16:45:57 2015 +0100

      queue: fix QSLIST_INSERT_HEAD_ATOMIC race

      There is a not-so-subtle race in QSLIST_INSERT_HEAD_ATOMIC.

      Because atomic_cmpxchg returns the old value instead of a success flag,
      QSLIST_INSERT_HEAD_ATOMIC was checking for success by comparing against
      the second argument to atomic_cmpxchg.  Unfortunately, this only works
      if the second argument is a local or thread-local variable.

      If it is in memory, it can be subject to common subexpression elimination
      (and then everything's fine) or reloaded after the atomic_cmpxchg,
      depending on the compiler's whims.  If the latter happens, the race can
      happen.  A thread can sneak in, doing something on elm->field.sle_next
      after the atomic_cmpxchg and before the comparison.  This causes a wrong
      failure, and then two threads are using "elm" at the same time.  In the
      case discovered by Christian, the sequence was likely something like this:

          thread 1                   | thread 2
          QSLIST_INSERT_HEAD_ATOMIC  |
            atomic_cmpxchg succeeds  |
            elm added to list        |
                                     | steal release_pool
                                     | QSLIST_REMOVE_HEAD
                                     | elm removed from list
                                     | ...
                                     | QSLIST_INSERT_HEAD_ATOMIC
                                     |   (overwrites sle_next)
            spurious failure         |
            atomic_cmpxchg succeeds  |
            elm added to list again  |
                                     |
          steal release_pool         |
          QSLIST_REMOVE_HEAD         |
          elm removed again          |

      The last three steps could be done by a third thread as well.
      A reproducer that failed in a matter of seconds is as follows:

      - the guest has 32 VCPUs on a 28 core host (hyperthreading was enabled),
        memory was 16G just to err on the safe side (the host has 64G, but hey
        at least you need no s390)

      - the guest has 24 null-aio virtio-blk devices using dataplane
        (-object iothread,id=ioN -drive if=none,id=blkN,driver=null-aio,size=500G
        -device virtio-blk-pci,iothread=ioN,drive=blkN)

      - the guest also has a single network interface.  It's only doing loopback
        tests so slirp vs. tap and the model doesn't matter.

      - the guest is running fio with the following script:

           [global]
           rw=randread
           blocksize=16k
           ioengine=libaio
           runtime=10m
           buffered=0
           fallocate=none
           time_based
           iodepth=32

           [virtio1a]
           filename=/dev/block/252\:16

           [virtio1b]
           filename=/dev/block/252\:16

           ...

           [virtio24a]
           filename=/dev/block/252\:384

           [virtio24b]
           filename=/dev/block/252\:384

           [listen1]
           protocol=tcp
           ioengine=net
           port=12345
           listen
           rw=read
           bs=4k
           size=1000g

           [connect1]
           protocol=tcp
           hostname=localhost
           ioengine=net
           port=12345
           protocol=tcp
           rw=write
           startdelay=1
           size=1000g

           ...

           [listen8]
           protocol=tcp
           ioengine=net
           port=12352
           listen
           rw=read
           bs=4k
           size=1000g

           [connect8]
           protocol=tcp
           hostname=localhost
           ioengine=net
           port=12352
           rw=write
           startdelay=1
           size=1000g

      Moral of the story: I should refrain from writing more clever stuff.
      At least it looks like it is not too clever to be undebuggable.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1426002357-6889-1-git-send-email-pbonzini@redhat.com
      Fixes: c740ad92d0d958fa785e5d7aa1b67ecaf30a6a54
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 43db7c3d484943f62019434d919367c9e3e4402a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 16 14:44:59 2015 +0100

      pixman: add a bunch of PIXMAN_BE_* defines for 32bpp

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f676c67e4be3d4687ca67f35432b8ea4c1d4cc38
  Author: Jeremy White <jwhite@codeweavers.com>
  Date:   Fri Jan 9 13:08:49 2015 -0600

      Allow the use of X11 from a non standard location.

      Signed-off-by: Jeremy White <jwhite@codeweavers.com>

      [ kraxel: solve opengl patch conflicts ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit da076ffed6b9a9cb6b1afce78a4de743212db36e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Nov 20 09:49:44 2014 +0100

      configure: opengl overhaul

      Rename config option from "glx" to "opengl", glx will not be the only
      option for opengl in near future.  Also switch over to pkg-config for
      opengl support detection.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit d28d6505bd72f0d6e3e7a968c60c27f893da976e
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 15:11:22 2014 +1000

      sdl: Fix crash when calling sdl_switch() with NULL surface

      This happens for example when doing ctrl-alt-u and segfaults

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5f5d82ddf1789d32d8921c022261be59e4dcd283
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 15:10:12 2014 +1000

      sdl: Refresh debug statements

      Put them under a #define similar to the VGA model and make them
      actually compile. Add a couple too.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2a5b58e2405e9fe42ba356b5a1b78146a4e9a659
  Merge: a195fdd 81607cb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 12 10:35:53 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150312-1' into staging

      vnc: bugfixes and cleanups.

      # gpg: Signature made Thu Mar 12 08:58:39 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150312-1:
        vnc: fix segmentation fault when invalid vnc parameters are specified
        vnc: avoid possible file handler leak
        ui/console: fix OVERFLOW_BEFORE_WIDEN
        ui: fix regression in x509verify parameter for VNC server
        vnc: switch to inet_listen_opts
        vnc: remove dead code
        vnc: drop display+ws_display from VncDisplay

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7752efcacf41daf34f9fefc5e78131f2afa3d4d7
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:36:12 2015 +0300

      9pfs-proxy: tiny cleanups in proxy_pwritev and proxy_preadv

      Don't compare syscall return with -1, use "<0" condition.
      Don't introduce useless local variables when we already
      have similar variable
      Rename local variable to be consistent with other usages
      Finally make the two methods, read and write, to be similar to each other

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 1b6f85e2cb9302a8587772d04983a3ecc0ecfe68
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:52:30 2015 +0300

      9pfs-local: simplify/optimize local_mapped_attr_path()

      Omit one unnecessary memory allocation for components
      of the path and create the resulting path directly given
      lengths of the components.

      Do not use basename(3) because there are 2 versions of
      this function which differs when argument ends with
      slash character, use strrchr() instead so we have
      consistent result.  This also makes sure the function
      will do the right thing in corner cases (eg, empty
      pathname is given), when basename(3) return entirely
      another string.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit a195fdd028370faa54ba3d627f1add8401ac5193
  Merge: ee74801 18bf9e2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 12 09:13:06 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      misc fixes and cleanups

      A bunch of fixes all over the place, some of the
      bugs fixed are actually regressions.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 11 17:48:30 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
      #      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

      * remotes/mst/tags/for_upstream: (25 commits)
        virtio-scsi: remove empty wrapper for cmd
        virtio-scsi: clean out duplicate cdb field
        virtio-scsi: fix cdb/sense size
        uapi/virtio_scsi: allow overriding CDB/SENSE size
        virtio-scsi: drop duplicate CDB/SENSE SIZE
        exec: don't include hw/boards for linux-user
        acpi: specify format for build_append_namestring
        MAINTAINERS: drop aliguori@amazon.com
        tpm: Move memory subregion function into realize function
        virtio-pci: Convert to realize()
        pci: Convert pci_nic_init() to Error to avoid qdev_init()
        machine: query mem-merge machine property
        machine: query dump-guest-core machine property
        hw/boards: make it safe to include for linux-user
        machine: query phandle-start machine property
        machine: query kvm-shadow-mem machine property
        kvm: add machine state to kvm_arch_init
        machine: query kernel-irqchip property
        machine: allowed/required kernel-irqchip support
        machine: replace qemu opts with iommu property
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 81607cbfa433272d1f09bd0f0ae6c3b14f818972
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 12 15:33:45 2015 +0800

      vnc: fix segmentation fault when invalid vnc parameters are specified

      Reproducer:
       #./qemu-system-x86_64 -vnc :0,ip
      qemu-system-x86_64: -vnc :1,ip: Invalid parameter 'ip'
      Segmentation fault (core dumped)

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b3c33f91732ea32e7a8391c5e61c3fc02308d822
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 11 16:21:01 2015 +0800

      vnc: avoid possible file handler leak

      vs->lsock may equal to 0, modify the check condition,
      avoid possible vs->lsock leak.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f76b84a04b75e98eee56e8dc277564d0fbb99018
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 11 16:21:00 2015 +0800

      ui/console: fix OVERFLOW_BEFORE_WIDEN

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 8c7d06457311b13bc65c9b24df5d895b2826b8c5
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 10 16:27:34 2015 +0000

      ui: fix regression in x509verify parameter for VNC server

      The 'x509verify' parameter is documented as taking a path to the
      x509 certificates, ie the same syntax as the 'x509' parameter.

        commit 4db14629c38611061fc19ec6927405923de84f08
        Author: Gerd Hoffmann <kraxel@redhat.com>
        Date:   Tue Sep 16 12:33:03 2014 +0200

          vnc: switch to QemuOpts, allow multiple servers

      caused a regression by turning 'x509verify' into a boolean
      parameter instead. This breaks setup from libvirt and is not
      consistent with the docs.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e556032960eaa403da6069aa9abf4dcaddefd710
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 11:31:44 2015 +0100

      vnc: switch to inet_listen_opts

      Use inet_listen_opts instead of inet_listen.  Allows us to drop some
      pointless indirection:  Format strings just to parse them again later on.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit fc5c3ff75135fcc02ca3453568d212241d2bc40f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 11:03:17 2015 +0100

      vnc: remove dead code

      If vs->ws_enabled is set ws_display is non-NULL.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit bf7aa45e7b378691ea0e8616a2aeae2aaabb7bc3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 10:46:49 2015 +0100

      vnc: drop display+ws_display from VncDisplay

      Nobody cares about those strings, they are only used to check whenever
      the vnc server / websocket support is enabled or not.  Add bools for
      this and drop the strings.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit ee74801035b0b5f1fdfd4e31d3a53f511f91c804
  Merge: d598911 6445111
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 18:22:15 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150311' into staging

      MIPS patches 2015-03-11

      Changes:
      * use VMStateDescription for MIPS CPU

      # gpg: Signature made Wed Mar 11 15:01:52 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150311:
        target-mips: add missing MSACSR and restore fp_status and hflags
        target-mips: replace cpu_save/cpu_load with VMStateDescription

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 18bf9e2f379334306530cbfd44218748eceaf67d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 15:10:09 2015 +0100

      virtio-scsi: remove empty wrapper for cmd

      The anonymous struct only has a single field now, drop the wrapper
      structure.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bb72463bc80d90d104a996a111dd8bb39bff58d0
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:35:47 2015 +0100

      virtio-scsi: clean out duplicate cdb field

      cdb is now part of cmd, drop it from req.
      There's also nothing to check using build assert now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03325525c3a607825ab67bf36bffaa5cf8447df2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:31:29 2015 +0100

      virtio-scsi: fix cdb/sense size

      Commit "virtio-scsi: use standard-headers" added
      cdb and sense into req/rep structures, which
      breaks uses of sizeof for these structures,
      since qemu adds its own arrays on top.

      To fix, redefine CDB/sense field size to 0.

      Reported-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2106ba30105969262a7810417a57524d9a225b91
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:19:03 2015 +0100

      uapi/virtio_scsi: allow overriding CDB/SENSE size

      QEMU wants to use virtio scsi structures with
      a different VIRTIO_SCSI_CDB_SIZE/VIRTIO_SCSI_SENSE_SIZE,
      let's add ifdefs to allow overriding them.

      Keep the old defines under new names:
      VIRTIO_SCSI_CDB_DEFAULT_SIZE/VIRTIO_SCSI_SENSE_DEFAULT_SIZE,
      since that's what these values really are:
      defaults for cdb/sense size fields.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e7cc8ba22ece189a44fa08671426cbc4377e2056
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:25:25 2015 +0100

      virtio-scsi: drop duplicate CDB/SENSE SIZE

      This is duplicated from the kernel header,
      drop our copy.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4485bd269c0e1c051d21d0196be89cdba23d9520
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 07:56:34 2015 +0100

      exec: don't include hw/boards for linux-user

      As noted by Andreas, hw/boards.h shouldn't be used outside softmmu code.
      Include it conditionally, and drop the (now unnecessary) ifdef guards in
      hw/boards.h

      Reported-by: Andreas Färber <afaerber@suse.de>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit 7927266183583f1fa90323890b21d2c03ed244f6
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 18:13:15 2015 +0100

      acpi: specify format for build_append_namestring

      Will catch users if we misused it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 238d7497b9268b1f91c07829de1f75b88011d76f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 16:04:42 2015 +0100

      MAINTAINERS: drop aliguori@amazon.com

      It's sad when a friend leaves, but we have to move on.

      Drop Anthony's email from MAINTAINERS so he stops getting
      irrelevant email.

      Got Anthony's ack off-list.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Anthony Liguori <aliguori@amazon.com>

  commit 9dfd24ed848228643293e37c36848b5ac520ab98
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Tue Mar 10 06:34:01 2015 -0400

      tpm: Move memory subregion function into realize function

      Move the memory subregion function into the DeviceClass realize function
      due to isa_address_space (now) crashing if called in the instance init
      function.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc079951b7a5eb799bd24d18e4098aa03a3c79dd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:52:14 2015 +0100

      virtio-pci: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 558ecef29240c5a901648f4d44789ac3b07a68ea
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 15:40:25 2015 +0100

      pci: Convert pci_nic_init() to Error to avoid qdev_init()

      qdev_init() is deprecated, and will be removed when its callers have
      been weaned off it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 75cc7f018328e708d94cca23c3a77e85363f25dc
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:55 2015 +0200

      machine: query mem-merge machine property

      Running
          qemu-bin ... -machine pc,mem-merge=on
      leads to crash:
          x86_64-softmmu/qemu-system-x86_64 -machine pc,dump-guest-core=on
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 47c8ca533e502955a4e1b24056639c79500ab8f8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:54 2015 +0200

      machine: query dump-guest-core machine property

      Running
          qemu-bin ... -machine pc,dump-guest-core=on
      leads to crash:
          x86_64-softmmu/qemu-system-x86_64 -machine pc,dump-guest-core=on
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66bd56694beef7fb8687767e6bec0264227c6b14
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 18:20:07 2015 +0100

      hw/boards: make it safe to include for linux-user

      Make it safe to include hw/boards.h in exec.c
      for linux-user configurations.
      We don't need any of its contents though.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6cabe7fa6deeffeed9a3e6d996d6107c94965948
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:53 2015 +0200

      machine: query phandle-start machine property

      Commit e79d5a6 ("machine: remove qemu_machine_opts global list") removed
      the global option descriptions and moved them to MachineState's QOM
      properties.

      Query phandle-start by accessing machine properties through designated
      wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4689b77bda5187d4e2aac78bf21cc1a86502652d
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:52 2015 +0200

      machine: query kvm-shadow-mem machine property

      Commit e79d5a6 ("machine: remove qemu_machine_opts global list") removed
      the global option descriptions and moved them to MachineState's QOM
      properties.

      Query kvm-shadow-mem by accessing machine properties through designated
      wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b16565b396dbbb4c99899dbea599b22f4e0658d6
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:51 2015 +0200

      kvm: add machine state to kvm_arch_init

      Needed to query machine's properties.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 446f16a6906e9d05aa9ce0dde727d4f731a89298
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Mar 10 18:59:54 2015 +0200

      machine: query kernel-irqchip property

      Running
          x86_64-softmmu/qemu-system-x86_64 -machine pc,kernel_irqchip=on -enable-kvm
      leads to crash:
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d8870d0217216478888c2d3dd6bf62e155d978c8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:49 2015 +0200

      machine: allowed/required kernel-irqchip support

      The code using kernel-irqchip property requires 'allowed/required'
      functionality. Replace machine's kernel_irqchip field with two fields
      representing the new functionality and expose them through wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8caff63699a9bd6b82556bd527ff023c443ada2d
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:48 2015 +0200

      machine: replace qemu opts with iommu property

      Fixes a QEMU crash when passing iommu parameter in command line.
      Running
          x86_64-softmmu/qemu-system-x86_64 -machine pc,iommu=on -enable-kvm
      leads to crash:
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.
          Aborted (core dumped)

      This happens because commit e79d5a6 ("machine: remove qemu_machine_opts global
      list") removed the global option descriptions and moved them to MachineState's
      QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d598911b6f5e7bf7bafb63b8e1d074729e94aca7
  Merge: 165fa40 4f99505
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 16:30:33 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150311' into staging

      target-arm queue:
       * fix a bug in bitops.h
       * implement SD card support on integratorcp
       * add a missing 'compatible' property for Cortex-A57
       * add Netduino 2 machine model
       * fix command line parsing bug for CPU options with multiple CPUs

      # gpg: Signature made Wed Mar 11 14:14:22 2015 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150311:
        bitops.h: sextract64() return type should be int64_t, not uint64_t
        integrator/cp: Implement CARDIN and WPROT signals
        integrator/cp: Model CP control registers as sysbus device
        target-arm: Add missing compatible property to A57
        netduino2: Add the Netduino 2 Machine
        stm32f205: Add the stm32f205 SoC
        stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG
        stm32f2xx_USART: Add the stm32f2xx USART Controller
        stm32f2xx_timer: Add the stm32f2xx Timer
        hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 165fa4091e97bfafbf394acb446623b92998175f
  Merge: 9159eb9 2d5eeef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 15:11:58 2015 +0000

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150310' into staging

      s390x/kvm: Features and fixes for 2.3

      - an extension to the elf loader to allow relocations
      - make the ccw bios relocatable. This allows for bigger ramdisks
        or smaller guests
      - Handle all slow SIGPs in QEMU (instead of kernel) for better
        compliance and correctness
      - tell the KVM module the maximum guest size. This allows KVM
        to reduce the number or page table levels
      - Several fixes/cleanups

      # gpg: Signature made Wed Mar 11 10:17:13 2015 GMT using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150310:
        s390-ccw: rebuild BIOS
        s390/bios: Make the s390-ccw.img relocatable
        elf-loader: Provide the possibility to relocate s390 ELF files
        s390-ccw.img: Reinitialize guessing on reboot
        s390-ccw.img: Allow bigger ramdisk sizes or offsets
        s390x/kvm: passing max memory size to accelerator
        virtio-ccw: Convert to realize()
        virtio-s390: Convert to realize()
        virtio-s390: s390_virtio_device_init() can't fail, simplify
        s390x/kvm: enable the new SIGP handling in user space
        s390x/kvm: deliver SIGP RESTART directly if stopped
        s390x: add function to deliver restart irqs
        s390x/kvm: SIGP START is only applicable when STOPPED
        s390x/kvm: implement handling of new SIGP orders
        s390x/kvm: trace all SIGP orders
        s390x/kvm: helper to set the SIGP status in SigpInfo
        s390x/kvm: pass the SIGP instruction parameter to the SIGP handler
        s390x/kvm: more details for SIGP handler with one destination vcpu
        s390x: introduce defines for SIGP condition codes
        synchronize Linux headers to 4.0-rc3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5820945946b1e221905aa898f2cd97ed825acd47
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Mar 9 15:59:46 2015 +0100

      pci/shpc: fix signed integer overflow

      clang undefined behaviour sanitizer reports:
      > hw/pci/shpc.c:162:27: runtime error: left shift of 1 by 31 places
      > cannot be represented in type 'int'

      Caused by the usual lack of a 'U' qualifier on a constant 1 being
      shifted left. Fix it up.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 92bf484a87882aa23f10412c774a7357b9bd2be0
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 15:07:13 2015 +0100

      acpi-test: update expected files

      commit ecdc7bab095a2cf29d9e9d4a7e1494f586a8b270
          "acpi: fix aml_equal term implementation"
      dropped a useless Zero in generated code,
      update expected files appropriately.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9159eb9abc31e02797dc55998e71f12c06846d55
  Merge: 8d86e34 b18a755
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 14:27:13 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/vser-for-2.3-1' into staging

      virtio-serial: fix crash on port hotplug when a previously-added port
      did not have the 'name' property set.

      # gpg: Signature made Wed Mar 11 11:13:53 2015 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/vser-for-2.3-1:
        virtio-serial: fix segfault on NULL port names

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 644511117e7ca9f26d633a59c202a297113a796c
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Feb 20 13:07:45 2015 +0000

      target-mips: add missing MSACSR and restore fp_status and hflags

      Save MSACSR state. Also remove fp_status, msa_fp_status, hflags and restore
      them in post_load() from the architectural registers.
      Float exception flags are not present in vmstate. Information they carry
      is used only by softfloat caller who translates them into MIPS FCSR.Cause,
      FCSR.Flags and then they are cleared. Therefore there is no need for saving
      them in vmstate.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 04cd79625fa4103c5839ba36ad476dd22f7f7557
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Feb 20 13:07:44 2015 +0000

      target-mips: replace cpu_save/cpu_load with VMStateDescription

      Create VMStateDescription for MIPS CPU. The new structure contains exactly the
      same fields as before, therefore leaving existing version_id.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4f9950520a115acf9c0a209f0befa45758ad0215
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      bitops.h: sextract64() return type should be int64_t, not uint64_t

      The documentation for sextract64() claims that the return type is
      an int64_t, but the code itself disagrees. Fix the return type to
      conform to the documentation and to bring it into line with
      sextract32(), which returns int32_t.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1423231328-15662-1-git-send-email-peter.maydell@linaro.org

  commit 83d0cf895f9b1c35fb56d3c93fd3504bc1ac8344
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      integrator/cp: Implement CARDIN and WPROT signals

      This allows to use the SD card emulation of the board: Forward the
      signals from the pl181 top the CP control register emulation, report the
      current state via CP_INTREG, deliver CARDIN IRQ to the secondary
      interrupt controller and also support clearing that line via CP_INTREG.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Message-id: c55d9fb28d19ec83625cb0074b3b6f2e5958caf6.1426004843.git.jan.kiszka@siemens.com
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffc8542a660c447db6ba972b71b4903458309e7e
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      integrator/cp: Model CP control registers as sysbus device

      No new features yet, just encapsulation.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Message-id: 3829c7c7e01cd3ccf15a1198f114e4d675974ae0.1426004843.git.jan.kiszka@siemens.com
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0458b7b5b87be2422a67912c222aa1ec97fe94fa
  Author: Ryota Ozaki <ozaki.ryota@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      target-arm: Add missing compatible property to A57

      Signed-off-by: Ryota Ozaki <ozaki.ryota@gmail.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1424097799-11002-1-git-send-email-ozaki.ryota@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da6bd924c049068723b91b97610940d63ce57850
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      netduino2: Add the Netduino 2 Machine

      This patch adds the Netduino 2 Machine.

      This is a Cortex-M3 based machine. Information can be found at:
      http://www.netduino.com/netduino2/specs.htm

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5bd999824f14252c122c4501cc973cee986eadd7.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit db635521a02c951d03ad7b373acfa92a8ff4359e
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      stm32f205: Add the stm32f205 SoC

      This patch adds the stm32f205 SoC. This will be used by the
      Netduino 2 to create a machine.

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 48d509747a1ea0d8a7d5480560495e679990f9d2.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bbbbd9002ffe9d03851bc87ab326b01378f93faf
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG

      This patch adds the stm32f2xx System Configuration
      Controller. This is used to configure what memory is mapped
      at address 0 (although that is not supported) as well
      as configure how the EXTI interrupts work (also not
      supported at the moment).

      This device is not required for basic examples, but more
      complex systems will require it (as well as the EXTI device)

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5d499d7b60b61d5d6dcb310b2e55411b1f53794e.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 73af5d1115255ac921e3169d2d7376e5bc9d2838
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_USART: Add the stm32f2xx USART Controller

      This patch adds the stm32f2xx USART controller
      (UART also uses the same controller).

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 762c6c0d2a41d574932bc4445ec9bfffe6da8798.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be2847051421119f64a0134b5654a5134658d379
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_timer: Add the stm32f2xx Timer

      This patch adds the stm32f2xx timers: TIM2, TIM3, TIM4 and TIM5
      to QEMU.

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 155091a323390f8da3cca496e4c611c493e62a77.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 886bc7a0492ff5d3b6c42157afff827b68595c34
  Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

      The recently introduced feature that allows 32 bit guests to be
      executed under KVM on a 64-bit host incorrectly handles the case
      where more than 1 cpu is specified using '-smp N'

      For instance, this invocation of qemu

        qemu-system-aarch64 -M virt -cpu cortex-a57,aarch64=off -smp 2

      produces the following error

        qemu-system-aarch64: Expected key=value format, found aarch64

      which is caused by the destructive parsing performed by
      cpu_common_parse_features(), resulting in subsequent attempts
      to parse the CPU option string (for each additional CPU) to fail.

      So duplicate the string before parsing it, and free it directly
      afterwards.

      Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1425402380-10488-1-git-send-email-ard.biesheuvel@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8d86e34e65d6d4c8201de6356635f34d38391a93
  Merge: 4841237 2994fd9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 12:50:51 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * Add CPUClass documentation
      * Clean up X86CPU APIC realization
      * Cleanups around cpu_init()

      # gpg: Signature made Tue Mar 10 17:27:28 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter:
        cpu: Make cpu_init() return QOM CPUState object
        unicore32: Use uc32_cpu_init()
        m68k: Use cpu_m68k_init()
        target-unicore32: Make uc32_cpu_init() return UniCore32CPU
        target-i386: Clean up misuse of qdev_init() in realize method
        cpu: Add missing documentation for some CPUClass methods

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 48412371415a260d00fc7fdcdb400da55f268828
  Merge: 4ba4df4 9886e83
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 11:12:35 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 patches queued in the last few weeks. Mostly code cleanup and changes on
      code assigning APIC ID.

      # gpg: Signature made Mon Mar  9 20:40:38 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Require APIC ID to be explicitly set before CPU realize
        target-i386: Move APIC ID compatibility code to pc.c
        target-i386: Move CPUX86State::cpuid_apic_id to X86CPU::apic_id
        target-i386: Remove unused APIC ID default code
        target-i386: Eliminate unnecessary get_cpuid_vendor() function
        target-i386: Simplify listflags() function
        target-i386: Move topology.h to include/hw/i386

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b18a755c4266a340a25ab4118525bd57c3dfc3fa
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Wed Mar 4 14:29:52 2015 +0530

      virtio-serial: fix segfault on NULL port names

      Commit d0a0bfe6729ef6044d76ea49fafa07e29fa598bd added checks for port
      names, but didn't add a check to ensure port->name is non-NULL.  This
      results in a SIGSEGV when adding a port when one of the previously-added
      ports didn't have the 'name' property set.

      https://bugzilla.redhat.com/show_bug.cgi?id=1192775

      Reported-by: vivian zhang <vivianzhang@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 2d5eeef1c0be68c30ccd60fd7267690d523f702a
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 9 09:45:44 2015 +0100

      s390-ccw: rebuild BIOS

      rebuild bios to get latest changes:

      s390/bios: Make the s390-ccw.img relocatable
      s390-ccw.img: Reinitialize guessing on reboot
      s390-ccw.img: Allow bigger ramdisk sizes or offsets

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d884c86dcd3b64406cf5ce2373374cee6b475ecb
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Mar 9 11:12:53 2015 +0100

      s390/bios: Make the s390-ccw.img relocatable

      The current bios sits at location 0x7e00000 in the guest RAM
      and thus prevents loading of bigger ramdisks. By making the
      image relocatable we can move it to the end of the RAM so that
      it is getting out of the way.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Message-Id: <1425895973-15239-3-git-send-email-thuth@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [Fixup build failure on 32 bit hosts]

  commit 4ba4df405c766b7f9e46ef145e140961155348e6
  Merge: 21025c2 f3b18f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 08:44:59 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

      qemu-sparc update

      # gpg: Signature made Tue Mar 10 13:39:51 2015 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-sparc-signed:
        sun4u: switch m48t59 NVRAM to MMIO access
        MAINTAINERS: add myself as SPARC maintainer
        doc: minor updates to SPARC32 and SPARC64 documentation
        m48t59: add m48t59 sysbus device
        m48t59: introduce new base-year qdev property
        m48t59: let init functions return a Nvram object
        m48t59: add a Nvram interface
        m48t59: register a QOM type for each nvram type we support
        m48t59: move ISA ports/memory regions registration to QOM constructor

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21025c29f5cc716cea8a8865d96fa259acbd4d47
  Merge: 23a7a28 b57489c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 19:28:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150310-1' into staging

      vnc bugfixes.

      # gpg: Signature made Tue Mar 10 10:37:51 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150310-1:
        Fix crash when connecting to VNC through websocket
        vnc: -readconfig fix
        vnc: set id at parse time not init time

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 23a7a287967089d70a7e30ca4c7421674691c503
  Merge: 1976058 ac57622
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 18:03:02 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - scsi: improvements to error reporting and conversion to realize,
        Coverity/sparse fix for iscsi driver
      - RCU fallout: fix -daemonize and s390x system emulation
      - KVM: kvm_stat improvements and new man page
      - x86: SYSRET fix for VxWorks

      # gpg: Signature made Tue Mar 10 10:18:45 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        x86: fix SS selector in SYSRET
        scsi: Convert remaining PCI HBAs to realize()
        scsi: Improve error reporting for invalid drive property
        hw: Propagate errors through qdev_prop_set_drive()
        scsi: Clean up duplicated error in legacy if=scsi code
        cpus: initialize cpu->memory_dispatch
        rcu: handle forks safely
        qemu-thread: do not use PTHREAD_MUTEX_ERRORCHECK
        kvm_stat: add kvm_stat.1 man page
        kvm_stat: add column headers to text UI
        iscsi: Fix check for username

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2994fd96d986578a342f2342501b4ad30f6d0a85
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:49 2015 -0300

      cpu: Make cpu_init() return QOM CPUState object

      Instead of making cpu_init() return CPUArchState, return CPUState.

      Changes were made using the Coccinelle semantic patch below.

        @@
        typedef CPUState;
        identifier e;
        expression args;
        type CPUArchState;
        @@
        -   e =
        +   cpu =
                cpu_init(args);
        -   if (!e) {
        +   if (!cpu) {
                ...
            }
        -   cpu = ENV_GET_CPU(env);
        +   e = cpu->env_ptr;

        @@
        identifier new_env, new_cpu, env, cpu;
        type CPUArchState;
        expression args;
        @@
        -{
        -   CPUState *cpu = ENV_GET_CPU(env);
        -   CPUArchState *new_env = cpu_init(args);
        -   CPUState *new_cpu = ENV_GET_CPU(new_env);
        +{
        +   CPUState *cpu = ENV_GET_CPU(env);
        +   CPUState *new_cpu = cpu_init(args);
        +   CPUArchState *new_env = new_cpu->env_ptr;
            ...
        }

        @@
        identifier c, cpu_init_func, cpu_model;
        type StateType, CPUType;
        @@
        -static inline StateType* cpu_init(const char *cpu_model)
        -{
        -   CPUType *c = cpu_init_func(cpu_model);
        (
        -   if (c == NULL) {
        -       return NULL;
        -   }
        -   return &c->env;
        |
        -   if (c) {
        -       return &c->env;
        -   }
        -   return NULL;
        )
        -}
        +#define cpu_init(cpu_model) CPU(cpu_init_func(cpu_model))

        @@
        identifier cpu_init_func;
        identifier model;
        @@
        -#define cpu_init(model) (&cpu_init_func(model)->env)
        +#define cpu_init(model) CPU(cpu_init_func(model))

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Riku Voipio <riku.voipio@iki.fi>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      [AF: Fixed up cpu_copy() manually]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c3898f770bffd6be5c1558abeaca9cd1fb18b6ca
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:48 2015 -0300

      unicore32: Use uc32_cpu_init()

      Instead of using the legacy cpu_init() function, use uc32_cpu_init() to
      create a UniCore32CPU object.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit eeff620f820f9f0a4f400dec1437bc251402051a
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:47 2015 -0300

      m68k: Use cpu_m68k_init()

      Instead of using the legacy cpu_init() function, use cpu_m68k_init()
      directly to create a M68kCPU object.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 41979669ab756791cebc1a20c6a6ee1cb7c71caa
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:46 2015 -0300

      target-unicore32: Make uc32_cpu_init() return UniCore32CPU

      This way, the cpu_init() function in target-unicore32 will follow the
      same pattern used on all other architectures.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6e8e26519901bc254a0db2e8aad805c4349cd3b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:29:15 2015 +0100

      target-i386: Clean up misuse of qdev_init() in realize method

      x86_cpu_apic_realize() calls qdev_init() to realize the APIC.
      qdev_init()'s error handling has unwanted side effects: it unparents
      the device, and it calls qerror_report_err().

      qerror_report_err() is always inappropriate in realize methods,
      because it doesn't return the Error object.  It either reports the
      error to stderr or the human monitor, or it stores it in the QMP
      monitor, where it makes the QMP command fail even though the realize
      method succeeded.

      Fortunately, qdev_init() can't actually fail here, because realize
      can't fail for any of the three possible APIC device models.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c08295d4bf161332f3f0b34b378138592a26245a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 5 14:23:32 2015 +0000

      cpu: Add missing documentation for some CPUClass methods

      The CPUClass QOM methods virtio_is_big_endian, write_elf{32,64}_note
      and write_elf{32,64}_qemunote were added without any description
      being added to the doc comment. Correct this omission.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit ecdc7bab095a2cf29d9e9d4a7e1494f586a8b270
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Mar 8 13:16:03 2015 +0200

      acpi: fix aml_equal term implementation

      The DefLEqual op does not have a target operand. Remove it.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit aea10cdef2fb5c3bb8af598609ce19f725bf127f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 16:19:15 2015 +0100

      aml-build: append opcodes using build_append_byte

      Opcodes are raw bytes, they shouldn't be added
      using build_append_int. This only happens to work
      with 0 and 1 opcodes.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 7d433b0d85eba3d5083be6b74fd111f6de4ee373
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sat Mar 7 20:47:51 2015 +0100

      aml-build: don't modify child

      this code:
          aml_append(foo, bar);

      might, non-intuitively, modify bar, which means that e.g. the following
      might not DTRT:

          c = ....;
          aml_append(a, c);
          aml_append(b, c);

      to fix, simply allocate an intermediate array,
      and always modify that.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 1976058109890892db8ec88bfd3273f79c459f6b
  Merge: 8437f7b 280458a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 14:01:22 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Tue Mar 10 13:03:17 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (73 commits)
        MAINTAINERS: Add jcody as blockjobs, block devices maintainer
        iotests: add O_DIRECT alignment probing test
        block/raw-posix: fix launching with failed disks
        MAINTAINERS: Add jsnow as IDE maintainer
        sheepdog: Fix misleading error messages in sd_snapshot_create()
        Add testcase for scsi-hd devices without drive property
        scsi-hd: fix property unset case
        block/vdi: Add locking for parallel requests
        iotests: Drop vpc from 004's and 104's format list
        iotests: Remove 006
        iotests: Fix 051's reference output
        virtio-blk: Remove the stale FIXME comment
        tests: Check QVIRTIO_F_ANY_LAYOUT flag in virtio-blk test
        libqos: Solve bug in interrupt checking when using MSIX in virtio-pci.c
        sheepdog: fix confused return values
        qtest/ahci: add fragmented dma test
        qtest/ahci: Add PIO and LBA48 tests
        qtest/ahci: Add DMA test variants
        libqos/ahci: add ahci command helpers
        qtest/ahci: Add a macro bootup routine
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 280458a34abcca2ba70843a089a35468c81e3740
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Mar 6 12:16:06 2015 -0500

      MAINTAINERS: Add jcody as blockjobs, block devices maintainer

      The block layer maintainership is being split up into smaller, more
      manageable pieces.

      I propose that I take over / assist with the following areas:

          * blockjobs
          * archipelago
          * curl
          * gluster
          * nfs
          * rbd
          * sheepdog
          * ssh
          * vhdx

      As John Snow noted in a different patch:

      As we split out the block layer, we will begin using the qemu-block
      mailing list as a catchall for all of the block layer subcomponents.
      Please CC qemu-block@nongnu.org for all block layer patches, including
      any that touch the above listed areas.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1a6e597995c8c0125d1f305b583d6de083e44c73
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 5 15:38:18 2015 -0600

      iotests: add O_DIRECT alignment probing test

      This test case checks that image files can be opened even if I/O
      produces EIO errors.  QEMU should not refuse opening failed disks since
      the guest may be configured for multipath I/O where accessing failed
      disks is expected.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 22d182e82b4ba2fb78b2cc22bcec4e6a440b0ad6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 5 15:38:17 2015 -0600

      block/raw-posix: fix launching with failed disks

      Since commit c25f53b06eba1575d5d0e92a0132455c97825b83 ("raw: Probe
      required direct I/O alignment") QEMU has failed to launch if image files
      produce I/O errors.

      Previously, QEMU would launch successfully and the guest would see the
      errors when attempting I/O.

      This is a regression and may prevent multipath I/O inside the guest,
      where QEMU must launch and let the guest figure out by itself which
      disks are online.

      Tweak the alignment probing code in raw-posix.c to explicitly look for
      EINVAL on Linux instead of bailing.  The kernel refuses misaligned
      requests with this error code and other error codes can be ignored.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c095348b914b740d8364a2ccf748e4284de3b68b
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 4 23:37:55 2015 -0500

      MAINTAINERS: Add jsnow as IDE maintainer

      It has been proposed that the block layer be split up into smaller,
      more manageable portions to help speed up the review and merging of
      block layer patches.

      As part of this process, I propose that I take over the IDE, ATA, ATAPI
      and FD devices.

      As we split out the block layer, we will begin using the qemu-block
      mailing list as a catchall for all of the block layer subcomponents.
      Please CC qemu-block@nongnu.org for all block layer patches, including
      any that touch the IDE/Floppy devices.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 27994d587940b0c72d5f1d69f6e1a62a02f26dc9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 14:49:50 2015 +0100

      sheepdog: Fix misleading error messages in sd_snapshot_create()

      If do_sd_create() fails, it first reports the error returned, then
      reports a another one with strerror(errno).  errno is meaningless at
      that point.

      Report just one error combining the valid information from both
      messages.

      Reported-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Liu Yuan <namei.unix@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 354483e50726140d9c6cb5ff0e1698bd5f17a2d5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Mar 3 15:59:26 2015 +0100

      Add testcase for scsi-hd devices without drive property

      Lets add a test for scsi devices without a drive. This was broken
      by a recent block patch, thus indicating that we need a testcase.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit df1d4c341a735334de23513f17bf110c8c49b3e7
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Wed Mar 4 11:02:16 2015 +0100

      scsi-hd: fix property unset case

      Commit c53659f0 ("BlockConf: Call backend functions to detect geometry
      and blocksizes") causes a segmentation fault on the invalid
      configuration of a scsi device without a drive.

      Let's check for conf.blk before calling blkconf_blocksizes. The error
      will be handled later on in scsi_realize anyway.

      Reported-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f0ab6f109630940146cbaf47d0cd99993ddba824
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 27 14:54:39 2015 -0500

      block/vdi: Add locking for parallel requests

      When allocating a new cluster, the first write to it must be the one
      doing the allocation, because that one pads its write request to the
      cluster size; if another write to that cluster is executed before it,
      that write will be overwritten due to the padding.

      See https://bugs.launchpad.net/qemu/+bug/1422307 for what can go wrong
      without this patch.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aef58bdc1e7d8f37cdf838b49f160c520399c84f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 16:22:39 2015 -0500

      iotests: Drop vpc from 004's and 104's format list

      Both tests require the test image to have a specific size; this cannot
      be guaranteed by vpc (unless tuning the test specifically for that
      format).

      It is safe to exclude vpc from 004 because what is tested there is
      implemented in a generic part in the block layer and not
      format-specific.

      It is safe to exclude vpc from 104 because for vpc basically every image
      size is "unaligned", so if that would break at some point in time, we
      would quickly notice just by running the generic tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 005628bc8a1693c3dcb00ff2dc3a67cf92c61a13
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 16:22:38 2015 -0500

      iotests: Remove 006

      vpc does support images > 127 GB if done correctly. qemu does it
      correctly. Remove the test pretending otherwise.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2726958d5eaa3e8242a56014a33e2420280cdd57
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 09:38:32 2015 -0500

      iotests: Fix 051's reference output

      Commit c4bacafb717de55538311b80a185ce9166b8daa2 changed (improved)
      qdev_init_nofail()'s error reporting, which affects iotest 051. Fix the
      reference output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c0542ea60d21b56a9157d3f6331d2df8990d3bb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Feb 16 12:09:40 2015 +0800

      virtio-blk: Remove the stale FIXME comment

      By default, we have ioeventfd enabled, so the IO request processing is
      in IO thread; in the vcpu thread, guest mode is returned to as quickly
      as possible, and completion is delivered via irqfd. Therefore this
      comment from the initial implementation is barely relevant.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9b7d2d8b076ff12f0d7b4246aec8f421b4150aae
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:59:14 2015 +0100

      tests: Check QVIRTIO_F_ANY_LAYOUT flag in virtio-blk test

      Check the QVIRTIO_F_ANY_LAYOUT flag before performing operations with 2
      descriptor layout. This is to follow the specification strictly.

      This patch depends on:
      [PATCH v5 0/5] libqos: Virtio MMIO driver

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Message-id: 1424815154-27243-1-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1e34cf9681ec549e26f30daaabc1ce58d60446f7
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 17:34:14 2015 +0100

      libqos: Solve bug in interrupt checking when using MSIX in virtio-pci.c

      The MSIX interrupt was always acked without checking its value, which caused a
      race condition. If the ISR was raised between the read and the acking, the ISR
      was never detected and it timed out.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Tested-by: John Snow <jsnow@redhat.com>
      Message-id: 1424795655-16952-1-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 833a7cc36e63653641558ba27148076f9a32062f
  Author: Liu Yuan <liuyuan@cmss.chinamobile.com>
  Date:   Wed Feb 18 11:57:55 2015 +0800

      sheepdog: fix confused return values

      These functions mix up -1 and -errno in return values and would might cause
      trouble error handling in the call chain.

      This patch let them return -errno and add some comments.

      Cc: qemu-devel@nongnu.org
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Liu Yuan <liuyuan@cmss.chinamobile.com>
      Message-id: 1424231875-7131-1-git-send-email-namei.unix@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e0c59cc7608f84fcaddc827e05d38af8d10447a3
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:40 2015 -0500

      qtest/ahci: add fragmented dma test

      Test what happens when we try to use extremely short PRDTs
      to accomplish a small data transfer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bda39dc241b1c216158aa990936d08f0a1ad26e3
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:39 2015 -0500

      qtest/ahci: Add PIO and LBA48 tests

      In addition to DMA tests, test PIO and LBA48 command pathways in AHCI.
      To accomplish this, a primitive multiplexer for gtest is added.

      Though guests may prefer not to issue PIO commands directly except
      for single sector cases during early boot and shutdown, these pathways
      are still used for the transfer of ATAPI commands as well, and should
      be behaving well.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d6c403edc7ce890be12915f12eb02062bf275ca8
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:38 2015 -0500

      qtest/ahci: Add DMA test variants

      These test a few different pathways in the AHCI code.

      short:  Test the minimum transfer size, exactly one sector.
      simple: Test a transfer using a single PRD, in this case, 4K.
      double: Test transferring 8K, which we will split up as two PRDs.
      long:   Test transferring a lot of data using many PRDs, 256K.
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f9f963e0fbba98d7ece75287c40d0c1b249dc9b4
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:37 2015 -0500

      libqos/ahci: add ahci command helpers

      ahci_command_set_flags:  Set additional flags in the command header.
      ahci_command_clr_flags:  Clear flags from the command header.
      ahci_command_set_offset: Change the IO sector from 0.
      ahci_command_adjust:     Adjust many values simultaneously.

      To be used to adjust the command header if the default values/guesses
      were incorrect or undesirable.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

      [ kwolf: Fixed conflicting prototype for ahci_command_adjust() ]

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d63b4017c2dff9cf0f15d06d5f604a97a30ef4c5
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:36 2015 -0500

      qtest/ahci: Add a macro bootup routine

      Add a routine that can be used to engage the AHCI
      device at a not-granular level so that bringing up
      the functionality of the HBA is easy in future tests
      that are not concerned with testing the bring-up process.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4a42f6d408079830099dbffc1b0cb2869db69215
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:35 2015 -0500

      libqos/ahci: Zero-fill AHCI headers

      Even though it's just the reserved space, make sure they're zeroes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit baca2b9e3a94be1690fc4a842a97b64a4c8f892c
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:06 2015 -0500

      qtest/ide: Test flush / retry for ISA and PCI

      This patch adds tests for werror and rerror functionality
      for the PCI and ISA ide buses.

      Tests for the AHCI device are to be included at a later
      date after requisite patches have been merged upstream
      to support needed functionality by the tests.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1424708286-16483-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c27c73aaf924655b2cc2e74384a639805acededb
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:05 2015 -0500

      ahci: Recompute cur_cmd on migrate post load

      When the AHCI HBA device is migrated, all of the information that
      led to the request being created is stored in the AHCIDevice
      structures, except for pointers into guest data where return
      information needs to be stored.

      The "cur_cmd" field is usually responsible for this.

      To rebuild the cur_cmd pointer post-migration, we can utilize
      the busy_slot index to figure out where the command header
      we are still processing is.

      This allows a machine in a halted state from rerror=stop or
      werror=stop to be migrated and resume operations without issue.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e8ef87433ee005d304ba19c56488474432eb0c53
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:04 2015 -0500

      ahci: add support for restarting non-queued commands

      This is easy, since start_dma already restarts processing from the
      beginning of the PRDT.

      Migration is also easy to cover; the comment about busy_slot is
      wrong, busy_slot will only be set if there is an error.  In this
      case we have nothing to do really.  The core IDE code will restart
      the operation and command list processing will proceed after the
      erroring command has been completed.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd6649101d044df446c66949cb6c1462c8989726
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:03 2015 -0500

      ahci: Migrate IDEStatus

      Amazingly, we weren't doing this before.

      Make sure we migrate the IDEState structure that belongs to
      the AHCIDevice.IDEBus structure during migrations.

      No version numbering changes because AHCI is not officially
      migratable (and we can all see with good reason why) so we
      do not impact any official builds by altering the stream and
      leaving it at version 1.

      This fixes the rerror=stop/werror=stop test case where we wish
      to migrate a halted job. Previously, the error code would not
      migrate, so even if the job completed successfully, AHCI would
      report an error because it would still have the placeholder
      error code from initialization time.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d32c76b3add2cb5216ae6931ef06632b802a6f68
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:02 2015 -0500

      ide: support PIO restart for the ISA controller

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4e2b8b4a4e8fcc598f7b9df15aa8949a1ab096e8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:01 2015 -0500

      ide: make more functions static

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c71c06d437d4cccf753cb41731e5a71f54317a01
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:00 2015 -0500

      ide: commonize io_buffer_index initialization

      Resetting the io_buffer_index to 0 is commonized,
      with the exception of the case within ide_atapi_cmd_reply,
      where we need to reset this index to 0 prior to the
      ide_atapi_cmd_reply_end call.

      Note that not all calls to ide_atapi_cmd_reply_end
      expect the index to be 0, so setting it there is
      not appropriate.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d12b9ff2a4e21587e5b180008c88a0e6e1ec8ac5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:59 2015 -0500

      ide: migrate initial request state via IDEBus

      This only breaks backwards migration compatibility if the bus is in
      an error state.  It is in principle possible to avoid this by making
      two subsections (one for version 1, and one for version 2, but with
      the same name) with different "_needed" callbacks.  The v1 callback would
      return true if error_status != 0 and the bus is PATA; the v2 callback
      would return true if error_status != 0 and the bus is AHCI.

      Forward migration keeps working.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit dc5d0af49a90571813b9cbcea90c0bbbea0d4a22
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:58 2015 -0500

      ide: place initial state of the current request to IDEBus

      This moves more common restarting logic to the core IDE code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a96cb236290ef8e54b061b30c41835e435905d7a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:57 2015 -0500

      ide: replace set_unit callback with more IDEBus state

      Start moving the initial state of the current request to IDEBus, so that
      AHCI can use it.  The set_unit callback is not used anymore once this is
      done.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fe09c7c9f0e8ed8793e986cf616c8de0a9518fd7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:56 2015 -0500

      ide: remove restart_cb callback

      With restarts now handled by ide_restart_cb and
      the IDEDMAOps.restart_dma() member, remove the old
      restart_cb callback.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9898586d8929a7f1293fc64164b67a79289b074f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:55 2015 -0500

      ide: move restart callback to common code

      With BMDMA specific excised from the restart functions,
      create a HBA-agnostic restart callback to be shared
      between the different HBAs.

      Change the callback registered with the vmstate_change
      handler to always point to ide_restart_cb instead of
      relying on the IDEDMAOps.restart_cb() member.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d34fceda8feb6c36722f41f3e1db40cf2af82ea8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:54 2015 -0500

      ide: pass IDEBus to the restart_cb

      Pass the containing IDEBus to the restart_cb instead
      of the more specific BMDMAState child.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2745df813d82724f2633a9b2ba7f7c5717d7509b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:53 2015 -0500

      ide: do not use BMDMA in restart callback

      Whenever an error stops the VM, ide_handle_rw_error does
      "s->bus->dma->unit = s->unit".  So we can just use
      idebus_active_if.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f878c916077d510be3276dad7c36f606cdcea80a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:52 2015 -0500

      ide: introduce ide_register_restart_cb

      A helper is added that registers the IDEDMAOp .restart_cb()
      via qemu_add_vm_change_state_handler instead of requiring
      each HBA to register the callback themselves.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd8892c4e6d681517c687ec5ac86eed46b3bb23b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:51 2015 -0500

      ide: prepare to move restart to common code

      This patch adds the restart_dma callback and adjusts
      the ide_restart_dma function to utilize this callback
      to call the BMDMA-specific restart code instead of statically
      executing BMDMA-specific code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06b95b1ee75706592929e7e91cf18373fd0e6697
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:50 2015 -0500

      ide: start extracting ide_restart_dma out of bmdma_restart_dma

      This patch begins refactoring the restart dma functions
      out of bmdma to be shared with AHCI and other future
      IDE HBA implementations.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0eb28a42284ec32e6f283985d2d638474a05eba4
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:58 2015 +0100

      BlockConf: Call backend functions to detect geometry and blocksizes

      geometry: hd_geometry_guess function autodetects the drive geometry.
      This patch adds a block backend call, that probes the backing device
      geometry. If the inner driver method is implemented and succeeds
      (currently only for DASDs), the blkconf_geometry will pass-through
      the backing device geometry. Otherwise will fallback to old logic.

      blocksize: This patch initializes blocksize properties to 0.
      In order to set the property a blkconf_blocksizes was introduced.
      If user didn't set physical or logical blocksize, it will
      retrieve its value from a driver (only succeeds for DASD), otherwise
      it will set default 512 value.

      The blkconf_blocksizes call was added to all users of BlkConf.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-6-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f0272c4db2a914453a6254f80bfe3b708a0b2426
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:57 2015 +0100

      block-backend: Add wrappers for blocksizes and geometry probing

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-5-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1a9335e4a94d0f0c635a5284aa3ba5dc50d24f70
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:56 2015 +0100

      block: Add driver methods to probe blocksizes and geometry

      Introduce driver methods of defining disk blocksizes (physical and
      logical) and hard drive geometry.
      Methods are only implemented for "host_device". For "raw" devices
      driver calls child's method.

      For now geometry detection will only work for DASD devices. To check
      that a local check_for_dasd function was introduced. It calls BIODASDINFO2
      ioctl and returns its rc.

      Blocksizes detection function will probe sizes for DASD devices.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-4-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a4ed0d1b16d8932362ffecf8f6f79e6340a585f
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:55 2015 +0100

      raw-posix: Factor block size detection out of raw_probe_alignment()

      Put it in new probe_logical_blocksize().

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-3-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 892b7de832681cdfff22a6e96cb0280b59684024
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:54 2015 +0100

      block: add bdrv functions for geometry and blocksize

      Add driver functions for geometry and blocksize detection

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-2-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a069e2f1372a0a823ab506fc019852a2a652aa54
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Feb 6 16:26:17 2015 -0500

      blkdebug: fix "once" rule

      Background:
        The blkdebug scripts are currently engineered so that when a debug
      event occurs, a prefilter browses a master list of parsed rules for a
      certain event and adds them to an "active list" of rules to be used for
      the forthcoming action, provided the events and state numbers match.

        Then, once the request is received, the last active rule is used to
      inject an error if certain parameters match.

        This active list is cleared every time the prefilter injects a new
      rule for the first time during a debug event.

        The "once" rule currently causes the error injection, if it is
      triggered, to only clear the active list. This is insufficient for
      preventing future injections of the same rule.

      Remedy:
        This patch /deletes/ the rule from the list that the prefilter
      browses, so it is gone for good. In V2, we remove only the rule of
      interest from the active list instead of allowing the "once" rule to
      clear the entire list of active rules.

      Impact:
        This affects iotests 026. Several ENOSPC tests that used "once" can
      be seen to have output that shows multiple failure messages. After
      this patch, the error messages tend to be smaller and less severe, but
      the injection can still be seen to be working. I have patched the
      expected output to expect the smaller error messages.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423257977-25630-1-git-send-email-jsnow@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d2eed8c6d9601cddc9dff2940d87bc022e9bd03c
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:50 2015 -0500

      iotests: Add test for different refcount widths

      Add a test for errors specific to certain widths (i.e. snapshots with
      refcount_bits=1).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06d05fa738915ab82577289a0b81b3e600c4e749
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:49 2015 -0500

      qcow2: Allow creation with refcount order != 4

      Add a creation option to qcow2 for setting the refcount order of images
      to be created, and respect that option's value.

      This breaks some test outputs, fix them.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5262caa75468adce44b57ed9c076b2f22bd9315f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:48 2015 -0500

      iotests: Prepare for refcount_bits option

      Some tests do not work well with certain refcount widths (i.e. you
      cannot create internal snapshots with refcount_bits=1), so make those
      widths unsupported.

      Furthermore, add another filter to _filter_img_create in common.filter
      which filters out the refcount_bits value.

      This is necessary for test 079, which does actually work with any
      refcount width, but invoking qemu-img directly leads to the
      refcount_bits value being visible in the output; use _make_test_img
      instead which will filter it out.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a17b83cc3d4aa61ed24e2682aaf8ada7130f03d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:47 2015 -0500

      qcow2: Use symbolic macros in qcow2_amend_options

      qcow2_amend_options() should not compare options against some inline
      strings but rather use the symbolic macros available for each of the
      creation options.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd4b167f84840865b788e9f236585f77a77b10fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:46 2015 -0500

      qcow2: refcount_order parameter for qcow2_create2

      Add a refcount_order parameter to qcow2_create2(), use that value for
      the image header and for calculating the size required for
      preallocation.

      For now, always pass 4.

      This addition requires changes to the calculation of the file size for
      the "full" and "falloc" preallocation modes. That in turn is a nice
      opportunity to add a comment about that calculation not necessarily
      being exact (and that being intentional).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b72faf9f78377e38342f78ffacdfa0726f5e7511
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:52 2015 -0500

      qcow2: Open images with refcount order != 4

      No longer refuse to open images with a different refcount entry width
      than 16 bits; only reject images with a refcount width larger than 64
      bits (which is prohibited by the specification).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59c0cb7830be68080c6a0d1449253b954350e57d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:51 2015 -0500

      qcow2: More helpers for refcount modification

      Add helper functions for getting and setting refcounts in a refcount
      array for any possible refcount order, and choose the correct one during
      refcount initialization.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7453c96b78c2b09aa72924f933bb9616e5474194
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:50 2015 -0500

      qcow2: Helper function for refcount modification

      Since refcounts do not always have to be a uint16_t, all refcount blocks
      and arrays in memory should not have a specific type (thus they become
      pointers to void) and for accessing them, two helper functions are used
      (a getter and a setter). Those functions are called indirectly through
      function pointers in the BDRVQcowState so they may later be exchanged
      for different refcount orders.

      With the check and repair functions using this function, the refcount
      array they are creating will be in big endian byte order; additionally,
      using realloc_refcount_array() makes the size of this refcount array
      always cluster-aligned. Both combined allow rebuild_refcount_structure()
      to drop the bounce buffer which was used to convert parts of the
      refcount array to big endian byte order and store them on disk. Instead,
      those parts can now be written directly.

      [ kwolf: Fixed a build failure on 32 bit and another with old glib ]

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5fee192efdfe2161d392491e6f68bffb406b18e1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:49 2015 -0500

      qcow2: Helper for refcount array reallocation

      Add a helper function for reallocating a refcount array, independent of
      the refcount order. The newly allocated space is zeroed and the function
      handles failed reallocations gracefully.

      The helper function will always align the buffer size to a cluster
      boundary; if storing the refcounts in such an array in big endian byte
      order, this makes it possible to write parts of the array directly as
      refcount blocks into the image file.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0e06528e980b8ac7695a219f8405d3cdc52a1381
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:48 2015 -0500

      qcow2: Use 64 bits for refcount values

      Refcounts may have a width of up to 64 bits, so qemu should use the same
      width to represent refcount values internally.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2aabe7c7a16cee6b1b54592fa05b5f9c23c89bc0
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:47 2015 -0500

      qcow2: Use unsigned addend for update_refcount()

      update_refcount() and qcow2_update_cluster_refcount() currently take a
      signed addend. At least one caller passes a value directly derived from
      an absolute refcount that should be reached ("l2_refcount - 1" in
      expand_zero_clusters_in_l1()). Therefore, the addend should be unsigned
      as well; this will be especially important for 64 bit refcounts.

      Because update_refcount() then no longer knows whether the refcount
      should be increased or decreased, it now requires an additional flag
      which specified exactly that. The same applies to
      qcow2_update_cluster_refcount().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7324c10f96c821b00d691e2c8ced67d8536bf1d6
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:46 2015 -0500

      qcow2: Only return status from qcow2_get_refcount

      Refcounts can theoretically be of type uint64_t; in order to be able to
      represent the full range, qcow2_get_refcount() cannot use a single
      variable to represent both all refcount values and also keep some values
      reserved for errors.

      One solution would be to add an Error pointer parameter to
      qcow2_get_refcount(); however, no caller could (currently) pass that
      error message, so it would have to be emitted immediately and be
      passed to the next caller by returning -EIO or something similar.
      Therefore, an Error parameter does not offer any advantages here.

      The solution applied by this patch is simpler to use. Because no caller
      would be able to pass the error message, they would have to print it and
      free it, whereas with this patch the caller only needs to pass the
      returned integer (which is often a no-op from the code perspective,
      because that integer will be stored in a variable "ret" which will be
      returned by the fail path of many callers).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6e9d8ae6629aaf3c6d483032d219b988d78583f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:45 2015 -0500

      qcow2: Do not return new value after refcount update

      qcow2_update_cluster_refcount() does not have any quick access to the
      new refcount value, it has to call qcow2_get_refcount(). Some callers do
      not need that new value at all, others call qcow2_get_refcount()
      themselves anyway (albeit in a different code path, which can however be
      easily changed), therefore there is no advantage in making
      qcow2_update_cluster_refcount() return the new value. Drop it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0709c5a1530b046183b6e96d9631affcff76c1fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:44 2015 -0500

      qcow2: Add refcount_bits to format-specific info

      Add the bit width of every refcount entry to the format-specific
      information.

      In contrast to lazy_refcounts and the corrupt flag, this should be
      always emitted, even for compat=0.10 although it does not support any
      refcount width other than 16 bits. This is because if a boolean is
      optional, one normally assumes it to be false when omitted; but if an
      integer is not specified, it is rather difficult to guess its value.

      This new field breaks some test outputs, fix them.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 346a53df38e29021e4a9e8c2a759b05744902857
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:43 2015 -0500

      qcow2: Add two new fields to BDRVQcowState

      Add two new fields regarding refcount information (the bit width of
      every entry and the maximum refcount value) to the BDRVQcowState.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a6ed700061fdd86b3c4b71366be42503ac2ce23
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:55 2015 +0100

      libqos: Add virtio MMIO support

      Add virtio MMIO support.
      Add virtio-blk-test MMIO test case.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-6-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 870a306dec0cfdf32c8179acfd2c4d0bfd000d6b
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:54 2015 +0100

      libqos: Add malloc generic

      This malloc is a basic interface implementation that works for any platform.
      It should be replaced in the future for a real malloc implementation for each
      of the platforms.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-5-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 50311a81f812d234ed0782df7a09971978e226a5
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:53 2015 +0100

      libqos: Remove PCI assumptions in constants of virtio driver

      Convert PCI-specific constants names of libqos virtio driver.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-4-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 38d8364f4f9388b9f3a593d2664d019cf6c72b38
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:52 2015 +0100

      tests: Prepare virtio-blk-test for multi-arch implementation

      Modularize functions in virtio-blk-test and add PCI suffix for PCI specific
      components.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-3-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 728312b8c81564e437902aeca9f51fdb1e7c52b6
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:51 2015 +0100

      libqos: Change use of pointers to uint64_t in virtio

      Convert use of pointers in functions of virtio to uint64_t in order to make it
      platform-independent.

      Add casting from pointers (in PCI functions) to uint64_t and vice versa through
      uintptr_t.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-2-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a209f4615c6853a226e847810b6c607c71b6a046
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Feb 17 17:55:53 2015 +0800

      virtio-blk: Check return value of blk_aio_ioctl

      Since commit 1dc936aa84 (virtio-blk: Use blk_aio_ioctl) we silently lose
      the request if blk_aio_ioctl returns NULL (not implemented).

      Fix it by directly returning VIRTIO_BLK_S_UNSUPP as we used to do.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

      [ kwolf: Fixed build error on win32 ]

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8437f7be3b1c49631e435c652707f2cee477149d
  Merge: 277263e 438940c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 11:44:59 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-03-04' into staging

      trivial patches for 2015-03-04

      # gpg: Signature made Tue Mar 10 05:16:59 2015 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-03-04: (44 commits)
        9pfs: remove useless return
        gdbstub: avoid possible NULL pointer dereference
        milkymist-pfpu: fix GCC 5.0.0 aggressive-loop-optimizations warning
        fix GCC 5.0.0 logical-not-parentheses warnings
        migration: Fix coding style (whitespace issues)
        oslib-posix: Fix compiler warning (-Wclobbered) and simplify the code
        disas/microblaze: Fix warnings caused by missing 'static' attribute
        disas/arm: Fix warnings caused by missing 'static' attribute
        vhost_net: Add missing 'static' attribute
        e500: fix memory leak
        gitignore: Ignore new tests
        gitignore: Track common.env in iotests gitignore
        sysbus: fix memory leak
        milkymist.c: fix memory leak
        macio: fix possible memory leak
        sparc/leon3.c: fix memory leak
        nbd: fix resource leak
        qemu-char: add cyrillic key 'numerosign' to Russian keymap
        qemu-char: add cyrillic characters 'numerosign' to VNC keysyms
        qapi-schema: Fix SpiceChannel docs
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b57489cfe48f9fedc10205c0494f144085733f30
  Author: Jorge Acereda Maciá <jacereda@gmail.com>
  Date:   Thu Feb 26 00:21:39 2015 +0100

      Fix crash when connecting to VNC through websocket

      Connecting to VNC through websocket crashes in vnc_flush() when trying
      to acquire a mutex that hasn't been initialized (vnc_init_state(vs)
      hasn't been called at this point).

      Signed-off-by: Jorge Acereda Macia <jacereda@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 006decd448ae3ce04f12e2bbdd3079ba74d25c89
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 08:45:06 2015 +0100

      vnc: -readconfig fix

      Now that -vnc goes through QemuOpts we can get vnc configuration
      via -readconfig too.  So setting display_remote in the command
      line parsing code doesn't cut it any more, we must check QemuOpts
      instead to see whenever any vnc display is configured.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9634f4e3b721f75f9ba4c87fe1499d5e95fc63ca
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 09:28:17 2015 +0100

      vnc: set id at parse time not init time

      This way the generated id will be stored in -writeconfig cfg files.
      Also we can make vnc_auto_assign_id() local to vnc.c.

      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ac57622985220de064059971f9ccb00905e9bd04
  Author: Bill Paul <wpaul@windriver.com>
  Date:   Mon Mar 9 15:48:01 2015 -0700

      x86: fix SS selector in SYSRET

      According to my reading of the Intel documentation, the SYSRET instruction
      is supposed to force the RPL bits of the %ss register to 3 when returning
      to user mode. The actual sequence is:

      SS.Selector <-- (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *)

      However, the code in helper_sysret() leaves them at 0 (in other words, the "OR
      3" part of the above sequence is missing). It does set the privilege level
      bits of %cs correctly though.

      This has caused me trouble with some of my VxWorks development: code that runs
      okay on real hardware will crash on QEMU, unless I apply the patch below.

      Signed-off-by: Bill Paul <wpaul@windriver.com>
      Message-Id: <201503091548.01462.wpaul@windriver.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae071cc851d7150d3a9950c642570830bb85729e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:28 2015 +0100

      scsi: Convert remaining PCI HBAs to realize()

      These are "am53c974", "dc390", "lsi53c895a", "lsi53c810", "megasas",
      "megasas-gen2".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-5-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 390e90a90736f98ca47f2e767d7f2a15d68d6bc4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:27 2015 +0100

      scsi: Improve error reporting for invalid drive property

      When setting "realized" fails, scsi_bus_legacy_add_drive() passes the
      error to qerror_report_err(), then returns an unspecific "Setting
      drive property failed" error, which is reported further up the call
      chain.

      Example:

          $ qemu-system-x86_64 -nodefaults -S -display none \
          > -drive if=scsi,id=foo,file=tmp.qcow2 -global isa-fdc.driveA=foo
          qemu-system-x86_64: -drive if=scsi,id=foo,file=tmp.qcow2: Property 'scsi-disk.drive' can't take value 'foo', it's in use
          qemu-system-x86_64: Setting drive property failed
          qemu-system-x86_64: Initialization of device lsi53c895a failed: Device initialization failed

      Clean up the obvious way: simply return the original error to the
      caller.  Gets rid of the second message in the above error cascade.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-4-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9b3d111ad90886546614b2579eedcb4675b35d14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:26 2015 +0100

      hw: Propagate errors through qdev_prop_set_drive()

      Three kinds of callers:

      1. On failure, report the error and abort

         Passing &error_abort does the job.  No functional change.

      2. On failure, report the error and exit()

         This is qdev_prop_set_drive_nofail().  Error reporting moves from
         qdev_prop_set_drive() to its caller.  Because hiding away the error
         in the monitor right before exit() isn't helpful, replace
         qerror_report_err() by error_report_err().  Shouldn't make a
         difference, because qdev_prop_set_drive_nofail() should never be
         used in QMP context.

      3. On failure, report the error and recover

         This is usb_msd_init() and scsi_bus_legacy_add_drive().  Error
         reporting and freeing the error object moves from
         qdev_prop_set_drive() to its callers.

         Because usb_msd_init() can't run in QMP context, replace
         qerror_report_err() by error_report_err() there.

         No functional change.

         scsi_bus_legacy_add_drive() calling qerror_report_err() is of
         course inappropriate, but this commit merely makes it more obvious.
         The next one will clean it up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-3-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fa617181839741727d0067ea68807133f498f29b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:25 2015 +0100

      scsi: Clean up duplicated error in legacy if=scsi code

      Commit a818a4b changed scsi_bus_legacy_handle_cmdline() to report
      errors from scsi_bus_legacy_add_drive() with error_report() in
      addition to returning them.  That's inappropriate.

      Two kinds of callers:

      1. realize methods (devices "esp", "virtio-scsi-device" and
         "spapr-vscsi")

         The error object gets passed up the call chain until it gets
         reported again and freed.

         Example:

         $ qemu-system-arm -M virt -S -display none \
         > -drive if=scsi,id=foo,bus=1,file=tmp.qcow2 \
         > -device nec-usb-xhci -device usb-storage,drive=foo \
         > -device virtio-scsi-pci
         qemu-system-arm: -drive if=scsi,id=foo,bus=1,file=tmp.qcow2: Property 'scsi-disk.drive' can't take value 'foo', it's in use
         qemu-system-arm: -drive if=scsi,id=foo,bus=1,file=tmp.qcow2: Setting drive property failed
         qemu-system-arm: -device virtio-scsi-pci: Setting drive property failed
         qemu-system-arm: -device virtio-scsi-pci: Device initialization failed
         qemu-system-arm: -device virtio-scsi-pci: Device 'virtio-scsi-pci' could not be initialized

         The second message in this error cascade comes from
         scsi_bus_legacy_handle_cmdline().  The error object then gets
         passed up to the qdev_init() called from
         virtio_scsi_pci_init_pci(), which reports it again.

      2. init methods (devices "am53c974", "dc390", "lsi53c895a",
         "lsi53c810", "megasas", "megasas-gen2")

         init methods need to report their errors with qerror_report().
         These don't.  The inappropriate error_report() papers over the bug.

         error_report() isn't the same as qerror_report() in QMP context,
         but this can't actually happen: QMP can still only hot-plug, and
         callers call scsi_bus_legacy_handle_cmdline() only on cold-plug.
         Except for sysbus_esp_realize(), but that can't be hot-plugged at
         all, as far as I can tell.

      Fix the init methods and drop the inappropriate error_report() in
      scsi_bus_legacy_handle_cmdline().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-2-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cba7054928b10a7fda57c64807451bbc9a31e42e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 9 15:28:37 2015 +0100

      cpus: initialize cpu->memory_dispatch

      This fixes a NULL pointer dereference in s390x-softmmu.

      On pretty much all other architectures, creating an MMIO region calls
      cpu_reload_memory_map.  On s390, however, there are no MMIO regions
      and everything is done via hypercalls.

      Fixes: 9d82b5a792236db31a75b9db5c93af69ac07c7c5
      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 21b7cf9e07e5991c57b461181cfb5bbb6fe7a9d6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 5 16:53:48 2015 +0100

      rcu: handle forks safely

      After forking, only the calling thread is duplicated in the child process.
      The call_rcu thread has to be recreated in the child.  Exploit the fact
      that only one thread exists (same as when constructors run), and just redo
      the entire initialization to ensure the threads are in the proper state.

      The only additional things to do are emptying the list of threads
      registered with RCU, and unlocking the lock that was taken in the prepare
      callback (implementations are allowed to fail pthread_mutex_init()
      if the mutex is still locked).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 24fa90499f8b24bcba2960a3316d797f9b80b5e9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 5 16:47:14 2015 +0100

      qemu-thread: do not use PTHREAD_MUTEX_ERRORCHECK

      PTHREAD_MUTEX_ERRORCHECK is completely broken with respect to fork.
      The way to safely do fork is to bring all threads to a quiescent
      state by acquiring locks (either in callers---as we do for the
      iothread mutex---or using pthread_atfork's prepare callbacks)
      and then release them in the child.

      The problem is that releasing error-checking locks in the child
      fails under glibc with EPERM, because the mutex stores a different
      owner tid than the duplicated thread in the child process.  We
      could make it work for locks acquired via pthread_atfork, by
      recreating the mutex in the child instead of unlocking it
      (we know that there are no other threads that could have taken
      the mutex; but when the lock is acquired in fork's caller
      that would not be possible.

      The simplest solution is just to forgo error checking.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 811c5727765eba00824c29a696350d4780d86c19
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 2 17:29:07 2015 -0600

      kvm_stat: add kvm_stat.1 man page

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Ademar Reis <areis@redhat.com>
      Reviewed-by: Wei Huang <wei@redhat.com>
      Message-Id: <1425338947-10296-3-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9a7dcb711bdaf4082bf333dbecfeb729bbff1f8e
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 2 17:29:06 2015 -0600

      kvm_stat: add column headers to text UI

      The curses user interface shows both the accumulated total and the
      current event counts.  Add column headers so it's clear what the numbers
      mean.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Ademar Reis <areis@redhat.com>
      Reviewed-by: Wei Huang <wei@redhat.com>
      Message-Id: <1425338947-10296-2-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 532cee4184877053398a2bdae4edc965084fc79e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 10:14:30 2015 +0100

      iscsi: Fix check for username

      The variable user in struct iscsi_url is a character array, not a pointer.
      Therefore its address will never be NULL.

      clang reports this error:

      block/iscsi.c:1329:20: warning:
       comparison of array 'iscsi_url->user' not equal to a null pointer
       is always true [-Wtautological-pointer-compare]

      Reviewed-by: Peter Lieven <pl@kamp.de>
      Acked-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1425719670-5486-1-git-send-email-sw@weilnetz.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f3b18f35a23c60edbda6420cd4bd30b8bb11ea80
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      sun4u: switch m48t59 NVRAM to MMIO access

      Real sun4u systems memory-map the NVRAM on the (ISA) ebus, so switch over to
      MMIO from ioport access whilst setting the base year to 1968 as used by Sun
      systems. This allows all SPARC64 OSs included in my tests to correctly detect
      the NVRAM IC and read the hardware clock correctly upon boot.

      Note that this also requires a corresponding OpenBIOS update to r1330 in order
      to switch the SPARC64 NVRAM accessors over from ioport to MMIO.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit f2416d3ae4d38a078f0ff7662b26bed9b61f8096
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      MAINTAINERS: add myself as SPARC maintainer

      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 9bb9f217f56b678f3ad2bddeb9894880ae0320b7
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      doc: minor updates to SPARC32 and SPARC64 documentation

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 0278377dde6a5a845e886567c1e68a77766a89b1
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: add m48t59 sysbus device

      This is for subsequent use by the sun4u machine.

      Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 6de0497385cbbbbd5f20ca712389b3691ea5c96d
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: introduce new base-year qdev property

      Currently the m48t59 device uses the hardware model in order to determine
      whether the year value is offset from the hardware value. As this will
      soon be required by the x59 model, create a qdev base-year property to
      represent the base year and update the callers appropriately.

      Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 3168824682058457344faecdbe7014caa0e8dd6e
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: let init functions return a Nvram object

      Remove left-overs from header file.
      Move some functions only used by PReP to hw/ppc/prep.c

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 43745328881e839124d3d589644732cb65052819
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: add a Nvram interface

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 051ddccde29924cb200df3bca3db8c1a2aa10974
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: register a QOM type for each nvram type we support

      As m48t59 devices can only be created with m48t59_init() or m48t59_init_isa(),
      we know exactly which nvram types are required. Register only those three
      types.

      Remove .model and .size properties as they can be infered from nvram name.

      Rename type to 'isa-*' (and 'sysbus-*') to do like other devices ISA devices
      (isa-ide, isa-parallel, isa-serial...)

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 72cd63f817d5405f7f7339e3d389cee73c189b33
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: move ISA ports/memory regions registration to QOM constructor

      -device m48t59_isa can now be used to create a fully functional nvram.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 5dce07e1cb67aab265b16e39b0b9d812199a4d22
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Mar 9 11:12:52 2015 +0100

      elf-loader: Provide the possibility to relocate s390 ELF files

      On s390, we would like to load our "BIOS" s390-ccw.img to the end of the
      RAM. Therefor we need the possibility to relocate the ELF file so that
      it can also run from different addresses. This patch adds the necessary
      code to the QEMU ELF loader function.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Message-Id: <1425895973-15239-2-git-send-email-thuth@linux.vnet.ibm.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5c8d542004b7474560bc4cb017d597ea320bd4ac
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:27:09 2015 +0100

      s390-ccw.img: Reinitialize guessing on reboot

      guessed_disk_nature is a static zero variable. As the QEMU ELF
      loader does not zero the BSS section, lets do it explicitely here.

      This fixes reboot for some corner cases (like FCP flash
      devices with logical_block_size=512, physical_block_size=4096)

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Eugene (jno) Dvurechenski <jno@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1425310029-53396-3-git-send-email-borntraeger@de.ibm.com>

  commit 2be9d2927cca76d8475f0083e9ecc87baf1b8222
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:27:08 2015 +0100

      s390-ccw.img: Allow bigger ramdisk sizes or offsets

      The s390-ccw bios creates the the virtqueue at 100MB. For
      big ramdisks or offsets (via zipl) this gets overwritten.
      As a quick band-aid, lets move the virtqueue into the bss
      section, which is at 0x7f00000. As the bios code (text) is
      at 0x7e00000 we can now handle ramdisk which are  ~27MB
      bigger.

      Long term we want to make the s390-ccw bios position
      independent and load of at the end of memory.

      Reported-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1425310029-53396-2-git-send-email-borntraeger@de.ibm.com>

  commit a310b283e357b54533c8168a92e8f1068efdc4d1
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 5 16:56:21 2015 +0100

      s390x/kvm: passing max memory size to accelerator

      With "KVM: s390: Allow userspace to limit guest memory size" KVM is able to
      do some optimizations based on the guest memory limit.

      The guest memory limit is computed by the initial definition and with the notion of
      hotplugged memory.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Guenther Hutzl <hutzl@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1425570981-40609-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5e5ced386a4ae74e406453dd5a7927936b1911aa
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:53:39 2015 +0100

      virtio-ccw: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045219-19958-1-git-send-email-armbru@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f35dd5665142022ae9e8c2749db774da275549c2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:55:37 2015 +0100

      virtio-s390: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045337-20138-3-git-send-email-armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3e300d24c4131060c6b3d3e20c890eb92f18597
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:55:36 2015 +0100

      virtio-s390: s390_virtio_device_init() can't fail, simplify

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045337-20138-2-git-send-email-armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f16d3f58748acff4c23f9149c3261844b4d595d5
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:31 2015 +0100

      s390x/kvm: enable the new SIGP handling in user space

      All required SIGP handlers have been implemented in QEMU.

      Let's enable the new sigp handling in user space if the kernel supports it.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-11-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3b7b57807b5820e21555b711726e6abb1a4050f
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:30 2015 +0100

      s390x/kvm: deliver SIGP RESTART directly if stopped

      According to the PoP, a restart irq has to be delivered "without first honoring
      any other pending interruptions", if a cpu is in the STOPPED state.

      While it is hard to implement this case in kvm, it can easily be handled in qemu.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-10-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 3f10341ffbbf4271485c32ca96a75d99d1b6bf6d
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:29 2015 +0100

      s390x: add function to deliver restart irqs

      This patch adds a helper function to deliver restart irqs. To be able to be used
      by kvm, the psw load/store methods have to perform special cc-code handling only
      when running with tcg.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-9-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 4f2b55d18413ba09f8a4367a670192e46e967fc0
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:28 2015 +0100

      s390x/kvm: SIGP START is only applicable when STOPPED

      In preparation for other CPU states, SIGP START will only start a VCPU if it is
      in the STOPPED state.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-8-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 18ff949474cfbba892fdc34aa6ed7558afc78c5c
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:27 2015 +0100

      s390x/kvm: implement handling of new SIGP orders

      This patch adds handling code for the following SIGP orders:
      - SIGP SET ARCHITECTURE
      - SIGP SET PREFIX
      - SIGP STOP
      - SIGP STOP AND STORE STATUS
      - SIGP STORE STATUS AT ADDRESS

      SIGP STOP (AND STORE STATUS) are the only orders that can stay pending forever
      (and may only be interrupted by resets), so special care has to be taken about
      them. Their status also has to be tracked within QEMU. This patch takes
      care of migrating this status (e.g. if migration happens during a SIGP STOP).

      Due to the BQL, only one VCPU is currently able to execute SIGP handlers at a
      time. According to the PoP, BUSY should be returned if another SIGP order is
      currently being executed on a VCPU. This can only be implemented when the BQL
      does not protect all handlers. For now, all SIGP orders on all VCPUs will be
      serialized, which will be okay for the first shot.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-7-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 56dba22b7dc1c41ff7dca6593080a99bcca74b5c
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:26 2015 +0100

      s390x/kvm: trace all SIGP orders

      This patch adds tracing code for all SIGP orders (including the destination
      vcpu and the resulting condition code).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-6-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 36b5c84556f38421c43ee4ff213f7ab64fd66a51
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:25 2015 +0100

      s390x/kvm: helper to set the SIGP status in SigpInfo

      Whenever we set the SIGP status in the status register, we have to wipe out
      the lower 4 bytes and keep the higher 4 bytes. Also the condition code will
      always be set to STATUS_STORED.

      Let's introduce the wrapper for SigpInfo, as this will avoid most duplicate
      code in the future.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-5-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 22740e3fc0856b2b6e66c91056a7026f87f51482
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:24 2015 +0100

      s390x/kvm: pass the SIGP instruction parameter to the SIGP handler

      The parameter of the SIGP instruction will be neded in the future. Let's read it
      out and store it in the struct sigp_info, so it can be passed to the sigp
      handlers.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-4-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 6eb8f212d2686ed9b17077d554465df7ae06f805
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:23 2015 +0100

      s390x/kvm: more details for SIGP handler with one destination vcpu

      Whenever a sigp order is to be executed by a target vcpu, we use run_on_cpu().
      As we have only one pointer to pass all data to these sigp handlers, let's
      introduce the struct sigp_info and use it as a transport container.

      All orders targeting a single vcpu are now  dispatched from a separate
      handler. The destination vcpu is only valid for these orders and must not be
      checked for SIGP SET ARCHITECTURE.

      The sigp_info is filled with life in this new handler and used to pass the
      information about the sigp order to the existing handlers. The cc is set
      within these handlers.

      Rename sigp_cpu_start() and sigp_cpu_restart() on the way to match the SIGP
      order names (in order to avoid touching affected lines several times).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5172b780c5d2e37ae0a2b48813fda0e54ea15c38
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:22 2015 +0100

      s390x: introduce defines for SIGP condition codes

      This patch introduces defines for the SIGP condition codes and replaces all
      occurrences of numeral condition codes with the new defines.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-2-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 51628b1898b6bc15306e5c831962f858c2b48eb5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:13:59 2015 +0100

      synchronize Linux headers to 4.0-rc3

      synchronize linux headers up to
      commit 9eccca0843205f87c ("Linux 4.0-rc3")

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 438940cbc2eabbe9e403e5249dfa0be6c792c93b
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Mar 4 20:03:41 2015 +0300

      9pfs: remove useless return

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3d0f44189178aab3a21a33ecf6a113b9abaea2bc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 2 13:26:58 2015 +0100

      gdbstub: avoid possible NULL pointer dereference

      Coverity reports that s->chr is checked after put_packet dereferences it.
      Move the check earlier, consistent with the code used for user-mode
      emulation.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c6dc3dd72b747a057770087998a1f9ef0b3f1882
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Feb 20 17:06:16 2015 +0100

      milkymist-pfpu: fix GCC 5.0.0 aggressive-loop-optimizations warning

      man gcc:
        Warn if in a loop with constant number of iterations the compiler
        detects undefined behavior in some statement during one or more of
        the iterations.

      Milkymist pfpu has no jump instructions, so checking for MICROCODE_WORDS
      instructions should have kept us in bounds of s->microcode, but i++
      allowed one loop too many,

        hw/misc/milkymist-pfpu.c: In function ‘pfpu_write’:
        hw/misc/milkymist-pfpu.c:365:20: error: loop exit may only be reached after undefined behavior [-Werror=aggressive-loop-optimizations]
                         if (i++ >= MICROCODE_WORDS) {
                            ^
        hw/misc/milkymist-pfpu.c:167:14: note: possible undefined statement is here
             uint32_t insn = s->microcode[pc];
                      ^

      The code can still access out of bounds, because it presumes that PC register
      always begins at 0, and we allow writing to it.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Acked-by: Michael Walle <michael@walle.cc>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8c1ac475e30091ba77a075d5e2136ece4f7c9cd0
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Feb 20 17:06:15 2015 +0100

      fix GCC 5.0.0 logical-not-parentheses warnings

      man gcc:
        Warn about logical not used on the left hand side operand of a
        comparison.  This option does not warn if the RHS operand is of a
        boolean type.

      By preferring bool over int where sensible, but without modifying any
      depending code, make GCC happy in cases like this,
        qemu-img.c: In function ‘compare_sectors’:
        qemu-img.c:992:39: error: logical not is only applied to the left hand
        side of comparison [-Werror=logical-not-parentheses]
                 if (!!memcmp(buf1, buf2, 512) != res) {

      hw/ide/core.c:1836 doesn't throw an error,
        assert(!!s->error == !!(s->status & ERR_STAT));
      even thought the second operand is int (and first hunk of this patch has
      a very similar case), maybe GCC developers still have a little faith in
      C programmers.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 02942db7982541716131ca486ca0d59eae107553
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:41 2015 +0100

      migration: Fix coding style (whitespace issues)

      * Remove trailing whitespace (fixes 9 errors from checkpatch.pl).
        One comment line was longer than 80 characters, so wrap it
        and fix a typo, too.
      * Replace tabs by blanks (fixes 1 error).

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2a0457bbba10c208358e4e52642abeadd5f10c33
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 13:52:06 2015 +0100

      oslib-posix: Fix compiler warning (-Wclobbered) and simplify the code

      gcc reports this warning with -Wclobbered:

      util/oslib-posix.c: In function ‘os_mem_prealloc’:
      util/oslib-posix.c:374:49: error: argument ‘memory’ might be clobbered by
       ‘longjmp’ or ‘vfork’ [-Werror=clobbered]

      Fix this and simplify the code by using an existing macro.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52b831de0099e627ee3505cb1c0c3d8eeefd3d65
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 14:18:35 2015 +0100

      disas/microblaze: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      disas/microblaze.c:289:3: warning:
       symbol 'opcodes' was not declared. Should it be static?
      disas/microblaze.c:570:6: warning:
       symbol 'register_prefix' was not declared. Should it be static?
      disas/microblaze.c:571:6: warning:
       symbol 'special_register_prefix' was not declared. Should it be static?
      disas/microblaze.c:572:6: warning:
       symbol 'fsl_register_prefix' was not declared. Should it be static?
      disas/microblaze.c:573:6: warning:
       symbol 'pvr_register_prefix' was not declared. Should it be static?

      Remove the unused variable special_register_prefix.
      The variable pvr_register_prefix was unused, too, but can be used.
      Add also 'const' where possible.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 35ff0798130b654a866dc4c944e8bf45575ad990
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 14:05:51 2015 +0100

      disas/arm: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      disas/arm.c:1552:15: warning:
       symbol 'last_type' was not declared. Should it be static?
      disas/arm.c:1553:5: warning:
       symbol 'last_mapping_sym' was not declared. Should it be static?
      disas/arm.c:1554:9: warning:
       symbol 'last_mapping_addr' was not declared. Should it be static?

      Instead of adding 'static', the unused variables and the unused code which
      refers to those variables (which was deactivated a long time ago in
      commit 4b0f1a8b) are removed.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d122f1a254abb91e42b4f2b2e1f8ee8980785e68
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:19:17 2015 +0100

      vhost_net: Add missing 'static' attribute

      This fixes a warning from smatch.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2343dd11a673597aa59813fd0cac2ae42e2e0312
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Sat Feb 28 20:27:43 2015 +0300

      e500: fix memory leak

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>

  commit acff77b1ea90366143cb16d6fb1840e5d43b6633
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Fri Feb 27 10:21:22 2015 -0500

      gitignore: Ignore new tests

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 08156b4c34c2083552dcade929f1b8ad436678ad
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Fri Feb 27 10:21:21 2015 -0500

      gitignore: Track common.env in iotests gitignore

      Rather than track it in the toplevel gitignore

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 84b5d556dc29c06402783e98ee0eaa3369eb48e1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:18 2015 +0800

      sysbus: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c2c17a245127cb456840e8dd9db9efc20a71e526
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:17 2015 +0800

      milkymist.c: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6c5819c4d685bf5f3c81edb462f4d17fb99ca2b5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:14 2015 +0800

      macio: fix possible memory leak

      If ret = macio_initfn_ide() is less than 0, the timer_memory
      will leak the memory it points to.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d71cdbfd540d91a6ae0005e59abfd782c424b07a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:13 2015 +0800

      sparc/leon3.c: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9d0b65e6e8f255dd86630a6873b3859fb6a5477f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:11 2015 +0800

      nbd: fix resource leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3e4c67c9ce1eafe374f3070499d25ddeffb9f3ca
  Author: Wang Xin <wangxinxin.wang@huawei.com>
  Date:   Sat Feb 28 16:33:23 2015 +0800

      qemu-char: add cyrillic key 'numerosign' to Russian keymap

      numero sign is the number sign key of Russian keyboard layout, we
      get this key with 'shift + 3'. It's missing in current Russian keymap file,
      this patch fixes it.
      As number sign does not exsit in Russian keyboard layout[1][2], this
      patch also removes the 'numbersign' from Russian keymap.

      [1] http://en.wikipedia.org/wiki/Keyboard_layout#Russian
      [2] http://kbd-intl.narod.ru/english/layouts

      Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 09f4fbe47314c2f13f16bf081997611f7f4251ea
  Author: Wang Xin <wangxinxin.wang@huawei.com>
  Date:   Sat Feb 28 16:33:22 2015 +0800

      qemu-char: add cyrillic characters 'numerosign' to VNC keysyms

      This patch adds missing cyrillic character 'numerosign' to the VNC
      keysym table, it's needed by Russian keyboard. And I get the keysym from
      '<X11/keysymdef.h>', the current keysym table in Qemu was generated from
      it.

      Signed-off-by: Wang xin <wangxinxin.wang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e781c79449ec2b3b649712c85610b147e3d41ee
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Thu Feb 26 13:59:58 2015 -0500

      qapi-schema: Fix SpiceChannel docs

      The value is called channel-type, not connection-type

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 611af7fdb65759193c357e7d415feabad21e3b74
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:08 2015 +0100

      xen: Remove xen_cmos_set_s3_resume()

      The function is not used anymore, and thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 09526058d0a501106dcac842a455e187f1413d98
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:07 2015 +0100

      ui/vnc: Remove vnc_stop_worker_thread()

      This function is not used anymore, let's remove it.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b67072f0aba5837870163116da398005969495df
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:06 2015 +0100

      ui: Removed unused functions

      Remove qemu_console_displaystate(), qemu_remove_kbd_event_handler(),
      qemu_different_endianness_pixelformat() and cpkey(), since they are
      completely unused.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c65476612aa4842785939fa3fbea2123cc980c75
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:37 2015 +0800

      vhost: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d448527a4f19979f7005949025796121bdfdfa61
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:36 2015 +0800

      arm/digic_boards: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 27215a22ddade35e83cc8bb4f49a5bd91b98ca19
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:35 2015 +0800

      tpm: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ebbb419aa290dad2f8eb840398f5e87db0bad3a5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:34 2015 +0800

      xtensa: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 78e5b17f0495acf19a8e7830018e95e759504a51
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:33 2015 +0800

      vfio: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f6a16175962db8b2c7bd23374d5c138ef0171dcc
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:32 2015 +0800

      vhost-scsi: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 81b07353c5e7ae9ae9360c357b7b4732b1cb03b4
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:31 2015 +0800

      Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 01bbbcf41fbd6a3b8d58a9a09e257f5ab1797f1d
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:30 2015 +0800

      numa: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0c267a6b40e8a85d3a6dacee853531d1e98da122
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:29 2015 +0800

      pl330.c: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 15e10b3499782df5d2adc0d2941e445a67d78a8a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:28 2015 +0800

      a9gtimer: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit eec5eb42f597e652ad3b32d7bf13252966c4e85e
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:27 2015 +0800

      block: remove superfluous '\n' around error_report/error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3599d46ba23062df580a23a50f8c103070d7365d
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Feb 26 16:35:07 2015 +0200

      qmp-commands.hx: Fix several typos

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5b7a580f1f2d9ca04cf77d33515b29a149c01f1f
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Feb 20 14:58:23 2015 +0200

      qerror.h: Swap definitions that were not in alphabetical order

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 826a7cd9d94427aa72ff03f109632e48cf5f26ec
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:17:34 2015 -0500

      Add copyright and author after file split

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by:  Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit cc5d0e04ee313d0ceee5d8e4e697142eaf240dca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 12:30:43 2015 +0100

      cutils: refine strtol error handling in parse_debug_env

      Avoid truncation of a 64-bit long to a 32-bit int, and check for errno
      (especially ERANGE).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7c601803fb5f868a05ef762eebcc32bdfd1ebfdc
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Tue Feb 10 22:40:47 2015 +0300

      qemu-options: fix/document -incoming options

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b155eb1d0409eff4d0e7f33c746c81434f0ea629
  Author: Gabriel L. Somlo <gsomlo@gmail.com>
  Date:   Thu Feb 5 11:45:30 2015 -0500

      smbios: document cmdline options for smbios type 2-4, 17 structures

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0dc9daf0be2a4ebb3c6529d1c458d8ccf26cd412
  Author: Borislav Petkov <bp@suse.de>
  Date:   Sun Feb 8 13:14:38 2015 +0100

      memsave: Improve and disambiguate error message

      When requesting a size which cannot be read, the error message shows
      a different address which is misleading to the user and it looks like
      something's wrong with the address parsing. This is because the input
      @addr variable is incremented in the memory dumping loop:

      (qemu) memsave 0xffffffff8418069c 0xb00000 mem
      Invalid addr 0xffffffff849ffe9c specified

      Fix that by saving the original address and size and use them in the
      error message:

      (qemu) memsave 0xffffffff8418069c 0xb00000 mem
      Invalid addr 0xffffffff8418069c/size 11534336 specified

      Signed-off-by: Borislav Petkov <bp@suse.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 31da45ce04c5e886369bf88bf727cef5ccb3b12b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 21 14:18:37 2015 +0100

      xilinx_ethlite: Clean up after commit 2f991ad

      The "fall through" added by the commit is clearly intentional.  Mark
      it so.  Hushes up Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 14cec170ea4724e6881ba2febb20e88a942e52d3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 10 15:51:23 2015 +0800

      xen-pt: fix Out-of-bounds read

      The array length of s->real_device.io_regions[] is
      "PCI_NUM_REGIONS - 1".

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d4cd45028898a37afb45fb449954115b4960d4e9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 10 15:51:22 2015 +0800

      xen-pt: fix Negative array index read

      Coverity spot:
      Function xen_pt_bar_offset_to_index() may return a negative
      value (-1) which is used as an index to d->io_regions[] down
      the line.

      Let's pass index directly as an argument to
      xen_pt_bar_reg_parse().

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9886e834f47adabdbfd54ab606788ce7326e6779
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:31:11 2014 -0200

      target-i386: Require APIC ID to be explicitly set before CPU realize

      On softmuu, instead of setting APIC ID automatically when creating a
      X86CPU, require the property to be set before realizing the object
      (which is already done by the CPU creation code on PC).

      Keep apic_id = 0 by default on *-user so it can simply create a new CPU
      object and realize it without extra steps (so target-i386 will be able
      to use cpu_generic_init() eventually).

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 54a402930ac6d1a9d6d402229ae8ba8bef7e598e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:43:35 2014 -0200

      target-i386: Move APIC ID compatibility code to pc.c

      The APIC ID compatibility code is required only for PC, and now that
      x86_cpu_initfn() doesn't use x86_cpu_apic_id_from_index() anymore, that
      code can be moved to pc.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7e72a45c99fccfe5586d7c4e2f7441f28e24e450
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:20:10 2014 -0200

      target-i386: Move CPUX86State::cpuid_apic_id to X86CPU::apic_id

      The field doesn't need to be inside CPUX86State, and it is not specific
      for the CPUID instruction, so move and rename it.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0f4b210e504d7db42b96882e94481f444e420fe3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Mar 3 22:54:03 2015 -0300

      target-i386: Remove unused APIC ID default code

      The existing apic_id = cpu_index code has no visible effect: the PC code
      already initializes the APIC ID according to the topology on
      pc_new_cpu(), and linux-user memcpy()s the CPU state (including
      cpuid_apic_id) on cpu_copy().

      Remove the dead code and simply let APIC ID to to be 0 by default. This
      doesn't change behavior of PC because apic-id is already explicitly set,
      and doesn't affect linux-user because APIC ID was already always 0.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 5eb2f7a4df03b53f7eaf56d2dd53d75328909826
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:57:50 2015 -0200

      target-i386: Eliminate unnecessary get_cpuid_vendor() function

      The function was used in only two places. In one of them, the function
      made the code less readable by requiring temporary te[bcd]x variables.
      In the other one we can simply inline the existing code.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8c3329e50ad74245acbea89bdaa8af12ecf4972c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:48:55 2015 -0200

      target-i386: Simplify listflags() function

      listflags() had lots of unnecessary complexity. Instead of printing to a
      buffer that will be immediately printed, simply call the printing
      function directly. Also, remove the fbits and flags arguments that were
      always set to the same value. Also, there's no need to list the flags in
      reverse order.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 869b7649b534b51dd9e6ddbbdeb7397e083f527f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:41:06 2014 -0200

      target-i386: Move topology.h to include/hw/i386

      This will allow the PC code to use the header, and lets us eliminate the
      QEMU_INCLUDES hack inside tests/Makefile.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 277263e1b320d759a760ba6c5ea75ec268f929e5
  Merge: 0048fa6 a9ab06d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 9 14:04:14 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-03-09

      This is my current patch queue for 2.3. Highlights include:

        * pseries: 2.3 machine
        * pseries: Export RTC via QOM
        * pseries: EEH support
        * mac: save/restore support
        * fix POWER5 hosts
        * random bug fixes

      # gpg: Signature made Mon Mar  9 14:00:53 2015 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (38 commits)
        target-ppc: Fix warnings from Sparse
        sPAPR: Implement sPAPRPHBClass EEH callbacks
        sPAPR: Implement EEH RTAS calls
        target-ppc: Add versions to server CPU descriptions
        PPC: Introduce the Virtual Time Base (VTB) SPR register
        PPC: Remove duplicate OPENPIC defines in default-configs
        ppc64-softmmu: Remove duplicated OPENPIC from config
        Revert "default-configs/ppc64: add all components of i82378 SuperIO chip used by prep"
        spapr_vio: Convert to realize()
        openpic: convert to vmstate
        openpic: switch IRQQueue queue from inline to bitmap
        openpic: fix up loadvm under -M mac99
        openpic: fix segfault on -M mac99 savevm
        target-ppc: force update of msr bits in cpu_post_load
        target-ppc: move sdr1 value change detection logic to helper_store_sdr1()
        cuda.c: include adb_poll_timer in VMStateDescription
        adb.c: include ADBDevice parent state in KBDState and MouseState
        macio.c: include parent PCIDevice state in VMStateDescription
        display cpu id dump state
        Openpic: check that cpu id is within the number of cpus
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9ab06d1187f5967d315052da948afba6c3ba651
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 23:16:38 2015 +0100

      target-ppc: Fix warnings from Sparse

      Sparse report:

      target-ppc/mmu-hash64.c:353:9: warning: returning void-valued expression
      target-ppc/mmu-hash64.c:620:9: warning: returning void-valued expression

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2aad88f4b05303531bc9aad6531258616d95af52
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Fri Feb 20 15:58:53 2015 +1100

      sPAPR: Implement sPAPRPHBClass EEH callbacks

      The patch implements sPAPRPHBClass EEH callbacks so that the EEH
      RTAS requests can be routed to VFIO for further handling.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee954280da8d9ea7afd28b4c288da15fb8b4efca
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Fri Feb 20 15:58:52 2015 +1100

      sPAPR: Implement EEH RTAS calls

      The emulation for EEH RTAS requests from guest isn't covered
      by QEMU yet and the patch implements them.

      The patch defines constants used by EEH RTAS calls and adds
      callbacks sPAPRPHBClass::{eeh_set_option, eeh_get_state, eeh_reset,
      eeh_configure}, which are going to be used as follows:

        * RTAS calls are received in spapr_pci.c, sanity check is done
          there.
        * RTAS handlers handle what they can. If there is something it
          cannot handle and the corresponding sPAPRPHBClass callback is
          defined, it is called.
        * Those callbacks are only implemented for VFIO now. They do ioctl()
          to the IOMMU container fd to complete the calls. Error codes from
          that ioctl() are transferred back to the guest.

      [aik: defined RTAS tokens for EEH RTAS calls]
      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d7586dc426472b5ad0f5c01b5c7c551eeb5a6003
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Wed Mar 4 12:31:26 2015 +1100

      target-ppc: Add versions to server CPU descriptions

      5b79b1c "target-ppc: Create versionless CPU class per family if KVM" added
      a dynamic CPU class registration with the name of the CPU family which
      QEMU is running on. For example, this allowed specifying "-cpu POWER7"
      on every version of POWER7 machine, not just the one which POWER7 was
      an alias of. I.e. before 5b79b1c, "-cpu POWER7" would not work on real
      POWER7 2.1 and would work on POWER7 2.3 only. The same story for POWER8.

      However that patch broke POWER5+ support as POWER5+ CPU uses the same
      name as the CPU class so dynamic registering of the POWER5+ class failed.

      This redefines POWER5+ server CPUs by adding a version to them and adding
      an alias for TCG case. KVM will use dynamically registered CPUs.

      While we are here, do the same for 970 CPU.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3ba55e399f7637d2b4054bcc30228cd2d0883823
  Author: Cyril Bur <cyril.bur@au1.ibm.com>
  Date:   Mon Mar 2 17:55:38 2015 +1100

      PPC: Introduce the Virtual Time Base (VTB) SPR register

      This patch adds basic support for the VTB.

      PowerISA:
      The Virtual Time Base (VTB) is a 64-bit incrementing counter.
      Virtual Time Base increments at the same rate as the Time Base until its value
      becomes 0xFFFF_FFFF_FFFF_FFFF (2 64 - 1); at the next increment its value
      becomes 0x0000_0000_0000_0000. There is no interrupt or other indication when
      this occurs.

      The operation of the Virtual Time Base has the following additional
      properties.
      1. Loading a GPR from the Virtual Time Base has no effect on the accuracy of
      the Virtual Time Base.
      2. Copying the contents of a GPR to the Virtual Time Base replaces the
      contents of the Virtual Time Base with the contents of the GPR.

      Signed-off-by: Cyril Bur <cyril.bur@au1.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6494ad9bf4f6e1561f078337d6d82018fd6e7516
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Mar 2 14:31:58 2015 +0100

      PPC: Remove duplicate OPENPIC defines in default-configs

      The CONFIG_OPENPIC variable was declared multiple times. We only need it once.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46ca0116657c225db0d7d3ee4fb0ed9fbf072257
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 17:46:27 2015 +1100

      ppc64-softmmu: Remove duplicated OPENPIC from config

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 25e1727884493596bfeecb8af569442983400a34
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 17:46:25 2015 +1100

      Revert "default-configs/ppc64: add all components of i82378 SuperIO chip used by prep"

      This reverts commit 9c9984242ce46ccf8636f5c19e81d794e84aa0c7 as even when
      it was applied, all supposedly new config options were already enabled.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28b07e737eb58f299b066c1c6b3740bb055a2cf9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 11:52:17 2015 +0100

      spapr_vio: Convert to realize()

      Bonus fix: always set an error on failure.  Some failures were silent
      before, except for the generic error set by device_realize().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5f6e7327a95bf4c7e9354cd00e03d7ffaf25f8e
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:52 2015 +0000

      openpic: convert to vmstate

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2ada66f944c0db9d037c7cf3ff1a4fd43283338d
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:51 2015 +0000

      openpic: switch IRQQueue queue from inline to bitmap

      This is in preparation for using VMSTATE_BITMAP in a followup vmstate
      migration patch.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 032ab092904ce1615e3cedcb9ebc775bd3d7fac6
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:50 2015 +0000

      openpic: fix up loadvm under -M mac99

      Issuing loadvm under -M mac99 would fail for two reasons: firstly an incorrect
      version number for openpic would cause openpic_load() to abort, and secondly
      a cut/paste error when restoring the IVPR and IDR registers caused subsequent
      vmstate sections to become misaligned and abort early.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4efef9864082c8daa2a0fcff2d5bc0bfca221d1f
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:49 2015 +0000

      openpic: fix segfault on -M mac99 savevm

      A simple copy/paste error causes savevm on -M mac99 to segfault.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2360b6e84f78d41fa0f76555a947148b73645259
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:48 2015 +0000

      target-ppc: force update of msr bits in cpu_post_load

      Since env->msr has already been restored by the time cpu_post_load is called,
      make sure that ppc_store_msr() is explicitly called with all msr bits except
      MSR_TGPR marked as invalid.

      This solves the issue where MSR flags aren't set correctly when restoring a VM
      snapshot, in particular the internal env->excp_prefix value when MSR_EP has
      been altered by a guest.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2828c4cd92b1c0590b959ec022888b1f6909949a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:47 2015 +0000

      target-ppc: move sdr1 value change detection logic to helper_store_sdr1()

      Otherwise when cpu_post_load calls ppc_store_sdr1() when restoring a VM
      snapshot the value is deemed unchanged and so the internal env->htab*
      variables aren't set correctly.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6cb577dde5c2e19025f4f24fdff46c47ba8cd398
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:46 2015 +0000

      cuda.c: include adb_poll_timer in VMStateDescription

      Make sure that we include the adb_poll_timer when saving the VM state for
      client OSs that use it, e.g. Darwin.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5dffaa5b19b284718b40a4aba01abf0bcdabf7a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:45 2015 +0000

      adb.c: include ADBDevice parent state in KBDState and MouseState

      The parent ADBDevice contains the device id on the ADB bus. Make sure that
      this state is included in both its subclasses since some clients (such as
      OpenBIOS) reprogram each device id after enumeration.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 026359238b50f56a90961d9aa62ef303371eca8c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:44 2015 +0000

      macio.c: include parent PCIDevice state in VMStateDescription

      This ensures that the macio PCI device is correctly configured when restoring
      from a VM snapshot.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 21e5d28a4798f536525338f4f9137d83a9556491
  Author: Tristan Gingold <gingold@adacore.com>
  Date:   Wed Feb 25 10:39:25 2015 +0100

      display cpu id dump state

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 04d2acbb57900f1cba2eef86b21ab78d854683db
  Author: Fabien Chouteau <chouteau@adacore.com>
  Date:   Wed Feb 25 10:50:28 2015 +0100

      Openpic: check that cpu id is within the number of cpus

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit eefaccc02bab659c8cb4c994b2f385c3f0a27551
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Tue Feb 10 15:36:16 2015 +1100

      pseries: Switch VGA endian on H_SET_MODE

      When the guest switches the interrupt endian mode, which essentially
      means a global machine endian switch, we want to change the VGA
      framebuffer endian mode as well in order to be backward compatible
      with existing guests who don't know about the new endian control
      register.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3c2784fc864d943ff70a2a5c9dea8e9a9b4d9e1d
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Tue Feb 10 15:36:15 2015 +1100

      vga: Expose framebuffer byteorder as a QOM property

      The VGA device model now supports having the framebuffer in either endian,
      and can be switched between these by the guest via a register in the qext
      region.

      However, in some cases (e.g. LE OS on the pseries machine) we have
      existing guest that don't know about the endian switch register, but other
      parts of the qemu code have better information to set a default endianness
      than the VGA code does of itself.

      In order to allow them to set a correct default endianness in these cases,
      without breaking abstraction walls, this patch exposes the VGA framebuffer
      endianness via a writable QOM property.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      [agraf: use instance_init for property exposure]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 34f2af3d3edf9d57c27811d3780cbc0ece319625
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:48 2015 +0100

      spapr: Clean up misuse of qdev_init() in xics-kvm creation

      We call try_create_xics() to create a "xics-kvm".  If it fails, we
      call it again to fall back to plain "xics".

      try_create_xics() uses qdev_init().  qdev_init()'s error handling has
      an unwanted side effect: it calls qerror_report_err(), which prints to
      stderr.  Looks like an error, but isn't.

      In QMP context, it would stash the error in the monitor instead,
      making the QMP command fail.  Fortunately, it's only called from board
      initialization, never in QMP context.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      While there, improve the error message when we can't satisfy an
      explicit user request for "xics-kvm", and exit(1) instead of abort().
      Simplify the abort when we can't create "xics".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      [agraf: squash in fix for uninitialized variable from mdroth]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fe656ebd4e4339972bae771a692109fd43ff5737
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:47 2015 +0100

      PPC: Clean up misuse of qdev_init() in kvm-openpic creation

      We call ppce500_init_mpic_kvm() to create a "kvm-openpic".  If it
      fails, we call ppce500_init_mpic_qemu() to fall back to plain
      "openpic".

      ppce500_init_mpic_kvm() uses qdev_init().  qdev_init()'s error
      handling has an unwanted side effect: it calls qerror_report_err(),
      which prints to stderr.  Looks like an error, but isn't.

      In QMP context, it would stash the error in the monitor instead,
      making the QMP command fail.  Fortunately, it's only called from board
      initialization, never in QMP context.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      While there, improve the error message when we can't satisfy an
      explicit user request for "kvm-openpic", and exit(1) instead of
      abort().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 74e5ae284b1c8ac36a77e57ab9a49178173c666f
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:53 2015 +1100

      pseries: Export RTC time via QOM

      On x86, the guest's RTC can be read with QMP, either from the RTC device's
      "date" property or via the "rtc-time" property on the machine (which is an
      alias to the former).  This is set up in the mc146818rtc driver, and
      doesn't work on other targets.

      This patch adds a similar "date" property to the pseries machine's RTAS RTC
      and adds a compatible alias to the machine.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 880ae7de5958a765699386777de0f3841d635e1d
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:52 2015 +1100

      pseries: Move rtc_offset into RTC device's state structure

      The initial creation of the PAPR RTC qdev class left a wart - the rtc's
      offset was left in the sPAPREnvironment structure, accessed via a global.

      This patch moves it into the RTC device's own state structure, were it
      belongs.  This requires a small change to the migration stream format.  In
      order to handle incoming streams from older versions, we also need to
      retain the rtc_offset field in the sPAPREnvironment structure, so that it
      can be loaded into via the vmsd, then pushed into the RTC device.

      Since we're changing the migration format, this also takes the opportunity
      to:

        * Change the rtc offset from a value in seconds to a value in
          nanoseconds, allowing nanosecond offsets between host and guest
          rtc time, if desired.

        * Remove both the already unused "next_irq" field and now unused
          "rtc_offset" field from the new version of the spapr migration
          stream

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28df36a13a3b0b792d9df64f8db8a392df5e0b35
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:51 2015 +1100

      pseries: Make the PAPR RTC a qdev device

      At present the PAPR RTC isn't a "device" as such - it's accessed only via
      firmware/hypervisor calls, and is handled in the sPAPR core code.  This
      becomes inconvenient as we extend it in various ways.

      This patch makes the PAPR RTC a separate device in the qemu device model.

      For now, the only piece of device state - the rtc_offset - is still kept in
      the global sPAPREnvironment structure.  That's clearly wrong, but leaving
      it to be fixed in a following patch makes for a clearer separation between
      the internal re-organization of the device, and the behavioural changes
      (because the migration stream format needs to change slightly when the
      offset is moved into the device's own state).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f01c5d84775cfc877dc0b537565a168d043394e9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:50 2015 +1100

      pseries: Make RTAS time of day functions respect -rtc options

      In the 'pseries' machine the real time clock is provided by a
      paravirtualized firmware interface rather than a device per se; the RTAS
      get-time-of-day and set-time-of-day calls.

      Out current implementations of those work directly off host time (with
      an offset), not respecting options such as clock=vm which can be
      specified in the -rtc command line option.

      This patch reworks the RTAS RTC code to respect those options, primarily
      by basing them on the qemu_clock_get_ns(rtc_clock) function instead of
      directly on qemu_get_timedate() (which essentially handles host time, not
      virtual rtc time).

      As a bonus, this means our get-time-of-day function now also returns
      nanoseconds.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5dad1d7d1618822dbadb1dd12efa1b5674b6c40
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:49 2015 +1100

      pseries: Add spapr_rtc_read() helper function

      The virtual RTC time is used in two places in the pseries machine.  First
      is in the RTAS get-time-of-day function which returns the RTC time to the
      guest.  Second is in the spapr events code which is used to timestamp
      event messages from the hypervisor to the guest.

      Currently both call qemu_get_timedate() directly, but we want to change
      that so we can properly handle the various -rtc options.  In preparation,
      create a helper function to return the virtual RTC time.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bbade20633a6b4ed7333e03a76038eda98950946
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:48 2015 +1100

      pseries: Add more parameter validation in RTAS time of day functions

      Currently, the RTAS time of day functions only partially validate the
      number of parameters they receive and return.  Because of how the
      parameters are used, this is unlikely to lead to a crash, but it's messy.

      This patch adds the missing checks.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 12f421745cd763742377c7134f48fa12fb889ee3
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:47 2015 +1100

      pseries: Move sPAPR RTC code into its own file

      At the moment the RTAS (firmware/hypervisor) time of day functions are
      implemented in spapr_rtas.c along with a bunch of other things.  Since
      we're going to be expanding these a bit, move the RTAS RTC related code
      out into new file spapr_rtc.c.  Also add its own initialization function,
      spapr_rtc_init() called from the main machine init routine.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 87774a4a4217b5cddc693f0678d0fc2bfc7f2ec1
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:46 2015 +1100

      Add more VMSTATE_*_TEST variants for integers

      Currently, vmstate.h includes helper macro variants for 8, 16 and 32-bit
      unsigned integers which include a "test" function which can selectively
      enable or disable the field's presence in the migration stream.

      There aren't similar helpers for 64-bit unsigned integers, or any size of
      signed integers.  This patch remedies this.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8e099d14f5233f330c4a6f03ff655219cd789c8f
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:45 2015 +1100

      Generalize QOM publishing of date and time from mc146818rtc.c

      The mc146818rtc driver exposes the current RTC date and time via the "date"
      property in QOM (which is also aliased to the machine's "rtc-time"
      property).  Currently it uses a custom visitor function rtc_get_date to
      do this.

      This patch introduces new helpers to the QOM core to expose struct tm
      valued properties via a getter function, so that this functionality can be
      more easily duplicated in other RTC implementations.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b194df478ae7607d93b47a8307e623c9f9f2b3ab
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Jan 30 12:53:19 2015 +1100

      spapr-pci: Enable huge BARs

      At the moment sPAPR only supports 512MB window for MMIO BARs. However
      modern devices might want bigger 64bit BARs.

      This extends MMIO window from 512MB to 62GB (aligned to
      SPAPR_PCI_WINDOW_SPACING) and advertises it in 2 records in
      the PHB "ranges" property. 32bit gets the space from
      SPAPR_PCI_MEM_WIN_BUS_OFFSET till the end of 4GB, 64bit gets the rest
      of the space. If no space is left, 64bit range is not advertised.

      The MMIO space size is set to old value of 0x20000000 by default
      for pseries machines older than 2.3.

      The approach changes the device tree which is a guest visible change, however
      it won't break migration as:
      1. we do not support migration to older QEMU versions
      2. migration to newer QEMU will migrate the device tree as well and since
      the new layout only extends the old one and does not change address mappigns,
      no breakage is expected here too.

      SLOF change is required to utilize this extension.

      Suggested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3dab024430cf72ea65afce227585f9768fb3bfa7
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Jan 30 12:53:18 2015 +1100

      spapr: Add pseries-2.3 machine

      The next patch will make MMIO space bigger and keep the old value for
      older pseries machines.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e4ac9687103f907eadea10d6176eb2e989d1e36
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Wed Jan 14 13:33:39 2015 +1100

      pseries: Limit PCI host bridge "index" value

      pseries guests can have large numbers of PCI host bridges.  To avoid the
      user having to specify a number of different configuration values for every
      one, the device supports an "index" property which is a shorthand setting
      the various window and configuration addresses from a predefined sensible
      set.

      There are some problems with the details at present:
        * The "index" propery is signed, but negative values will create PCI
      windows below where we expect, potentially colliding with other devices
        * No limit is imposed on the "index" property and large values can
      translate to extremely large window addresses.  With PCI passthrough in
      particular this can mean we exceed various mapping and physical address
      limits causing the guest host bridge to not work in strange ways.

      This patch addresses this, by making "index" unsigned, and imposing a
      limit.  Currently the limit allows indices from 0..255 which is probably
      enough host bridges for the time being.  It's fairly easy to extend if
      we discover we need more.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ad3e67d05a65da2e3696ed45b999e061ccb7a879
  Author: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
  Date:   Mon Jan 26 19:51:58 2015 +0530

      target-ppc: Use right page size with hash table lookup

      We look at two sizes specified in ISA (4K, 64K). If not found matching,
      we consider it 16MB.

      Without this patch we would fail to lookup address above 16MB range.
      Below 16MB happened to work before because the kernel have a liner
      mapping and we always looked up hash for 0xc000000000000000. The
      actual real address was computed by using the 16MB offset
      with the real address found with the above hash.

      Without Fix:
      (gdb) x/16x 0xc000000001000000
      0xc000000001000000 <list_entries+453208>:       Cannot access memory at address 0xc000000001000000
      (gdb)

      With Fix:
      (gdb)  x/16x 0xc000000001000000
      0xc000000001000000 <list_entries+453208>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000010 <list_entries+453224>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000020 <list_entries+453240>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000030 <list_entries+453256>:       0x00000000      0x00000000      0x00000000      0x00000000

      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee9a569ab88edd0755402aaf31ec0c69decf7756
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu Jan 29 16:04:58 2015 +1100

      spapr_vio/spapr_iommu: Move VIO bypass where it belongs

      Instead of tweaking a TCE table device by adding there a bypass flag,
      let's add an alias to RAM and IOMMU memory region, and enable/disable
      those according to the selected bypass mode.
      This way IOMMU memory region can have size of the actual window rather
      than ram_size which is essential for upcoming DDW support.

      This moves bypass logic to VIO layer and keeps @bypass flag in TCE table
      for migration compatibility only. This replaces spapr_tce_set_bypass()
      calls with explicit assignment to avoid confusion as the function could
      do something more that just syncing the @bypass flag.

      This adds a pointer to VIO device into the sPAPRTCETable struct to provide
      the sPAPRTCETable device a way to update bypass mode for the VIO device.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 20a1f9d07125bead22efd1dc208b4d14ae1b2a21
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 17 14:47:54 2015 +0100

      qcow2: Remove unused struct QCowCreateState

      The only user went away five years ago with commit a9420734 ('qcow2:
      Simplify image creation'). It's about time to remove it.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6dcf097fad2773fdee9ea12f8452dcc259e9ee1
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Thu Feb 12 08:35:49 2015 +0300

      block/raw-posix: fix compilation warning on OSX

      block/raw-posix.c:947:19: warning: unused variable 's' [-Wunused-variable]
          BDRVRawState *s = aiocb->bs->opaque;

      This variable is used only when on of the following macros are defined
      CONFIG_XFS, CONFIG_FALLOCATE, CONFIG_FALLOCATE_PUNCH_HOLE or
      CONFIG_FALLOCATE_ZERO_RANGE. Fortunately, CONFIG_FALLOCATE_PUNCH_HOLE
      and CONFIG_FALLOCATE_ZERO_RANGE could be defined only along with
      CONFIG_FALLOCATE. Therefore checking for CONFIG_XFS or CONFIG_FALLOCATE
      would be enough.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Peter Maydell <peter.maydell@linaro.org>
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 876eb1b0cc2b04927739cba10e4e73e8b990d65e
  Author: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
  Date:   Fri Feb 13 18:20:53 2015 +0900

      sheepdog: selectable object size support

      Previously, qemu block driver of sheepdog used hard-coded VDI object size.
      This patch enables users to handle VDI object size.

      When you start qemu, you don't need to specify additional command option.

      But when you create the VDI which doesn't have default object size
      with qemu-img command, you specify object_size option.

      If you want to create a VDI of 8MB object size,
      you need to specify following command option.

       # qemu-img create -o object_size=8M sheepdog:test1 100M

      In addition, when you don't specify qemu-img command option,
      a default value of sheepdog cluster is used for creating VDI.

       # qemu-img create sheepdog:test2 100M

      Signed-off-by: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
      Acked-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0cc84887068eeb59eed84dbab6547b39e83d739c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Feb 11 15:56:01 2015 +0100

      vpc: Implement bdrv_co_get_block_status()

      This implements bdrv_co_get_block_status() for VHD images. This can
      significantly speed up qemu-img convert operation because only with this
      function implemented sparseness can be considered. (Before, converting a
      1 TB empty image took several minutes for me, now it's instantaneous.)

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 3f3f20dcd34fc2fcf6dea2fe4e9b45d1c4d67288
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Feb 11 17:19:57 2015 +0100

      vpc: Fix size in fixed image creation

      If total_sectors is rounded to match the geometry, total_size needs to
      be changed as well. Otherwise we end up with an image whose geometry
      describes a disk larger than the image file, which doesn't end well.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 7c2eed3efa86c19436bc33372bfa9d7fbb6fda2c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Feb 10 11:15:59 2015 +0100

      test-coroutine: Regression test for yield bug

      This adds a test for reentering a coroutine that previously yielded to a
      coroutine that has meanwhile terminated.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit cd12bb567cdcd9665a5acdecd6ac8afd9a977003
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 11:31:52 2015 +0100

      coroutine: Clean up qemu_coroutine_enter()

      qemu_coroutine_enter() is now the only user of coroutine_swap(). Both
      functions are short, so inline it.

      Also, using COROUTINE_YIELD is now even more confusing because this code
      is never called during qemu_coroutine_yield() any more. In fact, this
      value is never read back, so we can just introduce a new COROUTINE_ENTER
      which documents the purpose of the task switch better.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 315a1309defd8ddf910c6c17e28cbbd7faf92f2e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 11:17:53 2015 +0100

      coroutine: Fix use after free with qemu_coroutine_yield()

      Instead of using the same function for entering and exiting coroutines,
      and hoping that it doesn't add any functionality that hurts with the
      parameters used for exiting, we can just directly call into the real
      task switch in qemu_coroutine_switch().

      This fixes a use-after-free scenario where reentering a coroutine that
      has yielded still accesses the old parent coroutine (which may have
      meanwhile terminated) in the part of coroutine_swap() that follows
      qemu_coroutine_switch().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0048fa6c807fc8fb5c52873562ea3debfa65f085
  Merge: 6608c7e 59ea3e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 9 09:14:28 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, pc, virtio fixes and cleanups

      A bunch of fixes all over the place.
      All of ACPI refactoring has been merged.
      Legacy pci commands have been dropped.
      virtio header cleanup
      initial patches from virtio-1.0 branch

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      * remotes/mst/tags/for_upstream: (130 commits)
        acpi: drop unused code
        aml-build: comment fix
        acpi-build: fix typo in comment
        acpi: update generated files
        vhost user:support vhost user nic for non msi guests
        aml-build: fix build for glib < 2.22
        acpi: update generated files
        Makefile.target: binary depends on config-devices
        acpi-test-data: update after pci rewrite
        acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb().
        pci-hotplug-old: Has been dead for five major releases, bury
        pci: Give a few helpers internal linkage
        acpi: make build_*() routines static to aml-build.c
        pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs
        pc: acpi-build: drop template patching and create PCI bus tree dynamically
        tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation
        pc: acpi-build: simplify PCI bus tree generation
        tests: add ACPI blobs for qemu with bridge cases
        tests: bios-tables-test: add support for testing bridges
        tests: ACPI test blobs update due to PCI0._CRS changes
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

      Conflicts:
      	hw/pci/pci-hotplug-old.c

  commit 6608c7e9eb65727524f6f590b1e716ec6e7877d4
  Merge: 9c31a82 12004c9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 14:32:38 2015 +0000

      Merge remote-tracking branch 'remotes/xtensa/tags/20150307-xtensa' into staging

      Xtensa updates:

      - implement do_unassigned_access callback;
      - fix ML605 xtfpga FLASH size.

      # gpg: Signature made Sat Mar  7 12:35:05 2015 GMT using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20150307-xtensa:
        target-xtensa: xtfpga: fix ml605 flash size
        target-xtensa: implement do_unassigned_access callback
        hw/xtensa: allow reads/writes in the system I/O region

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9c31a8219a8fb6e790d5510987ae2c810ff968b5
  Merge: 033c7dd a3b0421
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 12:47:13 2015 +0000

      Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging

      * remotes/qmp-unstable/queue/qmp:
        docs: add memory-hotplug.txt
        qemu-options.hx: improve -m description
        virtio-balloon: Add some trace events
        virtio-balloon: Fix balloon not working correctly when hotplug memory
        pc-dimm: add a function to calculate VM's current RAM size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 59ea3e7532a85b15bd551335b27fa97db48efa8d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 11:49:21 2015 +0100

      acpi: drop unused code

      Recent changes left acpi_get_hex unused,
      and clag is unhappy about it:
          error: unused function 'acpi_get_hex'

      Drop it, as well as some unused macros.

      Signer-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 56521fb88f7e3d2e3c7cf87d5f85e17e563c0df7
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 10:36:52 2015 +0100

      aml-build: comment fix

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e71fd76454ac78f8feee69acb301263f2bc7a55c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 10:24:42 2015 +0100

      acpi-build: fix typo in comment

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 033c7ddf86fe4315069ac4cf3cfab9bc6035dee7
  Merge: b6d527f 7c6044a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 09:47:55 2015 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150304-1' into staging

      misc spice/qxl fixes.

      # gpg: Signature made Wed Mar  4 13:57:42 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150304-1:
        hmp: info spice: take out webdav
        hmp: info spice: Show string channel name
        qxl: drop update_displaychangelistener call for secondary qxl devices
        vga: refactor vram_size clamping and rounding
        qxl: refactor rounding up to a nearest power of 2
        spice: fix invalid memory access to vga.vram
        qxl: document minimal video memory for new modes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b6d527fbc0b64a2ba7d83623e47b05c745b88043
  Merge: fff795a aa68578
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 07:33:45 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150303-1' into staging

      xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      # gpg: Signature made Tue Mar  3 07:38:43 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150303-1:
        xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fff795ab383e2052cfef792e74a3086e12a14f14
  Merge: cff6abd 76349f5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 06:43:32 2015 +0000

      Merge remote-tracking branch 'remotes/gonglei/tags/bootdevice-next-20150303' into staging

      bootdevice: bug fixes

      # gpg: Signature made Tue Mar  3 05:18:39 2015 GMT using RSA key ID DDE30FBB
      # gpg: Good signature from "Gonglei <arei.gonglei@huawei.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 5178 9C82 617F 2F58 8693  63B1 BA7A 65B0 DDE3 0FBB

      * remotes/gonglei/tags/bootdevice-next-20150303:
        bootdevice: add check in restore_boot_order()
        bootdevice: check boot order argument validation before vm running

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cff6abd6f2fc1af588207b27f2a6b96e15bd96dc
  Merge: c10b028 bebe80f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 00:16:27 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150303' into staging

      TriCore RRR1, RRR2 instructions and bugfixes

      # gpg: Signature made Tue Mar  3 01:12:02 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150303:
        target-tricore: Add instructions of RRR1 opcode format, which have 0xc3 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x43 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x83 as first opcode
        target-tricore: Add instructions of RRR2 opcode format
        target-tricore: fix msub32_suov return wrong results
        target-tricore: Fix RLC_ADDI, RLC_ADDIH using wrong microcode helper

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12004c9eb4486a134b1f49b17890a364adca5f8c
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Feb 16 22:30:21 2015 +0300

      target-xtensa: xtfpga: fix ml605 flash size

      ML605 daughterboard has 16MB flash, not 32MB. Change board definition
      accordingly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 4246e225c0e8fbcf17051aa83a4198293c007cc4
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Wed Feb 12 14:35:56 2014 +0400

      target-xtensa: implement do_unassigned_access callback

      Depending on access type raise either InstrPIFDataError or
      LoadStorePIFDataError exception.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 8bb3b575448aeff086b2849943da47dce3c2b6ec
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Feb 17 20:57:45 2014 +0400

      hw/xtensa: allow reads/writes in the system I/O region

      Ignore writes to unassigned areas of system I/O regison and return 0 for
      reads. This makes drivers for unimportant unimplemented hardware blocks
      happy.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit a3b042179859c68b3d08f8aa43866d28d6b56987
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Thu Feb 26 14:43:07 2015 -0500

      docs: add memory-hotplug.txt

      This document describes how to use memory hotplug in QEMU.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>

  commit 9fcc07948608423539f2030f8ea12aadbcdbb6ed
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Thu Feb 26 14:35:45 2015 -0500

      qemu-options.hx: improve -m description

      Add memory hotplug options to the command-line format. Also,
      add a complete command-line example and improve description.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>

  commit 6adfdc5a6a4c2540a802e10fe0370d3ffb14487b
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:10 2014 +0800

      virtio-balloon: Add some trace events

      Add some trace events for easier debugging

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 463756d03164d640e3de00460488ba97302bf77e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:09 2014 +0800

      virtio-balloon: Fix balloon not working correctly when hotplug memory

      When do memory balloon, it takes the 'ram_size' as the VM's current ram size,
      But 'ram_size' is the startup configured ram size, it does not take into
      account the hotplugged memory.

      As a result, the balloon result will be confused.
      Steps to reproduce:
      (1)Start VM: qemu -m size=1024,slots=4,maxmem=8G
      (2)In VM: #free -m : 1024M
      (3)qmp balloon 512M
      (4)In VM: #free -m : 512M
      (5)hotplug pc-dimm 1G
      (6)In VM: #free -m : 1512M
      (7)qmp balloon 256M
      (8)In VM: #free -m :1256M
      We expect the VM's available ram size to be 256M after 'qmp balloon 256M'
      command, but VM's real available ram size is 1256M.

      For "qmp balloon" is not performance critical code, we use function
      'get_current_ram_size' to get VM's current ram size.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 87a45cfee6b169a68e43f284a8a3c1bc20bd5dc9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:08 2014 +0800

      pc-dimm: add a function to calculate VM's current RAM size

      The global parameter 'ram_size' does not take into account
      the hotplugged memory.

      In some codes, we use 'ram_size' as current VM's real RAM size,
      which is not correct.

      Add function 'get_current_ram_size' to calculate VM's current RAM size,
      it will enumerate present memory devices and also plus ram_size.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c10b02836ff02fcd09367316260f9368c5c92f28
  Merge: 3539bbb 0b7e89b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 4 15:33:05 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

      # gpg: Signature made Mon Mar  2 21:45:18 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/tracing-pull-request:
        trace: add DTrace reserved words for .d files
        unbreak dtrace tracing due to double _ in rdma names

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 09d219a31cf87ed98150c0a9e772e54f470f2a01
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 4 16:05:32 2015 +0100

      acpi: update generated files

      Fixes up build on systems without iasl.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3539bbb93e944ffde31c61c369ea9eedcc5697a6
  Merge: 576a94d 47cbe50
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 4 14:37:31 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150302.0' into staging

      Updates for QEMU 2.3-rc0:
       - Error reporting and static cleanup (Alexey Kardashevskiy)
       - Runtime mmap disable for tracing (Samuel Pitoiset)
       - Support for host directed device request (Alex Williamson)

      # gpg: Signature made Mon Mar  2 18:42:50 2015 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150302.0:
        vfio-pci: Enable device request notification support
        vfio: allow to disable MMAP per device with -x-mmap=off option
        vfio: Make type1 listener symbols static
        vfio: Add ioctl number to error report

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c6044a94e52db8aef9a71d616c7a0914adb71ab
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Mar 3 09:27:28 2015 +0100

      hmp: info spice: take out webdav

      Obvious suggestion for the next spice-protocol
      release: Add some way to #ifdef new stuff.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Cole Robinson <crobinso@redhat.com>

  commit 24f938a682d934b133863eb421aac33592f7a09e
  Author: Haifeng Gao <gaohaifeng.gao@huawei.com>
  Date:   Sat Feb 28 17:02:02 2015 +0800

      vhost user:support vhost user nic for non msi guests

      Currently, vhost user nic doesn't support non msi guests(like pxe stage) by default.
      Vhost user nic can't fall back to qemu like normal vhost net nic does. So we should
      enable it for non msi guests.

      Signed-off-by: Haifeng Gao <gaohaifeng.gao@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2e5feadbf8133b9b108919a2f576943b448a1a06
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 3 17:40:45 2015 +0100

      aml-build: fix build for glib < 2.22

      g_ptr_array_new_with_free_func is there since glib 2.22,
      use the older g_ptr_array_foreach instead.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 576a94d8bcaa1bb07a81d9ffd2cf76095a66ad9a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 3 11:36:09 2015 +0100

      vl: take iothread lock very early

      If the iothread lock isn't taken by the main thread, the RCU callbacks
      might run concurrently with the main thread.  QEMU's not ready for that.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3180aadb1f00fa0f0b47bccbcae5b1d47dc5ff74
  Merge: 5efde22 21618b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 12:07:47 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - more config options
      - bootdevice, iscsi, virtio-scsi fixes
      - build system patches for MinGW and config-devices.mak
      - qemu_mutex_lock_iothread deadlock fixes
      - another tiny patch from the record/replay series

      # gpg: Signature made Mon Mar  2 09:59:14 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        cpus: be more paranoid in avoiding deadlocks
        cpus: fix deadlock and segfault in qemu_mutex_lock_iothread
        virtio-scsi: Allocate op blocker reason before blocking
        Makefile.target: binary depends on config-devices
        Makefile: don't silence mak file test with V=1
        Makefile: fix up parallel building under MSYS+MinGW
        iscsi: Handle write protected case in reopen
        Give ivshmem its own config option
        Create specific config option for "platform-bus"
        Add specific config options for PCI-E bridges
        bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'
        timer: replace time() with QEMU_CLOCK_HOST
        virtio-scsi-dataplane: Call blk_set_aio_context within BQL
        block: Forbid bdrv_set_aio_context outside BQL
        scsi: give device a parent before setting properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aa6857891df614c620e6e9fc4bc4af6e0e49cafd
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Mar 2 17:02:53 2015 +0100

      xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      At the moment, when the XHCI driver in edk2
      (MdeModulePkg/Bus/Pci/XhciDxe/XhciDxe.inf) runs on QEMU, with the options

        -device nec-usb-xhci -device usb-kbd

      it crashes with:

        ASSERT MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c(1759):
        TrsRing != ((void*) 0)

      The crash hits in the following edk2 call sequence (all files under
      MdeModulePkg/Bus/):

      UsbEnumerateNewDev()                         [Usb/UsbBusDxe/UsbEnumer.c]
        UsbBuildDescTable()                        [Usb/UsbBusDxe/UsbDesc.c]
          UsbGetDevDesc()                          [Usb/UsbBusDxe/UsbDesc.c]
            UsbCtrlGetDesc(USB_REQ_GET_DESCRIPTOR) [Usb/UsbBusDxe/UsbDesc.c]
              UsbCtrlRequest()                     [Usb/UsbBusDxe/UsbDesc.c]
                UsbHcControlTransfer()             [Usb/UsbBusDxe/UsbUtility.c]
                  XhcControlTransfer()             [Pci/XhciDxe/Xhci.c]
                    XhcCreateUrb()                 [Pci/XhciDxe/XhciSched.c]
                      XhcCreateTransferTrb()       [Pci/XhciDxe/XhciSched.c]
                    XhcExecTransfer()              [Pci/XhciDxe/XhciSched.c]
                      XhcCheckUrbResult()          [Pci/XhciDxe/XhciSched.c]
                        //
                        // look for TRB_TYPE_DATA_STAGE event [1]
                        //
                    //
                    // Store a copy of the device descriptor, as the hub device
                    // needs this info to configure endpoint. [2]
                    //
        UsbSetConfig()                             [Usb/UsbBusDxe/UsbDesc.c]
          UsbCtrlRequest(USB_REQ_SET_CONFIG)       [Usb/UsbBusDxe/UsbDesc.c]
            UsbHcControlTransfer()                 [Usb/UsbBusDxe/UsbUtility.c]
              XhcControlTransfer()                 [Pci/XhciDxe/Xhci.c]
                XhcSetConfigCmd()                  [Pci/XhciDxe/XhciSched.c]
                  XhcInitializeEndpointContext()   [Pci/XhciDxe/XhciSched.c]
                    //
                    // allocate transfer ring for the endpoint [3]
                    //

      USBKeyboardDriverBindingStart()              [Usb/UsbKbDxe/EfiKey.c]
        UsbIoAsyncInterruptTransfer()              [Usb/UsbBusDxe/UsbBus.c]
          UsbHcAsyncInterruptTransfer()            [Usb/UsbBusDxe/UsbUtility.c]
            XhcAsyncInterruptTransfer()            [Pci/XhciDxe/Xhci.c]
              XhcCreateUrb()                       [Pci/XhciDxe/Xhci.c]
                XhcCreateTransferTrb()             [Pci/XhciDxe/XhciSched.c]
                  XhcSyncTrsRing()                 [Pci/XhciDxe/XhciSched.c]
                    ASSERT (TrsRing != NULL) [4]

      UsbEnumerateNewDev() in the USB bus driver issues a GET_DESCRIPTOR
      request, in order to determine the number of configurations that the
      endpoint supports. The requests consists of three stages (three TRBs),
      setup, data, and status. The length of the response is determined in [1],
      namely from the transfer event that the host controller generates in
      response to the request's middle stage (ie. the data stage).

      If the length of the answer is correct (a full GET_DESCRIPTOR request
      takes 18 bytes), then the XHCI driver that underlies the USB bus driver
      "snoops" (caches) the descriptor data for later [2].

      Later, the USB bus driver sends a SET_CONFIG request. The underlying XHCI
      driver allocates a transfer ring for the endpoint, relying on the data
      snooped and cached in step [2].

      Finally, the USB keyboard driver submits an asynchronous interrupt
      transfer to manage the keyboard. As part of this it asserts [4] that the
      ring has been allocated in step [3].

      And this ASSERT() fires. The root cause can be found in the way QEMU
      handles the initial GET_DESCRIPTOR request.

      Again, that request consists of three stages (TRBs, Transfer Request
      Blocks), "setup", "data", and "status". The XhcCreateTransferTrb()
      function sets the IOC ("Interrupt on Completion") flag in each of these
      TRBs.

      According to the XHCI specification, the host controller shall generate a
      Transfer Event in response to *each* individual TRB of the request that
      had the IOC flag set. This means that QEMU should queue three events:
      setup, data, and status, for edk2's XHCI driver.

      However, QEMU only generates two events:
      - one for the setup (ie. 1st) stage,
      - another for the status (ie. 3rd) stage.

      No event is generated for the middle (ie. data) stage. The loop in QEMU's
      xhci_xfer_report() function runs three times, but due to the "reported"
      variable, only the first and the last TRBs elicit events, the middle (data
      stage) results in no event queued.

      As a consequence:
      - When handling the GET_DESCRIPTOR request, XhcCheckUrbResult() in [1]
        does not update the response length from zero.

      - XhcControlTransfer() thinks that the response is invalid (it has zero
        length payload instead of 18 bytes), hence [2] is not reached; the
        device descriptor is not stashed for later, and the number of possible
        configurations is left at zero.

      - When handling the SET_CONFIG request, (NumConfigurations == 0) from
        above prevents the allocation of the endpoint's transfer ring.

      - When the keyboard driver tries to use the endpoint, the ASSERT() blows
        up.

      The solution is to correct the emulation in QEMU, and to generate a
      transfer event whenever IOC is set in a TRB.

      The patch replaces

        !reported && (IOC || foo)    == !reported && IOC ||
                                        !reported && foo

      with

        IOC || (!reported && foo)    == IOC ||
                                        !reported && foo

      which only changes how

        reported && IOC

      is handled. (Namely, it now generates an event.)

      Tested with edk2 built for "qemu-system-aarch64 -M virt" (ie.
      "ArmVirtualizationQemu.dsc", aka "AAVMF"), and guest Linux.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 22fa7da0005c939c940634da069ecb9bbb199a2a
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Sun Mar 1 09:29:18 2015 -0500

      hmp: info spice: Show string channel name

      Useful for debugging.

      https://bugzilla.redhat.com/show_bug.cgi?id=822418
      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 20ca3763abbb77ae9942f3e854bdeec36a147a29
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 2 17:01:50 2015 +0100

      qxl: drop update_displaychangelistener call for secondary qxl devices

      Commit 3dcadce5076d4b42fa395c39662d65e050b77784 added three
      update_displaychangelistener call sites:

      Two for primary qxl cards, when entering/leaving vga mode, which are
      correct.

      One for secondary qxl cards, which is wrong because we don't register
      a displaychangelistener in the first place for secondary cards.

      Remove it.

      Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
      Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 619616ce31a5a5d167bf26f40d920b26da0a7bfd
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:53 2015 +0100

      vga: refactor vram_size clamping and rounding

      Make the code a bit more obvious.

      We don't have min/max, so a general helper for clamp probably isn't
      acceptable either.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bb7443f6d6f09411ea10f06e6cb0d416bd1ccebd
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:52 2015 +0100

      qxl: refactor rounding up to a nearest power of 2

      We already have pow2floor, mirror it and use instead of a function with
      similar results (same in used domain), to clarify our intent.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 876d516311c1538a7d29f2abec48b7cda0645eea
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:51 2015 +0100

      spice: fix invalid memory access to vga.vram

      vga_common_init() doesn't allow more than 256 MiB vram size and silently
      shrinks any larger value.  qxl_dirty_surfaces() used the unshrinked size
      via qxl->shadow_rom.surface0_area_size when accessing the memory, which
      resulted in segfault.

      Add a workaround for this case and an assert if it happens again.

      We have to bump the vga memory limit too, because 256 MiB wouldn't have
      allowed 8k (it requires more than 128 MiB).
      1024 MiB doesn't work, but 512 MiB seems fine.

      Proposed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 03d9825d15e17e444e00bd4caa9edb0d57022794
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:50 2015 +0100

      qxl: document minimal video memory for new modes

      The alternative to removing existing comments.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 76349f5ba8f4e2f0b8c93c12ec0950a8bc77408a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 13:13:47 2015 +0000

      bootdevice: add check in restore_boot_order()

      qemu_boot_set() can't fail in restore_boot_order(),
      then simply assert it doesn't fail, by passing
      &error_abort if boot_set_handler set.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit f05f47bb5f07ca32a23edf1df3dd75f5004f9325
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 3 11:31:09 2015 +0000

      bootdevice: check boot order argument validation before vm running

      Either 'once' option or 'order' option can take effect for -boot at
      the same time, that is say initial startup processing can check only
      one. And pc.c's set_boot_dev() fails when its boot order argument
      is invalid. This patch provide a solution fix this problem:

       1. If "once" is given, register reset handler to restore boot order.

       2. Pass the normal boot order to machine creation.  Should fail when
         the normal boot order is invalid.

       3. If "once" is given, set it with qemu_boot_set().  Fails when the
         once boot order is invalid.

       4. Start the machine.

       5. On reset, the reset handler calls qemu_boot_set() to restore boot
         order.  Should never fail.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 5efde22aa781d37df58f0060430f459491dcfd62
  Merge: 0856579 b3adf5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 01:28:54 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-26' into staging

      QemuOpts: Convert various setters to Error

      # gpg: Signature made Thu Feb 26 13:56:43 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-26:
        qtest: Use qemu_opt_set() instead of qemu_opts_parse()
        pc: Use qemu_opt_set() instead of qemu_opts_parse()
        qemu-sockets: Simplify setting numeric and boolean options
        block: Simplify setting numeric options
        qemu-img: Suppress unhelpful extra errors in convert, amend
        QemuOpts: Propagate errors through opts_parse()
        QemuOpts: Propagate errors through opts_do_parse()
        QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use
        block: Suppress unhelpful extra errors in bdrv_img_create()
        qemu-img: Suppress unhelpful extra errors in convert, resize
        QemuOpts: Convert qemu_opts_set() to Error, fix its use
        QemuOpts: Convert qemu_opt_set_number() to Error, fix its use
        QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bebe80fc78cc91c4225cfb98ef3a916b9c861c60
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Feb 6 14:48:33 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xc3 as first opcode

      Add helpers helper_addsur_h/_ssov which adds one halfword and subtracts one
      halfword, rounds / and saturates each half word independently.

      Add microcode helper functions:
          * gen_maddsu_h/sus_h: multiply two halfwords left justified and add to the
                                first one word and subtract from the second one word
                                / and saturate each resulting word independetly.
          * gen_maddsum_h/sums_h: multiply two halfwords in q-format left justified
                                  and add to the first one word and subtract from
                                  the second one word / and saturate each resulting
                                  word independetly.
          * gen_maddsur32_h/32s_h: multiply two halfwords in q-format left justified
                                   and add to the first one word and subtract from
                                   the second one word, round both results / and
                                   saturate each resulting word independetly.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit b00aa8ecbc6fd7468178a0dabc7dfd0b7e1b8cd6
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Feb 3 18:36:53 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x43 as first opcode

      Add helpers:
          * madd64_q_ssov: multiply two 32 bit q-format number, add them with a
                           64 bit q-format number and saturate.
          * madd32_q_add_ssov: add two 64 bit q-format numbers and return a 32 bit
                               result.
          * maddr_q_ssov: multiplay two 32 bit q-format numbers, add a 32 bit
                          q-format number and saturate.
          * maddr_q: multiplay two 32 bit q-format numbers and add a 32 bit
                     q-format number.

      Note: madd instructions in the q format can behave strange, e.g.
      0x1 + (0x80000000 * 0x80000000) << 1 for 32 bit signed values does not cause an
      overflow on the guest, because all intermediate results should be handled as if
      they are indefinitely precise. We handle this by inverting the overflow bit for
      all cases: a + (0x80000000 * 0x80000000) << 1.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2e430e1cdcbac8825bc44b42844cbb011b859847
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Jan 29 15:35:56 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x83 as first opcode

      Add helpers:
          * add64_ssov: adds two 64 bit values and saturates the result.
          * addr_h/_ssov: adds two halfwords with two words in q-format with rounding
                          / and saturates each result independetly.

      Add microcode generator:
          * gen_add64_d: adds two 64 bit values.
          * gen_addsub64_h: adds/subtracts one halfwords with a word and adds/
                            subtracts another halftword with another word.
          * gen_madd_h/s_h: multiply four halfwords, add each result left justfied
                            to two word values / and saturate each result.
          * gen_maddm_h/s_h: multiply four halfwords, add each result left justfied
                             to two words values in q-format / and saturate each
                             result.
          * gen_maddr32/64_h/s_h: multiply four halfwords, add each result left
                                  justfied to two halftwords/words values in q-format
                                  / and saturate each result.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2984cfbdb4dbc31d614aaa0303374dff951e7a31
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 14:57:51 2015 +0000

      target-tricore: Add instructions of RRR2 opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 3debbb5af5f63440b170b71bf3aecc0e778f5691
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 28 12:15:05 2015 +0000

      target-tricore: fix msub32_suov return wrong results

      If the signed result of the multiplication overflows, we would get a negative
      value, which would result in a addition instead of a subtraction.

      Now we do the overflow calculation and saturation by hand instead of using
      suov32_neg.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f0cab01b6c9bb9c2f5085837ca86d70d144cca9d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Feb 6 15:06:05 2015 +0000

      target-tricore: Fix RLC_ADDI, RLC_ADDIH using wrong microcode helper

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0856579cac2f1dacecd847cfcd89680d26ff78f5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 00:29:17 2015 +0000

      Revert "Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging"

      This reverts commit b8a173b25c887a606681fc35a46702c164d5b2d0, reversing
      changes made to 5de090464f1ec5360c4f30faa01d8a9f8826cd58.

      (I applied this pull request when I should not have done so, and
      am now immediately reverting it.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b7e89b103b899c21b9ab37dbf9b832db8d18108
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Aug 14 11:39:23 2014 +0100

      trace: add DTrace reserved words for .d files

      DTrace on Mac OS X fails due to trace events using 'self' as an argument
      name:

        GEN   trace/generated-tracers-dtrace.h
      dtrace: failed to compile script trace/generated-tracers-dtrace.dtrace: line 1330: syntax error, unexpected DT_KEY_SELF, expecting ) near "self"
      make: *** [trace/generated-tracers-dtrace.h] Error 1

      Filter argument names according to the list of DTrace .d file reserved
      keywords.

      Note that DTrace on Mac and Linux still do not work after this patch.
      There are additional build issues remaining.

      Reported-by: Henk Poley <henkpoley@gmail.com>
      Tested-by: Henk Poley <henkpoley@gmail.com>
      Cc: Lluís Vilanova <vilanova@ac.upc.edu>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ba795761857082a9bb8c4be1f28e7cdd82f039b0
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Feb 16 16:58:05 2015 +0000

      unbreak dtrace tracing due to double _ in rdma names

      It looks like the dtrace trace code gets upset if you have trace names
      with __ in, which the migration/rdma.c code does.

      Rename the functions and the associated traces.

      Fixes: 733252deb8b7d37beacda5976c2769e18642b2fa

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reported-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1424105885-12149-1-git-send-email-dgilbert@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47cbe50cc8d8e59129311bcdb827e1116e935bde
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio-pci: Enable device request notification support

      Linux v4.0-rc1 vfio-pci introduced a new virtual interrupt to allow
      the kernel to request a device from the user.  When signaled, QEMU
      will by default attmempt to hot-unplug the device.  This is a one-
      shot attempt with the expectation that the kernel will continue to
      poll for the device if it is not returned.  Returning the device when
      requested is the expected standard model of cooperative usage, but we
      also add an option option to disable this feature.  Initially this
      opt-out is set as an experimental option because we really should
      honor kernel requests for the device.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6ee47c90081b3ab5980eeef1a8b12b54bac98bb5
  Author: Samuel Pitoiset <samuel.pitoiset@gmail.com>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio: allow to disable MMAP per device with -x-mmap=off option

      Disabling MMAP support uses the slower read/write accesses but allows to
      trace all MMIO accesses, which is not good for performance, but very
      useful for reverse engineering PCI drivers. This option allows to
      disable MMAP per device without a compile-time change.

      Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 51b833f4405426b63b66380117bbe1f4c8976021
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio: Make type1 listener symbols static

      They are not used from anywhere but common.c which is where these are
      defined so make them static.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 46f770d4a55ceb21583ac573326f81901a3f1723
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 11:38:54 2015 -0700

      vfio: Add ioctl number to error report

      This makes the error report more informative.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 48ce35b7645154eff6b685b3178aacf33f2ff871
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Mar 2 16:14:33 2015 +0100

      acpi: update generated files

      Fixes up build on systems without iasl.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8a173b25c887a606681fc35a46702c164d5b2d0
  Merge: 5de0904 de13197
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 14:25:48 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Move APIC ID compatibility code to pc.c
        target-i386: Require APIC ID to be explicitly set before CPU realize
        target-i386: Set APIC ID using cpu_index on CONFIG_USER
        linux-user: Check for cpu_init() errors
        target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id
        target-i386: Simplify error handling on cpu_x86_init_user()
        target-i386: Eliminate cpu_init() function
        target-i386: Rename cpu_x86_init() to cpu_x86_init_user()
        target-i386: Move topology.h to include/hw/i386
        target-i386: Eliminate unnecessary get_cpuid_vendor() function
        target-i386: Simplify listflags() function

      Conflicts:
      	target-i386/cpu.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5de090464f1ec5360c4f30faa01d8a9f8826cd58
  Merge: 2dffe55 4bc6a3e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 13:20:43 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Assertion fix for device_add with non-device types
      * Documentation fix
      * qdev_init() error reporting cleanups

      # gpg: Signature made Tue Feb 24 13:56:33 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        parallel: parallel_hds_isa_init() shouldn't fail
        parallel: Factor out common parallel_hds_isa_init()
        serial: serial_hds_isa_init() shouldn't fail
        serial: Factor out common serial_hds_isa_init()
        etsec: Replace qdev_init() by qdev_init_nofail()
        leon3: Replace unchecked qdev_init() by qdev_init_nofail()
        ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()
        qdev: Improve qdev_init_nofail()'s error reporting
        qom: Fix typo, 'my_class_init' -> 'derived_class_init'
        qdev: Avoid type assertion in qdev_build_hotpluggable_device_list()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2dffe5516e74215fadf2e0f5ee401db4d5a86f7a
  Merge: 041ccc9 dde1111
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 12:13:45 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA fixes queue

      # gpg: Signature made Mon Feb 23 19:28:42 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/numa-pull-request:
        numa: Rename set_numa_modes() to numa_post_machine_init()
        numa: Rename option parsing functions
        numa: Move QemuOpts parsing to set_numa_nodes()
        numa: Make max_numa_nodeid static
        numa: Move NUMA globals to numa.c
        vl.c: Remove unnecessary zero-initialization of NUMA globals
        numa: Move NUMA declarations from sysemu.h to numa.h

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21618b3e55ad2c6fede0bffcaea466091811ce59
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 27 20:01:03 2015 +0100

      cpus: be more paranoid in avoiding deadlocks

      For good measure, ensure that the following sequence:

         thread 1 calls qemu_mutex_lock_iothread
         thread 2 calls qemu_mutex_lock_iothread
         VCPU thread are created
         VCPU thread enters execution loop

      results in the VCPU threads letting the other two threads run
      and obeying iothread_requesting_mutex even if the VCPUs are
      not halted.  To do this, check iothread_requesting_mutex
      before execution starts.

      Tested-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6b49809c597331803ea941eadda813e5bb4e8fe2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 27 19:58:23 2015 +0100

      cpus: fix deadlock and segfault in qemu_mutex_lock_iothread

      When two threads (other than the low-priority TCG VCPU thread)
      are competing for the iothread lock, a deadlock can happen.  This
      is because iothread_requesting_mutex is set to false by the first
      thread that gets the mutex, and then the VCPU thread might never
      yield from the execution loop.  If iothread_requesting_mutex is
      changed from a bool to a counter, the deadlock is fixed.

      However, there is another bug in qemu_mutex_lock_iothread that
      can be triggered by the new call_rcu thread.  The bug happens
      if qemu_mutex_lock_iothread is called before the CPUs are
      created.  In that case, first_cpu is NULL and the caller
      segfaults in qemu_mutex_lock_iothread.  To fix this, just
      do not do the kick if first_cpu is NULL.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reported-by: Andreas Gustafsson <gson@gson.org>
      Tested-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f6758f7d6b8b483eb1d061937ed06da830c1ecb8
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 27 12:11:53 2015 -0500

      virtio-scsi: Allocate op blocker reason before blocking

      s->blocker is really only used in hw/scsi/virtio-scsi.c; the only places
      where it is used in hw/scsi/virtio-scsi-dataplane.c is when it is
      allocated and when it is freed. That does not make a whole lot of sense
      (and is actually wrong because this leads to s->blocker potentially
      being NULL when blk_op_block_all() is called in virtio-scsi.c), so move
      the allocation and destruction of s->blocker to the device realization
      and unrealization in virtio-scsi.c, respectively.

      Case in point:

      $ echo -e 'eject drv\nquit' | \
          x86_64-softmmu/qemu-system-x86_64 \
              -monitor stdio -machine accel=qtest -display none \
              -object iothread,id=thr -device virtio-scsi-pci,iothread=thr \
              -drive if=none,file=test.qcow2,format=qcow2,id=drv \
              -device scsi-cd,drive=drv

      Without this patch:

      (qemu) eject drv
      [1]    10102 done
             10103 segmentation fault (core dumped)

      With this patch:

      (qemu) eject drv
      Device 'drv' is busy: block device is in use by data plane
      (qemu) quit

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1425057113-26940-1-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 92144c70939d9d029807c10a038acd07289f71bd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:52 2015 +0100

      Makefile.target: binary depends on config-devices

      relink binary whenever config-devices.mak changes:
      this makes sense as we are adding/removing devices,
      so binary has to be relinked to be up to date.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e32dccddb0b1fa335bf251c155e907f9d47accfd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 1 19:39:36 2015 +0100

      acpi-test-data: update after pci rewrite

      more trivial changes as more code has been rewritten in C.
      we also got rid of extra Scope operators.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1d51570166171cd85dfcd08b2eac2f02a3fda6fe
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Thu Feb 26 09:16:43 2015 +0800

      acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb().

      Replace string "slot" in acpi_memory_plug_cb() with macro PC_DIMM_SLOT_PROP.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f51074cdc6e750daa3b6df727d83449a7e42b391
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 26 17:21:13 2015 +0100

      pci-hotplug-old: Has been dead for five major releases, bury

      Commit 79ca616 (v1.6.0) accidentally disabled legacy x86-only HMP
      commands pci_add, pci_del: it defined CONFIG_PCI_HOTPLUG only as make
      variable, not as preprocessor macro, killing the code conditional on
      defined(CONFIG_PCI_HOTPLUG_OLD).

      In all this time, nobody reported the loss.  I only noticed it when I
      tried to test some error reporting change that forced me to touch this
      old crap again.

      Fun: git-log hw/pci/pci-hotplug-old.c shows our faith in the backward
      compatibility god has been strong enough to sacrifice at its altar
      about a dozen times, but not strong enough to even once verify the
      legacy feature's still there, let alone works.

      Remove the commands along with the code backing them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6dbcb81956b16d794c9c0257b94bd4c6feba713f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 26 17:21:14 2015 +0100

      pci: Give a few helpers internal linkage

      None of them should be used in new code.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af59b35ce1aa3e69488e7308b632d5af2ac54948
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:20 2015 +0000

      acpi: make build_*() routines static to aml-build.c

      build_*() routines were used for composing AML
      structures manually in acpi-build.c but after
      conversion to AML API they are not used outside
      of aml-build.c anymore, so hide them from external
      users.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72f15d6e53485e8d1754e56e0013bed2e5816fa8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:19 2015 +0000

      pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 62b52c266582d3241a468dc08dbaa81e337cb03f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:18 2015 +0000

      pc: acpi-build: drop template patching and create PCI bus tree dynamically

      Replace AML template patching with direct composing
      of PCI device entries in C. It allows to simplify
      PCI tree generation further and saves us about 400LOC
      scattered through different files, confining tree
      generation to one C function which is much easier
      to deal with.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 752bba815ec5b67e2aa6d7c86fd2be80e45c203b
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:17 2015 +0000

      tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b23046abe78f48498a423b802d6d86ba0172d57f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:16 2015 +0000

      pc: acpi-build: simplify PCI bus tree generation

      it basicaly does the same as original approach,
      * just without bus/notify tables tracking (less obscure)
        which is easier to follow.
      * drops unnecessary loops and bitmaps,
        creating devices and notification method in the same loop.
      * saves us ~100LOC

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71096d6cc5b4341e9b7ee59f10594d5f36ce12b9
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:15 2015 +0000

      tests: add ACPI blobs for qemu with bridge cases

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3a9c86df2169881978e697109ae9bb8a6ce41e92
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:14 2015 +0000

      tests: bios-tables-test: add support for testing bridges

      Adds alternative ACPI table blob selection for testing
      non default QEMU configurations. If blob file for test
      variant is not present, fallback to default blob.

      With this change implement testing with a coldplugged
      bridge.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 194c8615d7d819887180f196675ba987c4bf43bc
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:13 2015 +0000

      tests: ACPI test blobs update due to PCI0._CRS changes

      PCI0._CRS was moved into SSDT and became the same for
      PIIX4/Q35 machines.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ac6f7a6d64386426daa6c34676d296cafe19a80
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:12 2015 +0000

      pc: acpi-build: drop template patching and create Device(SMC) dynamically

      patch moves SMC device into SSDT and creates it only
      when device is present, which makes ACPI tables smaller
      in default case when device is not present.

      Also it fixes wrong IO range in CRS if "iobase"
      property is set to a non default value.

      PS:
      Testing with XP shows that current default "iobase"
      used SMC device conflicts with floppy controller IO,
      but it's topic for another patch and I'd leave it
      to SMC device author for resolving conflict.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      CC: agraf@suse.de
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1142e45ffdc5bf76ae920a25495e13223f5d5ed2
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:11 2015 +0000

      pc: export applesmc IO port/len

      IO port and length will be used in following patch
      to correctly generate SMC ACPI device in SSDT.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7056045332b997a8cd298e3bf231ecf690accdf4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:10 2015 +0000

      acpi: add acpi_irq_no_flags() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4ec8d2b3f54dd1dcd9e2a80e529feff4e2603288
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:09 2015 +0000

      pc: acpi-build: drop remaining ssdt_misc template

      It drops empty ssdt_misc templete. It also hides
      from user almost all pointer arithmetic when building
      SSDT which makes resulting code a bit cleaner
      and concentrating only on composing ASL construct
      /i.e. a task build_ssdt() should be doing/.

      Also it makes one binary blob less stored in QEMU
      source tree by removing need to keep and update
      hw/i386/ssdt-misc.hex.generated file here in total
      saving us ~430LOC.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d31c909e57a131dec7a1e620f36573f2f5fca9e5
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:08 2015 +0000

      pc: acpi: drop manual hole punching for GPE0 resources

      Drops manual hole punching in PCI0._CRS on PIIX4 machine type
      for GPE0 resources. Resources will be consumed by Device(GPE0)
      that is attached to PCI namespace.
      There is GPE device with HID ACPI0006 since ACPI2.0
      that should be used for this purpose but none of Windows
      versions support it and show it as "unknown device",
      so reserve resource in old fashioned way with PNP0A06
      device to make windows happy and actually reserve resources.

      Along with last hole _CRS layout of PIIX4 machine becomes
      the same as Q35 one, so merge them together and use the same
      _CRS for both machine types.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c2d9c595ade376ad4c94c8c2cab23fd6f50805f7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:07 2015 +0000

      pc: acpi: drop manual hole punching for CPU hotplug resources

      Drops manual hole punching in PCI0._CRS on PIIX4 machine type
      for CPU hotplug resources.
      Resources will be consumed by Device(PRES) that is attached
      to PCI bus. The same way how it currently works for mem hotlpug.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8bec1a0a78203d2555b7446efa7ebe5d2601f79a
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:06 2015 +0000

      pc: acpi: drop manual hole punching for PCI hotplug resources

      Drops manual hole punching in PCI0._CRS for PIIX4 machine type.
      Resources will be consumed by Device(PHPR) that cwis attached
      to PCI bus. The same way how it currently works for mem hotlpug.

      Manual hole in PIIX4 _CRS wasn't correct anyway since it was
      legacy size 0xF while current PCIHP MMIO region is of size 0x14.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 60efd4297d44a1ac41ae46485098919376fdcab4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:05 2015 +0000

      pc: acpi-build: create PCI0._CRS dynamically

      Replace template patching and runtime calculation
      in _CRS() method with static _CRS defined in SSDT.
      No functional change except of as mentined above
      and _CRS being moved from DSDT to SSDT.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9dd5c40ddfe332d8a03034d8e01208e5e1a4f5f7
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:20 2015 -0500

      tpm: Support for capability flags of TIS 1.3

      Provide the TIS 1.3 capability flags.
      The interface now looks like a TIS 1.3 interface. It's fully
      compatible with previous TIS 1.2 and drivers written for
      TIS 1.2 continue to work.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fd859081453f94c3cbd6527289e41b7fddbf645f
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:19 2015 -0500

      tpm: Support for TIS selftest done flag

      Extend the backend to check whether the TPM_ContinueSelfTest
      finished successfully and provide a flag to the TIS front-end
      if it successfully finished. The TIS then sets a flag in
      all localities in the STS register and keeps it until the next
      reset.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2eae8c7516a99c1309199df8d88c0f0749fce2cb
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:18 2015 -0500

      tpm: Support for XFIFO register

      Support for the XFIFO register (range) of the TIS 1.3 specification.
      We support a range of 64 bytes.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit feeb755fde70e34dbec9709f3dab439172cf5153
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:17 2015 -0500

      tpm: Allow 32 & 16 bit accesses to the registers

      Improve the access to the registers with 32 and 16 bit reads and writes.
      Also enable access to a non-base register address, such as reads of the
      2nd byte of a register. Map the FIFO byte access to any byte within
      its 4 byte register (following specs).

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fdc694635ebf275763aa2eee721f69e556fba5e
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:16 2015 -0500

      tpm: Extend sts register to 32 bit

      More recent TIS specs extend the STS register to 32 bit. While
      we don't store the TIS interface state, yet, we can extend it
      without sideeffects.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a6027b0f4bb4d8c8f14ac5fd8cbf05f5f7c6a503
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Thu Jan 29 17:24:41 2015 +0300

      balloon: call qdev_alias_all_properties for proxy dev in balloon class init

      The idea is that all other virtio devices are calling this helper
      to merge properties of the proxy device. This is the only difference
      in between this helper and code in inside virtio_instance_init_common.
      The patch should not cause any harm as property list in generic balloon
      code is empty.

      This also allows to avoid some dummy errors like fixed by this
          commit 91ba21208839643603e7f7fa5864723c3f371ebe
          Author: Gonglei <arei.gonglei@huawei.com>
          Date:   Tue Sep 30 14:10:35 2014 +0800
          virtio-balloon: fix virtio-balloon child refcount in transports

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Raushaniya Maksudova <rmaksudova@parallels.com>
      Revieved-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      CC: Christian Borntraeger <borntraeger@de.ibm.com>
      CC: Anthony Liguori <aliguori@amazon.com>
      CC: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a9ad5e1efcbbdf4b34bd7679613605efdb41bd04
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:52 2015 +0100

      Makefile.target: binary depends on config-devices

      relink binary whenever config-devices.mak changes:
      this makes sense as we are adding/removing devices,
      so binary has to be relinked to be up to date.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1424332114-13440-2-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 12ccfec9684679fc1945b5b5020487b2cb17dc06
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:46 2015 +0100

      Makefile: don't silence mak file test with V=1

      V=1 should show what's going on, it's not nice
      to silence things unconditionally.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1424332114-13440-1-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 23cab7b7a9cb365b15eee953a0dd6cdb9198ae6c
  Author: Vasily Efimov <real@ispras.ru>
  Date:   Wed Feb 18 15:59:37 2015 +0300

      Makefile: fix up parallel building under MSYS+MinGW

      This patch enables parallel building of QEMU in MSYS+MinGW environment.
      Currently an attempt to build QEMU in parallel fails on generation of
      version.lo (and version.o too).

      The cause of the failure is that when listing prerequisites "Makefile"
      references "config-host.h" by absolute path in some rules and by relative
      path in others. Make cannot figure out that these references points to the
      same file which leads to the race: the generation of "version.*" which
      requires "$(BUILD_DIR)/config-host.h" is launched in parallel with the
      generation of "config-host.h" needed by other "Makefile" targets.

      This patch removes "$(BUILD_DIR)/" prefix from corresponding prerequisite
      of "version.*". There is no other prerequisites "$(BUILD_DIR)/config-host.h"
      found.

      Also note that not every version of MSYS is able to build QEMU in parallel,
      see: "http://sourceforge.net/p/mingw/bugs/1950/". The suggested version is
      1.0.17.

      Signed-off-by: Vasily Efimov <real@ispras.ru>
      Message-Id: <1424264377-5992-1-git-send-email-real@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43ae8fb10c5f6ca78f242624c1f446e0050a9d43
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Feb 25 12:40:08 2015 +0800

      iscsi: Handle write protected case in reopen

      Save the write protected flag and check before reopen.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1424839208-5195-1-git-send-email-famz@redhat.com>
      [Fixed typo in the name of the new field. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8af738b3eecf69a795c6ff78121edbb81ab03684
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:37 2015 +1100

      Give ivshmem its own config option

      Currently the ivshmem device is built whenever both PCI and KVM support are
      included.  This patch gives it its own config option to allow easier
      customization of whether to include it.  It's enabled by default in the
      same circumstances as now - when both PCI and KVM are available.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425017077-18487-4-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2296594257d11a253d12f0219eef3f1a0201c2d9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:36 2015 +1100

      Create specific config option for "platform-bus"

      Currently the "platform-bus" device is included for all softmmu builds.
      This bridge is intended for use on any platforms that require dynamic
      creation of sysbus devices.  However, at present it is used only for the
      PPC E500 target, with plans for the ARM "virt" target in the immediate
      future.

      To avoid a not-very-useful entry appearing in "qemu -device ?" output on
      other targets, this patch makes a specific config option for platform-bus
      and enables it (for now) only on ppc configurations which include E500
      and on ARM (which always includes the "virt" target).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1425017077-18487-3-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4681867544f04f752bd98f39c3055493c80ea316
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:35 2015 +1100

      Add specific config options for PCI-E bridges

      The i82801b11, ioh3420 and xio3130 PCI Express devices are currently
      included in the build unconditionally.

      While they could theoretically appear on any target platform with PCI-E,
      they're pretty unlikely to appear on platforms that aren't Intel derived.

      Therefore, to avoid presenting unlikely-to-be-relevant devices to the user,
      add config options to enable these components, and enable them by default
      only on x86 and arm platforms.

      (Note that this patch does include these for aarch64, via its inclusion of
      arm-softmmu.mak).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425017077-18487-2-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 57fe6a6e4a050f639ac3d2f7c32b4cd3bcde3978
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 09:49:44 2015 +0800

      bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'

      Reproducer:

       $./qemu-system-x86_64 --enable-kvm -kernel /home/vmlinuz-2.6.32.12-0.7-default \
        -initrd /home/initrd-2.6.32.12-0.7-default -append \
       "root=/dev/ram rw console=ttyS0,115200" -dtb guest.dtb -vnc :10 --monitor stdio -smp 2
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) Segmentation fault (core dumped)

      Reported-by: Edivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1425001784-6752-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2ed1ebcf65edf6757d8904000889ce52cc0a9d1b
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Fri Feb 27 16:11:02 2015 +0300

      timer: replace time() with QEMU_CLOCK_HOST

      This patch replaces time() function calls with calls to
      qemu_clock_get_ns(QEMU_CLOCK_HOST). It makes such requests deterministic
      in record/replay mode of icount.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Message-Id: <20150227131102.11912.89850.stgit@PASHA-ISP>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0543055967e554b5be10c3f96c077bf26dcaf181
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Feb 15 11:06:31 2015 +0800

      virtio-scsi-dataplane: Call blk_set_aio_context within BQL

      It's not safe to call blk_set_aio_context from outside BQL because of
      the bdrv_drain_all there. Let's put it in the hotplug callback which
      will be called by qdev device realization for each scsi device attached
      to the bus.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1423969591-23646-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e5b887cfc69991eee27be6cc0938c70a360fe45
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Feb 15 11:06:30 2015 +0800

      block: Forbid bdrv_set_aio_context outside BQL

      Even if the caller has both the old and the new AioContext's, there can
      be a deadlock, due to the leading bdrv_drain_all.

      Suppose there are four io threads (A, B, A0, B0) with A and B owning a
      BDS for each (bs_a, bs_b); Now A wants to move bs_a to iothread A0, and
      B wants to move bs_b to B0, at the same time:

        iothread A                           iothread B
      --------------------------------------------------------------------------
        aio_context_acquire(A0) /* OK */     aio_context_acquire(B0) /* OK */
        bdrv_set_aio_context(bs_a, A0)       bdrv_set_aio_context(bs_b, B0)
        -> bdrv_drain_all()                  -> bdrv_drain_all()
           -> acquire A /* OK */               -> acquire A /* blocked */
           -> acquire B /* blocked */          -> acquire B
           ...                                 ...

      Deadlock happens because A is waiting for B, and B is waiting for A.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1423969591-23646-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2264750483107c45877d29813c497b4c87f64cb6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Feb 19 17:05:46 2015 +0100

      scsi: give device a parent before setting properties

      This mimics what is done in qdev_device_add, and lets the device be
      freed in case something goes wrong.  Otherwise, object_unparent returns
      immediately without freeing the device, which is on the other hand left
      in the parent bus's list of children.

      scsi_bus_legacy_handle_cmdline then returns an error, and the HBA is
      destroyed as well with object_unparent.  But the lingering device that
      was not removed in scsi_bus_legacy_add_drive cannot be removed now either,
      and bus_unparent gets stuck in an infinite loop trying to empty the list
      of children.

      The right fix of course would be to assert in bus_add_child that the
      device already has a bus, and remove the "safety net" that adds the
      drive to the QOM tree in device_set_realized.  I am not yet sure whether
      that would entail changing all callers to qdev_create (as well as
      isa_create and usb_create and the corresponding _try_create versions).

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b3adf5acb57dee14a74e57ab4f16cd1a83e5a7d2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:48:19 2015 +0100

      qtest: Use qemu_opt_set() instead of qemu_opts_parse()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 5bdb59a290cfc7332fdc23c6368310e0327e3828
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:46:36 2015 +0100

      pc: Use qemu_opt_set() instead of qemu_opts_parse()

      Less code, same result.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 62b3de693469508a58864bffefd3d54f897558b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:51:56 2015 +0100

      qemu-sockets: Simplify setting numeric and boolean options

      Don't convert numbers or bools to strings for use with qemu_opt_set(),
      simply use qemu_opt_set_number() or qemu_opt_set_bool() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a8b18f8fd2d9f0df33c3739e76fedfd9355dfa8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:50:43 2015 +0100

      block: Simplify setting numeric options

      Don't convert numbers to strings for use with qemu_opt_set(), simply
      use qemu_opt_set_number() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit dc523cd348c47372faa7271c9aab2030f94c290d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 18:37:11 2015 +0100

      qemu-img: Suppress unhelpful extra errors in convert, amend

      img_convert() and img_amend() use qemu_opts_do_parse(), which reports
      errors with qerror_report_err().  Its error messages aren't helpful
      here, the caller reports one that actually makes sense.  Reproducer:

          $ qemu-img convert -o backing_format=raw in.img out.img
          qemu-img: Invalid parameter 'backing_format'
          qemu-img: Invalid options for file format 'raw'

      To fix, propagate errors through qemu_opts_do_parse().  This lifts the
      error reporting into callers.  Drop it from img_convert() and
      img_amend(), keep it in qemu_chr_parse_compat(), bdrv_img_create().

      Since I'm touching qemu_opts_do_parse() anyway, write a function
      comment for it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4f81273dd9e036f9009ab902a2617a1167cf796d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 18:24:10 2015 +0100

      QemuOpts: Propagate errors through opts_parse()

      Since I'm touching qemu_opts_parse() anyway, write a function comment
      for it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d93ae3cfb9ec36ea53d8ff24af812db6dd9bb62a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:59:06 2015 +0100

      QemuOpts: Propagate errors through opts_do_parse()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f43e47dbf6de24db20ec9b588bb6cc762093dd69
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:52:20 2015 +0100

      QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use

      qemu_opt_set() is a wrapper around qemu_opt_set() that reports the
      error with qerror_report_err().

      Most of its users assume the function can't fail.  Make them use
      qemu_opt_set_err() with &error_abort, so that should the assumption
      ever break, it'll break noisily.

      Just two users remain, in util/qemu-config.c.  Switch them to
      qemu_opt_set_err() as well, then rename qemu_opt_set_err() to
      qemu_opt_set().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6be4194b9215ed29f258543ce34a1b4b2003864d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:49:02 2015 +0100

      block: Suppress unhelpful extra errors in bdrv_img_create()

      bdrv_img_create() uses qemu_opt_set(), which reports errors with
      qerror_report_err().  Its error messages aren't helpful here, the
      caller reports one that actually makes sense.  I don't know how to
      trigger the error conditions, though.

      Switch to qemu_opt_set_err() to get rid of the unwanted messages.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6750e795b167e3defab36502e61b8c57ede119eb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:43:08 2015 +0100

      qemu-img: Suppress unhelpful extra errors in convert, resize

      add_old_style_options() for img_convert() and img_resize() use
      qemu_opt_set(), which reports errors with qerror_report_err().  Its
      error messages aren't helpful here, the caller reports one that
      actually makes sense.  Reproducer:

          $ qemu-img convert -B raw in.img out.img
          qemu-img: Invalid parameter 'backing_file'
          qemu-img: Backing file not supported for file format 'raw'

      Switch to qemu_opt_set_err() to get rid of the unwanted messages.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 79087c782e1549a6f9c8303aafc0b74f4e637756
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:07:34 2015 +0100

      QemuOpts: Convert qemu_opts_set() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 39101f2511f6adf1ae4380f8d729dba1213b9d7a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 16:46:36 2015 +0100

      QemuOpts: Convert qemu_opt_set_number() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit cccb7967bdf19f9d31e65d2d07d4d311e07545c4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 16:37:44 2015 +0100

      QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 041ccc922ee474693a2869d4e3b59e920c739bc0
  Merge: 2559db0 912ae9c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 12:16:46 2015 +0000

      Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging

      * remotes/qmp-unstable/queue/qmp:
        qapi-types: add C99 index names to arrays
        monitor: Fix missing err = NULL in client_migrate_info()
        balloon: Fix typo
        hmp: Fix warning from smatch (wrong argument in function call)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dc33c0293505db9c747a6e27487a808ab2b62a6f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 22:29:26 2015 +0100

      acpi-test: update expected files

      A bunch of code moved from dsdt to ssdt,
      plus we got trivial changes like 0->Zero which our test
      dosn't recognize as identity yet.
      Update expected files to suppress test warning.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit dd6b6b0c833ec7333056c55dbb8e518241aceefd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 21:45:11 2015 +0100

      acpi: drop unused generated files

      drop ssdt-mem.hex.generated and ssdt-proc.hex.generated:
      dsl files have been removed previously.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7ff3bc2e112514f001cb24f3ec16bda8ba7826fc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 21:43:48 2015 +0100

      acpi: update generated hex files

      Used for IASL builds.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 500b11ea5095ae77da5ddd6dd12f6c485b516a91
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:50 2015 +0000

      pc: acpi-build: reserve PCIHP MMIO resources

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 78c2d8722b9118509e3d4ed8bae67c3e4eaa443e
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:49 2015 +0000

      pc: pcihp: expose MMIO base and len as properties

      it will be used later to dynamically reserve MMIO region
      instead of manually punching holes in PCI0._CRS

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6ece7053d6a4a502d2ea5d24ecf512caaa1437c7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:48 2015 +0000

      acpi: add aml_word_bus_number(), aml_word_io(), aml_dword_memory(), aml_qword_memory() terms

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2c6b94d84e3677a40905c42604cf4cd4ef6f3a8e
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:47 2015 +0000

      pc: acpi-build: create memory hotplug IO region dynamically

      it replaces a static complied in DSDT MMIO region
      for memory hotplug with one created at runtime
      leaving only truly static memory hotplug related
      ASL bits in DSDT. And replaces template patching
      of MEMORY_SLOTS_NUMBER value with ASL API created
      named value.

      Later it also would make easier to reuse current
      ACPI memory hotplug on other targets.

      Also later it would be possible to move remaining
      memory hotplug ASL methods into build_ssdt() and
      add all memory hotplug related AML into SSDT only
      when memory hotplug is enabled, further reducing
      ACPI tables blob if memory hotplug isn't used.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8698c0c0ed1ff3751ef91b61c0006620d5431be4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:46 2015 +0000

      pc: acpi-build: drop template patching and memory hotplug objects dynamically

      in addition it saves us ~330LOC and makes it one binary blob less
      stored in QEMU source tree by removing need to keep and update
      hw/i386/ssdt-mem.hex.generated file there.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e2ea299b01fbd9d4d0262cfbfcbdbd02ada984a5
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:45 2015 +0000

      acpi: add aml_reserved_field() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ddf1ec2ffe30bd6bb34acc020622741eafc16b79
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:44 2015 +0000

      pc: acpi-build: create CPU hotplug IO region dynamically

      it replaces a static complied in DSDT MMIO region
      for CPU hotplug with one created at runtime
      leaving only truly static CPU hotplug related ASL
      bits in DSDT.
      It also puts CPU_HOTPLUG_RESOURCE_DEVICE into
      PCI0 scope and reserves resources from it,
      preparing for dropping manual hole punching
      in PCI0._CRS.

      Later it also would make easier to reuse current
      ACPI CPU hotplug on other targets.

      Also later it would be possible to move remaining
      CPU hotplug ASL methods into build_ssdt() and
      add all CPU hotplug related AML into SSDT only
      when CPU hotplug is enabled, further reducing
      ACPI tables blob if CPU hotplug isn't used.

      impl. detail:
      Windows XP can't handle /BSODs/ OperationRegion
      declaration in DSDT when variable from SSDT is used
      for specifying its address/length and also when
      Field declared in DSDT with OperationRegion from
      SSDT if DSDT is being parsed before SSDT.
      But it works just fine when referencing named
      fields from another table. Hence OperationRegion
      and Field declaration are moved to SSDT to make
      XP based editions work.

      PS:
      Later Windows editions seem to be fine with above
      conditions.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 20843d16632c4da3d3d35ddc8d5eb047167693ce
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:43 2015 +0000

      pc: acpi-build: drop template patching and CPU hotplug objects dynamically

      in addition it saves us ~400LOC and makes it
      one binary blob less stored in QEMU source
      tree by removing need to keep and update
      hw/i386/ssdt-proc.hex.generated file there.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a7891dacadebb9c02e027c456a1d17ea0bdf6df8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:42 2015 +0000

      acpi: add aml_eisaid() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3dd156435369153c1c1d890b9ef525f1d033a971
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:41 2015 +0000

      acpi: add aml_processor() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 15e44e56d7da9d4569c10aa8de5f109a71570670
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:40 2015 +0000

      acpi: add aml_equal() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a678508e46ac806d81bd401a483aef1b98734ae4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:39 2015 +0000

      acpi: add aml_varpackage() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cd61cb2e2c02c5c257a15a52b3d0616474e52997
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:38 2015 +0000

      pc: acpi-build: generate pvpanic device description dynamically

      Drops AML template patching and allows to
      save some space in SSDT if pvpanic device doesn't
      exist by not including disabled device description
      into SSDT. It also makes device description
      smaller by replacing _STA method with named value
      and dropping _INI method.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d5e5830f56452d857f9c26c06a886f09056482c1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:37 2015 +0000

      acpi: add aml_string() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8a5d6894d94c8f7e815c64adff78b0d28a98ca6
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:36 2015 +0000

      acpi: add aml_local() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 214ae59f8e1c33db0f3fbbc4347bb3dacc6ce876
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:35 2015 +0000

      acpi: add aml_field() & aml_named_field() terms

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 31127938f496f56eb05dc407a31e4c5941fb436a
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:34 2015 +0000

      acpi: add aml_operation_region() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 19fff2d405d3bcc88fd7b860ec47797b3f7af977
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:33 2015 +0000

      acpi: include PkgLength size only when requested

      Named/Reserved{Field} definition uses PkgLength [1] encoding to specify
      field length, however it doesn't include size of PkgLength field itself,
      while other block objects that have explicit length of its body account
      for PkgLength size while encoding it [2].
      This special casing isn't mentioned in ACPI spec, but that's what 'iasl'
      compiles NamedField to so add extra argument to build_prepend_pkg_length()
      to allow it handle the case.

      --
      1. ACPI Spec 5.0, 20.2.5.2 Named Objects Encoding, page 822
      2. ACPI Spec 5.0, 5.4 Definition Block Encoding

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 52fa397c58667080979e8aa64177c0f69b1851b7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:32 2015 +0000

      acpi: add aml_io() helper

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ad4a80bc6f4aa7ce8e67e924574521f04b8b19a4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:31 2015 +0000

      acpi: add aml_resource_template() helper

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 04b8da543dd16afaea014032939db4cb54b15459
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:30 2015 +0000

      acpi: add aml_buffer() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ebc3028f7a2a164e442d734868e4168aa6040c81
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:29 2015 +0000

      pc: acpi-build: generate _S[345] packages dynamically

      Replaces template patching with packages composed
      using AML API.

      Note on behavior change:
      If S3 or S4 is disabled, respective packages won't
      be created and put into SSDT. Which saves us some
      space in SSDT and doesn't confuse guest OS with
      mangled package names as it was done originally.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3bfa74a7e8c0787877e0f23a873413ad8817c66c
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:28 2015 +0000

      acpi: add aml_package() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3f3992b7c4ed9850e7f5502a1294cd017a891b38
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:27 2015 +0000

      acpi: add aml_call1(), aml_call2(), aml_call3(), aml_call4() helpers

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 34189453f1783c934d3824ff4636684f3ab20810
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:26 2015 +0000

      acpi: add aml_notify() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 926f5aaefad164dabcdd771f4c15c9773383d9e9
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:25 2015 +0000

      acpi: add aml_and() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c263b3f754325ae76946a5ea0e1df9368fe289bd
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:24 2015 +0000

      acpi: add aml_store() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7193f3a67ee4794096255396eeac99f9624144e1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:23 2015 +0000

      acpi: add aml_arg() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b25af5ad5953c9587e59c82cc668e574384f5245
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:22 2015 +0000

      acpi: add aml_return() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 295a515df0df655a902df6ebfc301096a3ee88ed
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:21 2015 +0000

      acpi: add aml_int() term

      * factor out ACPI const int packing out of build_append_value()
        and rename build_append_value() to build_append_int_noprefix()
        it will be reused for adding a plain integer value into AML.
        will be used by is aml_processor() and CRS macro helpers
      * extend build_append_int{_noprefix}() to support 64-bit values
        it will be used PCI for generating 64bit _CRS entries

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3c054bd51a132a69e5180f8c6ffa9d46724e4a50
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:20 2015 +0000

      acpi: add aml_name() & aml_name_decl() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 32acac9eb3478cb1229654883f938ab21d28d998
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:19 2015 +0000

      acpi: add aml_if() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ea2407d7e8adae1ab6cd0ca0366752d101d2344f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:18 2015 +0000

      acpi: add aml_method() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit be06ebd0a4d42ccd3d79fae24e48c264be377356
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:17 2015 +0000

      acpi: add aml_device() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 011bb7490bf32d84e644d79570f603651e4f80cb
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:16 2015 +0000

      pc: acpi-build: use aml_scope() for \_SB scope

      prepares for incremental conversion of SSDT content to AML API

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2ef7c27b78c663557771076b45e6f4be1b3c78d6
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:15 2015 +0000

      acpi: add aml_scope() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0f2707e4e733614f2cd566e7210c1cff6f3b5b42
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:14 2015 +0000

      acpi: introduce AML composer aml_append()

      Adds for dynamic AML creation, which will be used
      for piecing ASL/AML primitives together and hiding
      from user/caller details about how nested context
      should be closed/packed leaving less space for
      mistakes and necessity to know how AML should be
      encoded, allowing user to concentrate on ASL
      representation instead.

      For example it will allow to create AML like this:

      init_aml_allocator();
      ...
      Aml *scope = aml_scope("PCI0")
      Aml *dev = aml_device("PM")
          aml_append(dev, aml_name_decl("_ADR", aml_int(addr)))
      aml_append(scope, dev);
      ...
      free_aml_allocator();

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e0d2be2ad6461ccdcf3e3930742a6b18a7ee5eb8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:37:35 2015 +0100

      virtio_ring.h: s/__inline__/inline/

      Thomas Huth noticed that some linux headers
      use __inline__, change to inline to be consistent
      with the rest of QEMU.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 714e601379e125cde88bea6d4a3ea8f78ffbdf62
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:44:35 2015 +0100

      standard-headers: include stdint.h

      The importing script got it right already, I just forgot to re-run it.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6a19cd34b175bfc99bf5aa877e6e8eda636848f9
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:42:30 2015 +0100

      virtio-serial-bus.c: drop virtio_ids.h

      virtio-serial.h pulls that in already.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c16758cb4f273f72606cd9002fa31c2651822fcd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:37:35 2015 +0100

      update-linux-headers.sh: s/__inline__/inline/

      Thomas Huth noticed that some linux headers
      use __inline__, change to inline to be consistent
      with the rest of QEMU.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7c2c1fa5f428b7087721f7312ee82b9de05da6ca
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 10:53:24 2015 +0000

      pc: acpi: use local var for accessing ACPI tables blob in acpi_build()

      except of shortening of lines and making code a bit more readable,
      it will reduce renaming noise when changing tables blob from GArray* to
      Aml* type.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a20275fa502f57a50517d31c6b770e0eeff8feca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jan 28 18:30:38 2015 +0200

      acpi-build: skip hotplugged bridges

      hotplugged bridges don't get bsel allocated so acpi hotplug doesn't work
      for them anyway.  OTOH adding them in ACPI creates a host of problems,
      e.g. they can't be hot-unplugged themselves which is surprising to
      users.

      So let's just skip these.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ef546f1275f6563e8934dd5e338d29d9f9909ca6
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:06 2014 +0100

      virtio: add feature checking helpers

      Add a helper function for checking whether a bit is set in the guest
      features for a vdev as well as one that works on a feature bit set.

      Convert code that open-coded this: It cleans up the code and makes it
      easier to extend the guest feature bits.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0cd09c3a6cc2230ba38c462fc410b4acce59eb6f
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:05 2014 +0100

      virtio: feature bit manipulation helpers

      Add virtio_{add,clear}_feature helper functions for manipulating a
      feature bits variable. This has some benefits over open coding:
      - add check that the bit is in a sane range
      - make it obvious at a glance what is going on
      - have a central point to change when we want to extend feature bits

      Convert existing code manipulating features to use the new helpers.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a590fd5ba8f01724eee169f097f65603f0c3a8f8
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:04 2014 +0100

      virtio: cull virtio_bus_set_vdev_features

      The only user of this function was virtio-ccw, and it should use
      virtio_set_features() like everybody else: We need to make sure
      that bad features are masked out properly, which this function did
      not do.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ad67a0f278ff9ad036a986384f1e3e94717af08e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:58 2015 +0100

      s390: use standard headers

      Drop duplicated macros in favor of values from
      standard headers.

      Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9abd373c645050c958763d66107685f1512f843c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:53 2015 +0100

      standard-headers: add s390 virtio headers

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 44fb1dd4cef6d8be87cef7437fb350d0ebf2f837
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:48 2015 +0100

      scripts: add arch specific standard-headers

      Copy arch specific virtio headers.
      ATM this applies to s390 only.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cbbe4f50a028ff49e983a2a8d82c8b0ae49bc756
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:43 2015 +0100

      virtio-pci: use standard headers

      Drop duplicate code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit aa2e69fe2dd69ac2008b066c4c558a4b5c6a7e10
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:37 2015 +0100

      linux-headers: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 05e492b0dbe42232b2ee9edffb016c68e6519a61
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:32 2015 +0100

      update-linux-headers: use standard-headers

      Drop the linux-specific virtio headers, use the copy from
      standard-headers instead.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9b70c1790acacae54d559d38ca69186a85040bb8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:26 2015 +0100

      virtio-serial: switch to standard-headers

      Drop duplicate code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 019adbd3715e98b5a09fab1370cc2c6904f79b6d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:20 2015 +0100

      virtio-scsi: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3e96b2db080db986b813b58228e2553621b4b675
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:15 2015 +0100

      virtio-rng: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit b93a5ba3d1e840feef70a9cd367c6818ac63911e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:09 2015 +0100

      virtio-net,tap: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 907eb3e5b6fad79308977ec7f885ef549e64daca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:03 2015 +0100

      virtio-blk: switch to standard-headers

      Drop duplicated code. Minor codechanges were required
      as geometry is a sub-structure now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 8744a6a8d500d3509de1f5e33b8cd7d22ec37cf1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:57 2015 +0100

      virtio-9p: use standard headers

      Drop code duplicated from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 73706bd1275bef2e7b3962d1be18a20cb8df7f66
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:52 2015 +0100

      virtio-balloon: use standard headers

      Drop code duplicated from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit e9600c6ca9e9ecc123105e1e3660314fe821a4cb
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:46 2015 +0100

      virtio: use standard-headers

      Drop a bunch of code duplicated from virtio_config.h and virtio_ring.h.
      This makes us rename event index accessors which conflict,
      as reusing the ones from virtio_ring.h isn't trivial.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 4fbe0f322d5413482efbf9c0d2329fdc32bea6d1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:40 2015 +0100

      virtio: use standard virtio_ring.h

      Switch to virtio_ring.h from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fbe302b2a4c349c1a8fa93a3f79f08e7007d80c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:31 2015 +0100

      include: import virtio headers from linux 4.0

      Add files imported from linux-next (what will become linux 4.0) using
      scripts/update-linux-headers.sh

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1ff0b555d3c6ba291adf0c4c76e222acfeb52f1d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:25 2015 +0100

      scripts/update-linux-headers.sh: pull virtio hdrs

      It doesn't make sense to copy values manually:
      the only issue with getting headers from linux
      seems to be dealing with linux/types, we
      can easily fix that automatically while importing.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit afaa2e4bc4e17360307cb86fbb1d5d350ae22961
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:40:30 2015 +0100

      acpi-build: simplify rsdp management for legacy

      For legacy machine types, rsdp is not in RAM, so we need a copy of rsdp
      for fw cfg. We previously used g_array_free with false parameter,
      but this seems to confuse people.
      This also wastes a bit of memory as the buffer is unused for new
      machine types.

      Let's just use plain g_memdup, and free original memory together with
      the array.

      TODO: rationalize tcpalog memory management, and get rid of the mfre
      parameter.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 384fb32ea7984ed6e5fdcea0bbc3d5b01238806b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:04:40 2015 +0100

      acpi: has_immutable_rsdp->!rsdp_in_ram

      As comment in acpi-build.c notes, RSDP is not really immutable.  So it's
      really a question of whether it's in RAM, name the variable accordingly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 42d859001d180ea788aa2d34a7be021ac8c447f2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Feb 15 17:12:11 2015 +0100

      acpi-build: fix ACPI RAM management

      This fixes multiple issues around ACPI RAM management:

      RSDP and linker RAM aren't currently marked dirty
      on update, so they won't be migrated correctly.

      Let's handle all tables in the same way: set correct size (assert if
      too big), update, mark RAM dirty.

      This also drops assert checking that table size didn't change: table
      size is fundamentally dynamic and depends on hw configuration,
      just set the correct size and use that (memory core asserts if size is
      too large).

      This also means we can drop tracking table size, memory core does this
      for us now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 129ddaf31be583fb7c97812e07e028661005ce42
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:15:30 2015 +0100

      exec: round up size on MR resize

      Block size must fundamentally be a multiple of target page size.
      Aligning automatically removes need to worry about the alignment
      from callers.

      Note: the only caller of qemu_ram_resize (acpi) already happens to have
      size padded to a power of 2, but we would like to drop the padding in
      ACPI core, and don't want to expose target page size knowledge to ACPI.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <ponzini@redhat.com>

  commit 358774d780ee8f91429323f44bef1f53afa448bf
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 13:59:55 2015 +0000

      pc: acpi-build: migrate RSDP table

      Makes sure that RSDP stays the same
      /i.e. matches ACPI tables blob in source/
      if guest is migrated during RSDP reading or
      has been already shadowed by firmware.

      Fix applies only to new machine types starting
      from 2.3, so it won't break migration for old
      machine types.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit 6e00619b1eb2050bf2c75d52edfe7b4566704922
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 13:59:54 2015 +0000

      pc: acpi-build: update linker on guest access

      Linker table is build only once, so if later during
      tables rebuild sizes of other ACPI tables change
      pointers will be patched incorrectly due to wrong
      offsets in linker. Resulting in guest not being able
      to find ACPI tables.
      Fix it by updating 'linker' table with the rest of
      tables when firmware reads it.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit d70414a5788c3d51f8ce4d2f437e669e6b99dc59
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 9 13:59:53 2015 +0000

      acpi: update RSDP on guest access

      RSDT offset can change across reboots and that makes
      immutable RSDP, which is build at startup, point to
      incorrect place in ACPI table blob. That results in
      BIOS corrupting tables and guest OS failing to find
      ACPI tables.
      We really should have put it in a ROM region, but
      we can't change that for old machine types,
      let's just set the callback and update it explicitly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit f2c385220598523c8b9fefbfff1a6754cfd8232a
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Thu Jan 29 14:48:41 2015 +0100

      pc: memory: Validate alignment of maxram_size to page size

      If the maxram_size is not aligned and dimm devices were added on the
      command line qemu would terminate with a rather unhelpful message:

      ERROR:hw/mem/pc-dimm.c:150:pc_dimm_get_free_addr: assertion failed:
      (QEMU_ALIGN_UP(address_space_size, align) == address_space_size)

      In case no dimm device was originally added on the commandline qemu
      exits on the assertion failure.

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 214224adb4ebc9f3d211b867f588413e13f05bb3
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Thu Jan 29 14:48:40 2015 +0100

      vl.c: Fix error messages when parsing maxmem parameters

      Produce more human readable error messages and fix few spelling
      mistakes.

      Also remove a redundant check for the max memory size.

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Peter Krempa <pkrempa@redhat.com>

  commit c0e57a6022fdb2b00e7946bbfa2ad1f9515527cd
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:41 2015 +0800

      acpi, piix4: Add unplug cb for piix4.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to piix4, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 91a734a6fa0fcd03a7ffc32a7b45a3c2735d82be
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:40 2015 +0800

      acpi, ich9: Add unplug cb for ich9.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to ich9, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 232391c19ec69e6781667c53cb3c3bc57932bb95
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:39 2015 +0800

      acpi, pc: Add unplug cb for pc machine.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to pc machine, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 469b8ad283d748648960e2260a4a3c415b1b3956
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:38 2015 +0800

      acpi, ich9: Add hotunplug request cb for ich9.

      Memory and CPU hot unplug are both asynchronous procedures.
      They both need unplug request cb when the unplug operation happens.

      This patch adds hotunplug request cb for ich9, and memory and CPU
      hot unplug will share it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d9c5c5b8a81433921a75390a9951436424b5c4c5
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:37 2015 +0800

      acpi, pc: Add hotunplug request cb for pc machine.

      Memory and CPU hot unplug are both asynchronous procedures.
      They both need unplug request callback to initiate unplug operation.

      Add unplug handler to pc machine that will be used by following
      CPU and memory unplug patches.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 25f8dd96598042a88fdd970d5531584b589b10e4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:04:07 2015 +0100

      qdev: Don't exit when running into bad -global

      -global lets you set a nice booby-trap for yourself:

          $ qemu-system-x86_64 -nodefaults -S -display none -usb -monitor stdio -global usb-mouse.usb_version=l
          QEMU 2.1.94 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          Parameter 'usb_version' expects an int64 value or range
          $ echo $?
          1

      Not nice.  Until commit 3196270 we even abort()ed.

      The same error triggers if you manage to screw up a machine type's
      compat_props.  To demonstrate, change HW_COMPAT_2_1's entry to

                  .driver   = "usb-mouse",\
                  .property = "usb_version",\
                  .value    = "1", \

      Then run

          $ qemu-system-x86_64 -usb -M pc-i440fx-2.1 -device usb-mouse
          upstream-qemu: -device usb-mouse: Parameter 'usb_version' expects an int64 value or range
          $ echo $?
          1

      One of our creatively cruel error messages.

      Since this is actually a coding error, we *should* abort() here.
      Replace the error by an assertion failure in this case.

      But turn the fatal error into a mere warning when the faulty
      GlobalProperty comes from the user.  Looks like this:

          $ qemu-system-x86_64 -nodefaults -S -display none -usb -monitor stdio -global usb-mouse.usb_version=l
          QEMU 2.1.94 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          Warning: global usb-mouse.usb_version=l ignored (Parameter 'usb_version' expects an int64 value or range)
          (qemu)

      This is consistent with how we handle similarly unusable -global in
      qdev_prop_check_globals().

      You could argue that the error should make device_add fail.  Would be
      harder, because we're running within TypeInfo's instance_post_init()
      method device_post_init(), which can't fail.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d313858dfc2b0b5e6c126f1920863fe43dc9d5b6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:37 2015 +0100

      pci-assign: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 042a24db0a6051313220e161bf1a19c545540d08
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:36 2015 +0100

      qxl: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit f409edf74360805e53e16e6a51ca766e8891f3b7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:35 2015 +0100

      cirrus-vga: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit b8a2dac04aea1f6c801bbb6c44a33ee7cd4ff533
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:34 2015 +0100

      ide/ich: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 28d85904daafda4e099d6a61371ab8e5c1f395bd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:33 2015 +0100

      serial-pci: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit eb1bef94b4067b19abac91fec001c690a58b2174
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:32 2015 +0100

      pcnet: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 4c3b22459d3589cf84d1ccadc6b09e586497820d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:31 2015 +0100

      pcnet: pcnet_common_init() always returns 0, change to void

      The next commit will exploit the fact it never fails.  This one makes
      it obvious.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 9af21dbee14c5165598d17115ade63184ec0dd8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:30 2015 +0100

      pci: Trivial device model conversions to realize

      Convert the device models where initialization obviously can't fail.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 7ee6c1e182cca6ccf5253569fca3d05826efb4e9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:29 2015 +0100

      pci: Permit incremental conversion of device models to realize

      Call the new PCIDeviceClass method realize().  Default it to
      pci_default_realize(), which calls old method init().

      To convert a device model, make it implement realize() rather than
      init().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 133e9b228df16d11de01529c217417e78d1d9370
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:28 2015 +0100

      pci: Convert core to realize

      Implement DeviceClass methods realize() and unrealize() instead of
      init() and exit().  The core's initialization errors now get
      propagated properly, and QMP sends them instead of an unspecific
      "Device initialization failed" error.  Unrealize can't fail, so no
      change there.

      PCIDeviceClass is unchanged: it still provides init() and exit().
      Therefore, device models' errors are still not propagated.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 661875e948ece4723ebe4e7628060c27cad06df1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:38 2015 +0000

      acpi: drop min-bytes in build_package()

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit eae8bded9a1a19561054654f5113aeb978d7b4c1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:37 2015 +0000

      acpi: add build_append_namestring() helper

      Use build_append_namestring() instead of build_append_nameseg()
      So user won't have to care whether name is NameSeg, NamePath or
      NameString.

      See for reference ACPI 5.0: 20.2.2 Name Objects Encoding

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 19934e0e3d0f70eefe8d9e51e71c1cb80f4659d0
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:36 2015 +0000

      acpi: move generic aml building helpers into dedictated file

      the will be later used for composing AML primitives
      and all that could be reused later for ARM machines
      as well.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 12e63900f01ce54702745d83f985e26042adda9b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Feb 1 11:54:26 2015 +0200

      bios linker: validate pointer within table

      buios linker assumes pointer parameter it gets
      is within table, validate this.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 16771613a89838020ee6d84be40b46c6a8180824
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jan 28 18:18:50 2015 +0200

      acpi-build: fix memory leak with bridge hp off

      When bridge hotplug is disabled for old machine types,
      we never free memory allocated for temporary tables.
      Fix this up.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2559db069628981bfdc90637fac5bf1b4f4e8ef5
  Merge: 11d39a1 21f5826
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 11:18:30 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-roms-20150219-1' into staging

      seabios: update to 1.8.0 release

      # gpg: Signature made Thu Feb 19 08:36:30 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-roms-20150219-1:
        seabios: update to 1.8.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11d39a131020cc5c54ff9bc86d3259f7d32bf849
  Merge: c5c6d7f e95d24f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 09:08:54 2015 +0000

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150218' into staging

      Features for s390x/kvm

      1. guest reIPL changes (Fan Zhang)
      Implements subcode 5 and 6 of diag 0x308. This allows to use
      /sys/firmware/[re]ipl/ccw/* and the chreipl and lsreipl tools in
      Linux. In addition to the normal "change the disk" this also
      allows to switch from booting an external kernel into rebooting
      from a disk.

      2. Memory page table walking (Thomas Huth)
      Fix several page table walking functions, used in several places
      like gdb server and instruction handling. Also use these functions
      in several I/O related functions.

      # gpg: Signature made Wed Feb 18 09:13:22 2015 GMT using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150218: (29 commits)
        s390x/helper: Remove s390_cpu_physical_memory_map
        s390x/pci: Rework memory access in zpci instruction
        s390x/ioinst: Rework memory access in TPI instruction
        s390x/ioinst: Rework memory access in CHSC instruction
        s390x/ioinst: Rework memory access in STCRW instruction
        s390x/ioinst: Rework memory access in TSCH instruction
        s390x/ioinst: Set condition code in ioinst_handle_tsch() handler
        s390x/ioinst: Rework memory access in STSCH instruction
        s390x/ioinst: Rework memory access in SSCH instruction
        s390x/ioinst: Rework memory access in MSCH instruction
        s390x/css: Make schib parameter of css_do_msch const
        s390x/mmu: Add function for accessing guest memory
        s390x/kvm: Add function for injecting pgm access exceptions
        s390x/mmu: Clean up mmu_translate_asc()
        s390x/mmu: Check bit 52 in page table entry
        s390x/mmu: Renaming related to the ASCE confusion
        s390x/mmu: Add support for read-only regions
        s390x/mmu: Fix the exception codes for illegal table entries
        s390x/mmu: Fix exception types when checking the ASCEs
        s390x/mmu: Fix translation exception code in lowcore
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c5c6d7f81a6950d8e32a3b5a0bafd37bfa5a8e88
  Merge: 68b459e 3339488
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 07:01:08 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-18' into staging

      Clean up around error_get_pretty(), qerror_report_err()

      # gpg: Signature made Wed Feb 18 10:10:07 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-18:
        qemu-char: Avoid qerror_report_err() outside QMP command handlers
        qemu-img: Avoid qerror_report_err() outside QMP command handlers
        vl: Avoid qerror_report_err() outside QMP command handlers
        tpm: Avoid qerror_report_err() outside QMP command handlers
        numa: Avoid qerror_report_err() outside QMP command handlers
        net: Avoid qerror_report_err() outside QMP command handlers
        monitor: Avoid qerror_report_err() outside QMP command handlers
        monitor: Clean up around monitor_handle_fd_param()
        error: Use error_report_err() where appropriate
        error: New convenience function error_report_err()
        vhost-scsi: Improve error reporting for invalid vhostfd

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de13197a38cf45c990802661a057f64a05426cbc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:43:35 2014 -0200

      target-i386: Move APIC ID compatibility code to pc.c

      The APIC ID compatibility code is required only for PC, and now that
      x86_cpu_initfn() doesn't use x86_cpu_apic_id_from_index() anymore, that
      code can be moved to pc.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e1356dd70aef11425883dd4d2885f1d208eb9d57
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:31:11 2014 -0200

      target-i386: Require APIC ID to be explicitly set before CPU realize

      Instead of setting APIC ID automatically when creating a X86CPU, require
      the property to be set before realizing the object (which all callers of
      cpu_x86_create() already do).

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 9c235e83f1c3437be6ca45755909efb745c10deb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:28:45 2014 -0200

      target-i386: Set APIC ID using cpu_index on CONFIG_USER

      The PC CPU initialization code already sets apic-id based on the CPU
      topology, and CONFIG_USER doesn't need the topology-based APIC ID
      calculation code.

      Make CONFIG_USER set apic-id before realizing the CPU (just like PC
      already does), so we can simplify x86_cpu_initfn later. As there is no
      CPU topology configuration in CONFIG_USER, just use cpu_index as the
      APIC ID.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 696da41b1b741f6056e52c572e05abd790637be1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 16:48:51 2015 -0200

      linux-user: Check for cpu_init() errors

      This was the only caller of cpu_init() that was not checking for NULL
      yet.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 9e9d3863adcbd1ffeca30f240f49805b00ba0d87
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:20:10 2014 -0200

      target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id

      The field doesn't need to be inside CPUState, and it is not specific for
      the CPUID instruction, so move and rename it.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 18b0e4e77142ace948497a053bd5b56c1b849592
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 14:51:00 2014 -0200

      target-i386: Simplify error handling on cpu_x86_init_user()

      Isolate error handling path from the "if (error)" checks.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 15258d46baef5f8265ad5f1002905664cf58f051
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:07:01 2014 -0200

      target-i386: Eliminate cpu_init() function

      Instead of putting extra logic inside cpu.h, just do everything inside
      cpu_x86_init_user().

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 644dba250a3ed04079792f0d6cc918fb1483e6a5
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:05:20 2014 -0200

      target-i386: Rename cpu_x86_init() to cpu_x86_init_user()

      The function is used only for CONFIG_USER, so make its purpose clear.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8a3f75b39db7d2c891d1e91dde5180d3ff9e10f7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:41:06 2014 -0200

      target-i386: Move topology.h to include/hw/i386

      This will allow the PC code to use the header, and lets us eliminate the
      QEMU_INCLUDES hack inside tests/Makefile.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 08e1a1e5a175ecbfdb761db5a62090498f736969
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:57:50 2015 -0200

      target-i386: Eliminate unnecessary get_cpuid_vendor() function

      The function was used in only two places. In one of them, the function
      made the code less readable by requiring temporary te[bcd]x variables.
      In the other one we can simply inline the existing code.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit a3c2ca7d29ff39cd5b06e48fa1e42c91d05ebd36
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:48:55 2015 -0200

      target-i386: Simplify listflags() function

      listflags() had lots of unnecessary complexity. Instead of printing to a
      buffer that will be immediately printed, simply call the printing
      function directly. Also, remove the fbits and flags arguments that were
      always set to the same value. Also, there's no need to list the flags in
      reverse order.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 68b459eaa660be17d3547aa581502fe2c572c84f
  Merge: 3d30395 1ce6be2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 13:14:37 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-02-18' into staging

      hmp: Normalize HMP command handler names

      # gpg: Signature made Wed Feb 18 10:59:44 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-02-18:
        hmp: Name HMP info handler functions hmp_info_SUBCOMMAND()
        hmp: Name HMP command handler functions hmp_COMMAND()
        hmp: Clean up declarations for long-gone info handlers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d30395f7fb3315e4ecf0de4e48790e1326bbd47
  Merge: c28d486 c3cf77c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 11:54:15 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150218-1' into staging

      usb: error handling fixes from Markus, make sysbus ehci arm-only.

      # gpg: Signature made Wed Feb 18 09:54:13 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150218-1:
        Make sysbus EHCI devices ARM only by default
        PPC: Don't use legacy -usbdevice support for setting up board
        r2d: Don't use legacy -usbdevice support for setting up board
        usb: Change usb_create_simple() to abort on failure
        usb: Suppress bogus error when automatic usb-hub creation fails
        usb: Do not prefix error_setg() messages with "Error: "
        usb: Improve -usbdevice error reporting a bit
        usb: usb_create() can't fail, drop useless error handling

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c28d4869ea1235b80ef59d5f5e8ca96bc4155c0c
  Merge: 73104fd ee17cbd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 11:05:10 2015 +0000

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-02-16-v2-tag' into staging

      tag for qga-pull-2015-02-16-v2

      v2:

      * generalized QAPI function definition for guest-memory-block-size
        to guest-memory-block-info for future extensibility (Eric)

      # gpg: Signature made Tue Feb 17 22:36:08 2015 GMT using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-02-16-v2-tag:
        qemu-ga-win: Fail loudly on bare 'set-time'
        qga: add memory block command that unsupported
        qga: implement qmp_guest_get_memory_block_info() for Linux with sysfs
        qga: implement qmp_guest_set_memory_blocks() for Linux with sysfs
        qga: implement qmp_guest_get_memory_blocks() for Linux with sysfs
        qga: introduce three guest memory block commmands with stubs
        qga: implement file commands for Windows guest
        guest agent: guest-file-open: refactoring
        utils: drop strtok_r from envlist_parse
        qga: add guest-set-user-password command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 73104fd399c6778112f64fe0d439319f24508d9a
  Merge: 3dc1061 0dc3f44
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 13:58:18 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - vhost-scsi: add bootindex property
      - RCU: fix MemoryRegion lifetime issues in PCI; document the rules;
      convert of AddressSpaceDispatch and RAMList
      - KVM: add kvm_exit reasons for aarch64

      # gpg: Signature made Mon Feb 16 16:32:32 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (21 commits)
        Convert ram_list to RCU
        exec: convert ram_list to QLIST
        cosmetic changes preparing for the following patches
        exec: protect mru_block with RCU
        rcu: add g_free_rcu
        rcu: introduce RCU-enabled QLIST
        exec: RCUify AddressSpaceDispatch
        exec: make iotlb RCU-friendly
        exec: introduce cpu_reload_memory_map
        docs: clarify memory region lifecycle
        pci: split shpc_cleanup and shpc_free
        pcie: remove mmconfig memory leak and wrap mmconfig update with transaction
        memory: keep the owner of the AddressSpace alive until do_address_space_destroy
        rcu: run RCU callbacks under the BQL
        rcu: do not let RCU callbacks pile up indefinitely
        vhost-scsi: set the bootable value of channel/target/lun
        vhost-scsi: add a property for booting
        vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface
        vhost-scsi: add bootindex property
        qdev: support to get a device firmware path directly
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3dc10613c313a042a111e46a977733411495ea8c
  Merge: 3dd2d1a b9c6494
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 12:59:13 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      v2:
       * Fix C11 typedef redefinitions in ahci and libqos malloc [Peter]
       * Fix lx -> PRIx64 format specifiers in ahci [Peter]

      # gpg: Signature made Mon Feb 16 15:45:53 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (65 commits)
        block: Keep bdrv_check*_request()'s return value
        block: Remove "growable" from BDS
        block: Clamp BlockBackend requests
        qemu-io: Use BlockBackend
        qemu-io: Remove "growable" option
        qemu-io: Use blk_new_open() in openfile()
        qemu-nbd: Use blk_new_open() in main()
        qemu-img: Use BlockBackend as far as possible
        qemu-img: Use blk_new_open() in img_rebase()
        qemu-img: Use blk_new_open() in img_open()
        block/xen: Use blk_new_open() in blk_connect()
        blockdev: Use blk_new_open() in blockdev_init()
        iotests: Add test for driver=qcow2, format=qcow2
        block: Add Error parameter to bdrv_find_protocol()
        block: Add blk_new_open()
        block: Lift some BDS functions to the BlockBackend
        iotests: Add test for qemu-img convert to NBD
        qemu-img: Fix qemu-img convert -n
        qemu-iotests: Add 093 for IO throttling
        qemu-iotests: Allow caller to disable underscore convertion for qmp
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3dd2d1a33976a7ec4aa3a6a29e5183af53949237
  Merge: bf2fd13 9e0ff75
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 12:07:28 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150216-1' into staging

      vnc: fixup some QemuOpts conversion fallout.

      # gpg: Signature made Mon Feb 16 08:13:32 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150216-1:
        vnc: fix coverity warning
        ui/vnc: optimize full scanline updates
        vnc: auto assian an id when calling change vnc qmp interface
        vnc: introduce an wrapper for auto assign vnc id
        vnc: using bool type instead of int for QEMU_OPT_BOOL
        vnc: correct missing property about vnc_display
        vnc: fix qemu crash when not configure vnc option

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf2fd13af3925f3a081fdeab8e8a1c8830431e46
  Merge: cd2d554 1ab2aea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 11:08:40 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150213-2' into staging

      MIPS patches 2015-02-13

      Changes:
      * bug fixes, cleanups and minor improvements

      # gpg: Signature made Sat Feb 14 17:01:37 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150213-2:
        linux-user: correct stat structure in MIPS N32
        target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction
        target-mips: fix broken snapshotting
        target-mips: use CP0EnLo_XI instead of magic number
        target-mips: ll and lld cause AdEL exception for unaligned address
        target-mips: fix detection of the end of the page during translation
        target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors
        isa: remove isa_mem_base variable
        gt64xxx: remove isa_mem_base usage
        piix4: use PCI address space instead of system memory
        mips: remove isa_mem_base usage
        jazz: remove usage of isa_mem_base
        jazz: do not explode QEMUMachineInitArgs structure
        isa: add memory space parameter to isa_bus_new

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4bc6a3e54e06c47b8e23bfa3d873fa2f42dfec02
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:08 2015 +0100

      parallel: parallel_hds_isa_init() shouldn't fail

      It shouldn't fail, and no caller checks for failure.  Make failure
      fatal.

      Maintainers of affected machines cc'ed.

      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 07dc788054d714a07df08e2eacc8c2e1c47b9a58
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:07 2015 +0100

      parallel: Factor out common parallel_hds_isa_init()

      Maintainers of affected machines cc'ed.

      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c6f10a5876a81f7a016714df06730c48210ee419
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:06 2015 +0100

      serial: serial_hds_isa_init() shouldn't fail

      It shouldn't fail, and no caller checks for failure.  Make failure
      fatal.

      Maintainers of affected machines cc'ed.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b6607a1a204d52fe13746cc9c3d2da4303e39b18
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:05 2015 +0100

      serial: Factor out common serial_hds_isa_init()

      It's the same old loop copied five times, plus another instance where
      it's clipped to two iterations and unrolled.

      No external users of serial_isa_init() are left, so give it internal
      linkage.

      Maintainers of affected machines cc'ed.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit aef0d55a4bc52b1713de88c100ba6dc451578e50
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:04 2015 +0100

      etsec: Replace qdev_init() by qdev_init_nofail()

      etsec_create() is a helper to create and realize the eTSEC.  It's
      currently unused.  Similar helpers for other NICs use
      qdev_init_nofail().  Match that.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit cd7c50a48dd484637aec36c351728ad0f140805a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:03 2015 +0100

      leon3: Replace unchecked qdev_init() by qdev_init_nofail()

      grlib_irqmp_create(), grlib_gptimer_create() and
      grlib_apbuart_create() are helpers to create and realize GRLIB
      devices.  Their only caller leon3_generic_hw_init() doesn't check for
      failure.  Only the first can actually fail, and only when the caller
      fails to set up a pointer property, which is a programming error.

      Replace qdev_init() by qdev_init_nofail().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit e25b89e5208564220b9ea3a728f899b37ff6dc2d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:02 2015 +0100

      ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()

      isa_ide_init()'s callers don't check for failure.  isa_ide_init()
      looks like it could fail, but since isa_ide_realizefn() can't fail, it
      actually can't.  Replace its qdev_init() by qdev_init_nofail() to make
      it obvious.

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit dde11116782c1891a057165539efc014cf365026
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:22 2015 -0200

      numa: Rename set_numa_modes() to numa_post_machine_init()

      This function does some initialization that needs to be done after
      machine init. The function may be eventually removed if we move the
      CPUState.numa_node initialization to the CPU init code, but while the
      function exists, lets give it a name that makes sense.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 1c1e6732786d46c7b0ab160cbf61122c53bb44cc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:21 2015 -0200

      numa: Rename option parsing functions

      Renaming set_numa_nodes() and numa_init_func() to parse_numa_opts() and
      parse_numa() makes the purpose of those functions clearer.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7dcd1d70fe2886a1e30d32678b795e6b9b6dd5c4
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:20 2015 -0200

      numa: Move QemuOpts parsing to set_numa_nodes()

      This allows us to make numa_init_func() static.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 25712ffe8478a95abd7b82e2f085c7c929498643
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:19 2015 -0200

      numa: Make max_numa_nodeid static

      Now the only code that uses the variable is inside numa.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit de1a7c84c49affff5884175d621c95196007ea23
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:18 2015 -0200

      numa: Move NUMA globals to numa.c

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 61b388c14c5b042e6a43caaba842e351b2c88edd
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:17 2015 -0200

      vl.c: Remove unnecessary zero-initialization of NUMA globals

      There's no need to zero-initialize globals, they are automatically
      initialized to zero.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e35704ba9ce0cd1e3c401f3bfbf3faf98b0b6885
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:16 2015 -0200

      numa: Move NUMA declarations from sysemu.h to numa.h

      Not all sysemu.h users need the NUMA declarations, and keeping them in a
      separate file makes it easier to see what are the interfaces provided by
      numa.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 912ae9c88669d0a0cbae1f20b8c80dde8e526251
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 11:13:10 2015 +0100

      qapi-types: add C99 index names to arrays

      It's not easy to figure out how monitor translates
      strings: most QEMU code deals with translated indexes,
      these are translated using _lookup arrays,
      so you need to find the array name, and find the
      appropriate offset.

      This patch adds C99 indexes to lookup arrays, which makes it possible to
      find the correct key using simple grep, and see that the matching is
      correct at a glance.

      Example:

      Before:

      const char *MigrationCapability_lookup[] = {
          "xbzrle",
          "rdma-pin-all",
          "auto-converge",
          "zero-blocks",
          NULL,
      };

      After:

      const char *MigrationCapability_lookup[] = {
          [MIGRATION_CAPABILITY_XBZRLE] = "xbzrle",
          [MIGRATION_CAPABILITY_RDMA_PIN_ALL] = "rdma-pin-all",
          [MIGRATION_CAPABILITY_AUTO_CONVERGE] = "auto-converge",
          [MIGRATION_CAPABILITY_ZERO_BLOCKS] = "zero-blocks",
          [MIGRATION_CAPABILITY_MAX] = NULL,
      };

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 606ee8f5eadd79627216bbdde4da0337cb7d4360
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 12 09:57:20 2015 +0800

      monitor: Fix missing err = NULL in client_migrate_info()

      When SPICE isn't used, we either fail an assertion in error_set(),
      or leak an error object.  Broken in commit b25d81b.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 438e8289d7746188f0684313d25d38d2a77747c9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Tue Feb 10 15:40:30 2015 -0700

      balloon: Fix typo

      Commit 422e0501 introduced a typo (unless removing an 'o' from
      balloon is how you deflate it?)

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f19e44bc9d5b9302d9ca4dcee52de3fc5d8b50f5
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Feb 8 15:40:48 2015 +0100

      hmp: Fix warning from smatch (wrong argument in function call)

      Fix this warning:
      hmp.c:414:38: warning: Using plain integer as NULL pointer

      qmp_query_block expects a pointer argument, so passing false is wrong.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 21f5826a04d38e19488f917e1eef22751490c769
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 09:33:03 2015 +0100

      seabios: update to 1.8.0 release

      'git shortlog 8936dbb2..4c59f5d8' for seabios repo:

      David Woodhouse (4):
            Update EFI_COMPATIBILITY16_TABLE to match 0.98 spec update
            build: use -m16 where available instead of asm(".code16gcc")
            romlayout: Use .code16 not .code16gcc
            vgabios: Use .code16 not .code16gcc

      Gerd Hoffmann (2):
            add scripts/tarball.sh
            build: set LC_ALL=C

      Hannes Reinecke (1):
            megasas: read addional PCI I/O bar

      Ian Campbell (1):
            romlayout: Use "rep ; nop" not "rep nop".

      Kevin O'Connor (139):
            vgabios: Return from handle_1011() if handler found.
            edd: Move EDD get drive parameters (int 1348) logic from disk.c to block.c.
            edd: Use sectors==-1 to detect removable media.
            edd: Separate out ATA and virtio specific parts of fill_edd().
            cdemu: store internal cdemu fields in standard "el-torito" spec format.
            Move cdemu call interface and disk_ret helper code to disk.c.
            smm: Replace SMI assembler code with C code.
            smm: Use a C struct to define the layout of the SMM area.
            smp: Replace QEMU SMP init assembler code with C; run only in 32bit mode.
            Don't enable thread preemption during S3 resume vga option rom execution.
            Remove old Bochs bios fixed address string at 0xfff00.
            Move most of the VAR16FIXED() defs to misc.c.
            build: Avoid absolute paths during "whole-program" compiling.
            Make sure handle_smi() and handle_smp() are compiled out if not enabled.
            Remove the TODO file.
            Abstract reset call (and possible 16bit mode switch) into reset() function.
            build: Remove unused function getSectionsStart() from layoutrom.py.
            build: Extract section visiting logic in layoutrom.py.
            build: Refactor layoutrom.py gc() function.
            build: Use customized entry point for each type of build.
            build: Refactor findInit() function.
            build: Rework getRelocs() to use a hash instead of categories in layoutrom.py
            build: Keep segmented sections separate until final link step.
            build: Use fileid instead of category to write sections in layoutrom.py.
            build: Only export needed fields in LayoutInfo in layoutrom.py.
            build: Get fixed address variables from 32bit compile pass (not 16bit)
            build: Minor - fix comments referring to old tools/ directory.
            xhci: Update the times for usb command timeouts.
            ehci: Update usb command timeouts to use usb_xfer_time()
            uhci: Update usb command timeouts to use usb_xfer_time()
            ohci: Update usb command timeouts to use usb_xfer_time()
            vgabios: Fix broken build resulting from e5749978.
            boot: Change ":rom%d" boot order rom instance to ":rom%x"
            Minor - remove stray tab from src/fw/smm.c.
            build: Update kconfig to version in Linux 3.16.
            usb: Fix usb_xfer_time() to work when called in 16bit mode.
            xhci: Call usb_desc2pipe() on xhci_update_pipe().
            xhci: Remove 16bit code wrappers.
            xhci: Use high memory instead of low memory for internal storage.
            xhci: Move root hub and setup code to top of file.
            xhci: Add xhci_check_ports() and xhci_free_pipes() functions.
            ehci: Move port power up from ehci_hub_detect() to check_ehci_ports().
            usb-hub: Enable power to all ports prior to calling usb_enumerate().
            xhci: Change xhci_hub_detect() to use connect status instead of link state.
            uhci: Repeatedly poll for device detect for 100ms.
            ohci: Repeatedly poll for device detect for 100ms.
            ehci: Stall uhci/ohci init only until default port routing is done.
            usb: Perform device detect polling on all usb controllers.
            ehci: Fix bug in hub port assignment
            Revert "Use the extra stack for 16bit USB and PS2 keyboard/mouse commands."
            pmm: Fix entry point to support non-zero %ss
            Move stack hop code below call32/call16 code in stacks.c
            Add need_hop_back() call that determines if stack_hop_back is needed
            Update invoke_mouse_handler() to use need_hop_back()
            Update stack_hop_back() to jump to 16bit mode if called in 32bit mode.
            Track when entering via call32() and use the same mode for stack_hop_back()
            Simplify farcall16 code
            Update reset() to use call16_back()
            build: Support declaring 32bit C functions that must reside in the f-segment
            Move call16() functions from romlayout.S to inline assembler in stacks.c
            Break up call32() into call32() and call32_sloppy()
            Fully restore 16bit state during call16_sloppy()
            Implement call32 mechanism using SMIs.
            Move a20 code from system.c and ps2port.h to x86.h
            Backup and restore a20 on call32_sloppy()
            usb: Rename ?hci_control() to ?hci_send_control()
            usb: Rename usb_getFrameExp() to usb_get_period()
            usb: Rename findEndPointDesc() to usb_find_desc()
            usb: Rename send_default_control() to usb_send_default_control()
            usb: Rename free_pipe() to usb_free_pipe()
            usb: Clarify usb freelist manipulations
            xhci: Change xhci_update_pipe() to xhci_realloc_pipe() and use for alloc too
            uhci: Export uhci_realloc_pipe() instead of uhci_alloc_pipe()
            ohci: Export ohci_realloc_pipe() instead of ohci_alloc_pipe()
            ehci: Export ehci_realloc_pipe() instead of ehci_alloc_pipe()
            usb: Use usb_realloc_pipe for pipe alloc, update, and free.
            Use 32bit memcpy in int1587 when applicable
            Don't clobber %ax on ENTRY_INTO32 macro
            Create assembler macros for saving and restoring 'struct bregs'
            Do full BREGS backup/restore for pmm, pnp, and irqentry_extrastack
            Remove unused macro ENTRY_ST
            vgabios: Don't declare custom internal BDA storage in std/bda.h
            vgabios: Cache a pointer to the current mode struct in the BDA
            vgabios: Don't pass vmode_g to vgafb_move_chars() / vgafb_clear_chars()
            vgabios: Rename vbe_flags to flags
            vgabios: Set cursor shape fixes
            vgabios: Refactor get/set_cursor_shape() code
            vgabios: Only init BDA device details in init_bios_area()
            vgabios: Only set the dcc_index=8 if stdvga ports are available
            vgabios: Move standard table definitions to std/vga.h
            vgabios: Fill in available legacy modes in video_func_static at runtime
            vgabios: Add support for reading framebuffer in "direct" mode
            Fix PNP regression introduced in 99cb8f3e due to missed conversion
            Minor - move PORT_PS2_CTRLB from hw/ps2port.h to hw/timer.c
            vgabios: Support emulating text mode attributes while in graphics mode
            vgabios: Add software cursor capability
            Use an aligned stack offset when entering on the extra stack
            Minor - comment updates in romlayout.S
            Fix build issue on gcc34
            pciinit: Fix build warning in mch_pci_slot_get_irq()
            floppy: Make sure to yield() during floppy PIO
            Minor - be consistent in placement of .code16/32 in romlayout.S
            Use macros for .code16/32 mode switches in inline asm in stacks.c
            Eliminate FUNCFSEG - only force portions of inline asm to f-segment
            usb: Update USB hub code to support super speed hubs
            Simplify README files - point to online documentation instead
            sdcard: Initial support for SD cards on PCI SDHCI controllers on QEMU
            Add wiki documentation to repository
            docs: Don't point to repo README files
            docs: Add info on MODE16/MODESEGMENT compile time flags
            docs: Add page describing SeaBIOS final object linking
            scsi: Move cdb_* functions above scsi_* functions
            scsi: Move process_scsi_op() to hw/blockcmd.c and rename
            cdrom: call scsi_process_op() instead of cdb_read()
            scsi: Don't export cdb_* functions
            cdrom: Break up very large read requests into smaller requests
            block: Check for read/write requests over 64K
            usb: Add support for OHCI bulk transfers
            readserial: Enhance pipe support
            docs: Add documentation on using readserial.py script
            uhci: Enable "depth" tree traversal for bulk transfers
            uhci: Increase bulk transfer STACKTDS to 16
            vgabios: Support emulated text in gfx_read_char()
            ehci: No need to support td array wrapping
            ehci: Simplify fillTDbuffer() and rename
            ehci: Merge ehci_send_control with ehci_send_bulk
            ohci: Merge ohci_send_control with ohci_send_bulk
            uhci: Merge uhci_send_control with uhci_send_bulk
            xhci: Merge xhci_send_control with xhci_send_bulk
            usb: Use usb_send_pipe() now that all drivers have x_send_pipe()
            xhci: Move xhci_xfer_x() functions together
            xhci: Merge some xhci_xfer_x() functions into xhci_send_pipe()
            usb: Control transfers always have an 8 byte command size
            usb: Minor - properly free memory on get_device_config() error path
            checkstack: Handle callw instruction
            docs: Document why v1.6.3 release came after v0.6.2
            docs: Update release history with dates of stable releases
            docs: There is only one VAR16 flag now
            docs: Note v1.8.0 release

      Marcel Apfelbaum (1):
            hw/pci: reserve IO and mem for pci express downstream ports with no devices attached

      Markus Armbruster (1):
            boot: Fix boot order for SCSI target, lun > 9

      Paolo Bonzini (5):
            piix: add and use dev-piix.h
            smm: complete SMM setup
            smm: unify SMM handlers
            vgabios: fix graphics operation with Bochs VGA in non-DISPI modes
            vgabios: implement read char in graphics mode

      zhanghailiang (1):
            acpi: use specified macro instead of magic-number

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1ce6be24df0a2f634b61b9b882ac6d10af485ad6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 14:18:24 2015 +0100

      hmp: Name HMP info handler functions hmp_info_SUBCOMMAND()

      Some are called do_info_SUBCOMMAND() (old ones, usually), some
      hmp_info_SUBCOMMAND(), some SUBCOMMAND_info(), sometimes SUBCOMMAND
      pointlessly differs in spelling.

      Normalize to hmp_info_SUBCOMMAND(), where SUBCOMMAND is exactly the
      subcommand name with '-' replaced by '_'.

      Exceptions:

      * sun4m_irq_info(), sun4m_pic_info() renamed to sun4m_hmp_info_irq(),
        sun4m_hmp_info_pic().

      * lm32_irq_info(), lm32_pic_info() renamed to lm32_hmp_info_irq(),
        lm32_hmp_info_pic().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3e5a50d64ca9c323f8099fdf1aef02813598882d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 13:55:43 2015 +0100

      hmp: Name HMP command handler functions hmp_COMMAND()

      Some are called do_COMMAND() (old ones, usually), some hmp_COMMAND(),
      and sometimes COMMAND pointlessly differs in spelling.

      Normalize to hmp_COMMAND(), where COMMAND is exactly the command name
      with '-' replaced by '_'.

      Exceptions:

      * do_device_add() and client_migrate_info() *not* renamed to
        hmp_device_add(), hmp_client_migrate_info(), because they're also
        QMP handlers.  They still need to be converted to QAPI.

      * do_memory_dump(), do_physical_memory_dump(), do_ioport_read(),
        do_ioport_write() renamed do hmp_* instead of hmp_x(), hmp_xp(),
        hmp_i(), hmp_o(), because those names are too cryptic for my taste.

      * do_info_help() renamed to hmp_info_help() instead of hmp_info(),
        because it only covers help.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 08d15d6c23a371ad75f8a242d6daceb19ff1468a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 12:07:09 2015 +0100

      hmp: Clean up declarations for long-gone info handlers

      Leftovers from
      d1f2964 qapi: Convert query-spice
      791e7c8 qapi: Convert query-migrate
      0fe6a7f slirp: Drop statistic code

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c3cf77cb63b71618224129df41f114488e0f74e4
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Wed Feb 18 16:01:01 2015 +1100

      Make sysbus EHCI devices ARM only by default

      A number of ARM embedded boards include EHCI USB host controllers which
      appear as directly mapped devices, rather than sitting on a PCI bus.

      At present code to emulate such devices is included whenever EHCI support
      is included.  This patch adjusts teh config options to only include them
      in builds targetting ARM by default.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c86580b889a0c22deba3afd4672472f23a1249d0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:14 2015 +0100

      PPC: Don't use legacy -usbdevice support for setting up board

      It's tempting, because usbdevice_create() is so simple to use.  But
      there's a lot of unwanted complexity behind the simple interface.
      Switch to usb_create_simple().

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 456dcd8ab45a83dd51cca357cd9aa6ad337dc20d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:13 2015 +0100

      r2d: Don't use legacy -usbdevice support for setting up board

      It's tempting, because usbdevice_create() is so simple to use.  But
      there's a lot of unwanted complexity behind the simple interface.
      Switch to usb_create_simple().

      Cc: Magnus Damm <magnus.damm@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 599655c91f3a55ac75007e851deca09010787bd7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:12 2015 +0100

      usb: Change usb_create_simple() to abort on failure

      Instead of returning null pointer.  Matches pci_create_simple(),
      isa_create_simple(), sysbus_create_simple().  It's unused since the
      previous commit, but I'll put it to use again shortly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bd8b92d5c8387c2c94f06665514c05000169fafd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:11 2015 +0100

      usb: Suppress bogus error when automatic usb-hub creation fails

      USBDevice's realize method usb_qdev_realize() automatically creates a
      usb-hub when only one port is left.  Creating devices in realize
      methods is questionable, but works.

      If usb-hub creation fails, an error is reported to stderr, but the
      failure is otherwise ignored.  We then create the actual device using
      the last port, which may well succeed.

      Example:

          $ qemu -nodefaults -S -display none -machine usb=on -monitor stdio
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          [Repeat 36 times]
          (qemu) info usb
            Device 0.0, Port 1, Speed 12 Mb/s, Product QEMU USB Mouse
            Device 0.0, Port 2, Speed 12 Mb/s, Product QEMU USB Hub
            Device 0.0, Port 2.1, Speed 12 Mb/s, Product QEMU USB Mouse
          [More mice and hubs omitted...]
            Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
          (qemu) device_add usb-mouse
          usb hub chain too deep
          Failed to initialize USB device 'usb-hub'
          (qemu) info usb
          [...]
            Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
            Device 0.0, Port 2.8.8.8.8.8, Speed 12 Mb/s, Product QEMU USB Mouse

      Despite the "Failed" message, the command actually succeeded.

      In QMP, it's worse.  When adding the 37th mouse via QMP, the command
      fails with

          {"error": {"class": "GenericError", "desc": "usb hub chain too deep"}}

      Additionally, "Failed to initialize USB device 'usb-hub'" is reported
      on stderr.  Despite the command failure, the device was created.  This
      is wrong.

      Fix by avoiding qdev_init() for usb-hub creation, so we can ignore
      errors cleanly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 06f22eb78f3eb557c667f5d0a46099e43a2aeb0d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:10 2015 +0100

      usb: Do not prefix error_setg() messages with "Error: "

      Because it produces beauties like

          (qemu) usb_add mouse
          Failed to initialize USB device 'usb-mouse': Error: tried to attach usb device QEMU USB Mouse to a bus with no free ports

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3bc36a401e0f33e63a4d2c58b646ddf78efb567c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:09 2015 +0100

      usb: Improve -usbdevice error reporting a bit

      Most LegacyUSBFactory usbdevice_init() methods realize with
      qdev_init_nofail(), even though their caller usbdevice_create() can
      handle failure.  Okay if it really can't fail (I didn't check), but
      somewhat brittle.

      usb_msd_init() and usb_bt_init() call qdev_init().  The latter
      additionally reports an error when qdev_init() fails.

      Realization failure produces multiple error reports: a specific one
      from qdev_init(), and generic ones from usb_bt_init(),
      usb_create_simple(), usbdevice_create() and usb_parse().

      Remove realization from the usbdevice_init() methods.  Realize in
      usbdevice_create(), and produce exactly one error message there.  You
      still get another one from usb_parse().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4806ec9b2c57ff42a91d5419ac1137fffd1c9fb5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:08 2015 +0100

      usb: usb_create() can't fail, drop useless error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 33394884060b6501ef39b124eeaa111f61c59f7f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:21:26 2015 +0100

      qemu-char: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in legacy chardev parser
      qemu_chr_parse_compat().  Legacy chardev syntax is not to be used in
      QMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6936f299a47acf84b4d926d0eec4cdf3cf2274ba
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:14:02 2015 +0100

      qemu-img: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a720a390b1b2260d245bcc96923bf17e186b4b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:12:59 2015 +0100

      vl: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helpers
      machine_set_property() and object_create().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bc09a287d85505eabd1f548eae3a188ece902e49
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:11:17 2015 +0100

      tpm: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helper
      configure_tpm().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 29b762f5f0efdb6a0cb693be6df2988c195523db
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:06:23 2015 +0100

      numa: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helper
      numa_init_func() and board setup helper
      memory_region_allocate_system_memory().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12d0cc2db971cc0888b7d465143c68dee381c88b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:02:06 2015 +0100

      net: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in HMP command handler
      hmp_host_net_add() and initial startup helpers net_init_client(),
      net_init_netdev().  Keep it in QMP command handler qmp_netdev_add().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 091e38b7dc3255d780f0603b5b93c25078c39856
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:15:43 2015 +0100

      monitor: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in HMP command handler
      hmp_trace_event().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1677f4c66cf2228eb14f1b0571d0e3b38d0d6606
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Feb 9 14:03:19 2015 +0100

      monitor: Clean up around monitor_handle_fd_param()

      monitor_handle_fd_param() is a wrapper around
      monitor_handle_fd_param2() that feeds errors to qerror_report_err()
      instead of returning them.  qerror_report_err() is inappropriate in
      many contexts.  monitor_handle_fd_param() looks simpler than
      monitor_handle_fd_param2(), which tempts use.  Remove the temptation:
      drop the wrapper and open-code the (trivial) error handling instead.

      Replace the open-coded qerror_report_err() by error_report_err() in
      places that already use error_report().  Turns out that's everywhere.

      While there, rename monitor_handle_fd_param2() to monitor_fd_param().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 565f65d271984a32eed2c324ff6ef8be33f7f3d2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 13:55:05 2015 +0100

      error: Use error_report_err() where appropriate

      Coccinelle semantic patch:

          @@
          expression E;
          @@
          -    error_report("%s", error_get_pretty(E));
          -    error_free(E);
          +    error_report_err(E);
          @@
          expression E, S;
          @@
          -    error_report("%s", error_get_pretty(E));
          +    error_report_err(E);
          (
               exit(S);
          |
               abort();
          )

      Trivial manual touch-ups in block/sheepdog.c.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 2ee2f1e41517efa7b5dd604a68ceca9b1377de2c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 15:27:19 2015 +0100

      error: New convenience function error_report_err()

      I've typed error_report("%s", error_get_pretty(ERR)) too many times
      already, and I've fixed too many instances of qerror_report_err(ERR)
      to error_report("%s", error_get_pretty(ERR)) as well.  Capture the
      pattern in a convenience function.

      Since it's almost invariably followed by error_free(), stuff that into
      the convenience function as well.

      The next patch will put it to use.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 248337e178fbcf1c20132d4f3d1033cb0dde7638
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Feb 9 11:49:08 2015 +0100

      vhost-scsi: Improve error reporting for invalid vhostfd

      We get two error messages: one from monitor_handle_fd_param2(), and
      another one from vhost_scsi_realize().  The second one gets suppressed
      in QMP context.

      That's because monitor_handle_fd_param() calls qerror_report_err().
      Calling qerror_report_err() is always inappropriate in realize
      methods, because it doesn't return the Error object.  It either
      reports the error to stderr or the human monitor, or it stores it in
      the QMP monitor, where it makes the QMP command fail even when the
      realize method ignores the error and succeeds.  Fortunately,
      vhost_scsi_realize() doesn't do that.

      Fix by switching to monitor_handle_fd_param2().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e95d24ff40c77fbfd71396834a2eb99375f8bcc4
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:42 2015 +0100

      s390x/helper: Remove s390_cpu_physical_memory_map

      The function is now not used anymore, so it can be removed safely.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 63ceef61ac6cc033d465a6a06d394bcc2854a7b2
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Thu Feb 12 18:09:41 2015 +0100

      s390x/pci: Rework memory access in zpci instruction

      Change zpci instructions to use the new logical memory access
      functions.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 7781a492fa5a2eff53d06b25b93f0186ad3226c9
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:40 2015 +0100

      s390x/ioinst: Rework memory access in TPI instruction

      Change the handler for TPI to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 166f1bb7968738490fafc058e4b6505eb78701b6
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:39 2015 +0100

      s390x/ioinst: Rework memory access in CHSC instruction

      Change the CHSC handler to correctly use logical addresses, too.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 7f74f0aa74a01698ef24459f7bc2a23f3880a2b8
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:38 2015 +0100

      s390x/ioinst: Rework memory access in STCRW instruction

      Change the handler for STCRW to use the new logical memory access
      functions. Since STCRW is suppressed on protection/access exceptions,
      we also have to make sure to re-queue the CRW in case it could not be
      written to the memory.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit b7b6348ab433519f16c1500e3ea04805428be91e
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:37 2015 +0100

      s390x/ioinst: Rework memory access in TSCH instruction

      Change the TSCH handler to use the new logical memory access functions.
      Since the channel should not be updated in case of a protection or access
      exception while writing to the guest memory, the css_do_tsch() has to be
      split up into two parts, one for retrieving the IRB and one for the update.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 653b080960578c25ed88f7e6c5b7ec65d4fe1648
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:36 2015 +0100

      s390x/ioinst: Set condition code in ioinst_handle_tsch() handler

      Move the setting of the condition code from kvm.c into the handler
      function in ioinst.c itself, just like it has been done with the other
      handlers already (TSCH has just not been changed yet since it is called
      from a different dispatcher in kvm.c).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 57b22fc7920ff1bc40ea7f800a8b83520a1aa244
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:35 2015 +0100

      s390x/ioinst: Rework memory access in STSCH instruction

      Change the handler for STSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 234d9b1d3c5a0c87b9f41f7350bcf8c07a992864
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:34 2015 +0100

      s390x/ioinst: Rework memory access in SSCH instruction

      Change the handler for SSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 14b4e13d4c74f52875d9e1456a126ae076fd2204
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:33 2015 +0100

      s390x/ioinst: Rework memory access in MSCH instruction

      Change the handler for MSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit bffd09cd76bc800f466b47d32b35470f9ccef88c
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:32 2015 +0100

      s390x/css: Make schib parameter of css_do_msch const

      The schib parameter of css_do_msch() can be declared as const to
      make it clear that it does not get modified by this function.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit c3edd62851098e6417786193ed9e9341781fcf57
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:31 2015 +0100

      s390x/mmu: Add function for accessing guest memory

      According to the POP specification, the parameter blocks of various
      functions like the IO instructions are accessed with logical addresses.
      Thus we need a function that can read or write a buffer from/to the
      guest's logical address space.

      This patch now provides a function that can be used to access virtual
      guest memory by using the mmu_translate function of QEMU to convert
      the virtual addresses to physical.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 801cdd355f8bc578f1d02462a91313959e55bee7
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:30 2015 +0100

      s390x/kvm: Add function for injecting pgm access exceptions

      Program access exceptions are defined to deliver a translation exception
      code in the low-core. Add a function trigger_access_exception() that
      generates the proper program interrupt on both KVM and non-KVM systems
      and switch the existing code to use it.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 9d77309c9fedca33525cae820b9eff6f35c795f4
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:29 2015 +0100

      s390x/mmu: Clean up mmu_translate_asc()

      We can get rid of the switch(asc) in mmu_translate_asc() by simply
      selecting the right control register ASCE in the mmu_translate()
      function already.
      This patch is based on an original patch/idea by Ralf Hoppe.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit b4ecbf8071022a2042624baaff78cab2bf7e94af
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:28 2015 +0100

      s390x/mmu: Check bit 52 in page table entry

      Bit 52 in a page table entry has always to be zero, or a translation
      specification exception is to be recognized.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit ede59855785f1980be76d9d3b3a727954bfbc461
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:27 2015 +0100

      s390x/mmu: Renaming related to the ASCE confusion

      An Address Space Control Element (ASCE) is only the very first unit of
      an s390 address translation (normally residing in one of the control
      registers). The entries in the page tables are called differently.
      So let's call the relevant variable pt_entry instead of asce in
      mmu_translate_pte() to avoid future confusion (thus there is no
      functional change in this patch, just renaming).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 43d49b0115aef2ead5125d4aa9719852d47ef6fc
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:26 2015 +0100

      s390x/mmu: Add support for read-only regions

      If the "DAT-protection" bit is set in the region table entry and EDAT is
      enabled, only read accesses are allowed in the corresponding memory area.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5a123b3c1a1d3540d4455772c42c466870d81061
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:25 2015 +0100

      s390x/mmu: Fix the exception codes for illegal table entries

      Each different level of region/segment table has a dedicated
      exception type for illegal entries.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d267571be419d389184916b56f862a8f143e67c5
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:24 2015 +0100

      s390x/mmu: Fix exception types when checking the ASCEs

      If an ASCE has illegal bits set, an ASCE-type exception should be
      generated instead of a translation specification exception.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit bab58bf0921ef5da3c5c764920f152ac7c914c41
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:23 2015 +0100

      s390x/mmu: Fix translation exception code in lowcore

      The address space bits in the translation exception code were wrong.
      In fact, we can simply copy the bits from the PSW, so there's no need
      for the trans_bits() function anymore.
      Additionally, we now also set the fetch/store bits in the translation
      exception code, so a guest can determine whether the exception occured
      during a write or during a read.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3e09d87c6e69c2da684d5aacabe3124ebcb6f8e
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:22 2015 +0100

      s390x/mmu: Skip exceptions properly when translating addresses for debug

      When a fault occurs during the MMU lookup in s390_cpu_get_phys_page_debug(),
      the trigger_page_fault() function writes the translation exception code
      into the lowcore - something you would not expect during a memory access
      by the debugger. Ease this problem by adding an additional parameter to
      mmu_translate() which can be used to specify whether a program check and
      the translation exception code should be injected or not.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5d180439d07774c5a2477cf9901c9b51c9edd74b
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:21 2015 +0100

      s390x/mmu: Check table length and offset fields

      The ACSEs have a table length field and the region entries have
      table length and offset fields which must be checked during
      translation to see whether the given virtual address is really
      covered by the translation table.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f8f84e93ab6111848cfc83b3d6122573eb03bccf
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:20 2015 +0100

      s390x/mmu: Fix the handling of the table levels

      The current code used a wrong and very confusing way of dealing with
      the table levels by introducing a "fake level above current". However,
      the real problem was simply that the checks for the region/segment
      invalid bit and for the matching region/segment level was done at the
      wrong spot in the code - it has to be done after the first table entry
      has been looked up instead (e.g. there is also no "invalid" bit in the
      ASCE itself and the current "level" has to be the same as the level in
      the entry that we just looked up).
      Also the entries for the segment table are quite a bit different compared
      to the region table entries. So this patch moves the related code into the
      function mmu_translate_segment() to make it clear at which table level we
      currently are and to get rid of the ugly switch-statement in the function
      mmu_translate_region().

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 89a41e0a37f3c749f3038ac2544f74257bc7b94d
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:19 2015 +0100

      s390x/mmu: Fix the check for the real-space designation bit

      The real-space designation bits live in the ASCEs, not in the table entries,
      so the check must be done before we start walking the MMU table.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit dfebd7a7a9f8435fe5cd6c7d3901091db6322f99
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:18 2015 +0100

      s390x/mmu: Move mmu_translate() and friends to separate file

      helper.c is quite overcrowded already, so let's move the MMU
      translation to a separate file instead (like it has been done
      with the other targets already).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit ee17cbdc3c21f5cb6144a434191ffcd08b7de5fe
  Author: Michal Privoznik <mprivozn@redhat.com>
  Date:   Wed Jan 21 12:09:50 2015 +0100

      qemu-ga-win: Fail loudly on bare 'set-time'

      The command is not implemented correctly yet. The documentation allows
      to not pass any value to set, in which case the time is re-read from
      RTC. However, reading CMOS on Windows is not trivial to implement. So
      instead of pretending we've set the correct time, fail explicitly.

      Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0dd38a03f5e1498aabf7d053a9fab792a5eeec5c
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:06 2015 +0800

      qga: add memory block command that unsupported

      For memory block command, we only support for linux with sysfs.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit ef82b60be13b18198b84a2157f59c50fd53f5408
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:05 2015 +0800

      qga: implement qmp_guest_get_memory_block_info() for Linux with sysfs

      This conveys general information about guest memory blocks. Currently,
      just the memory block size.

      The size of a memory block is architecture dependent, it represents the logical
      unit upon which memory online/offline operations are to be performed.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *generalized guest-get-memory-block-size to get-get-memory-block-info
       for future extensibility

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 32ca7927c7d66371abafb4cabfab9438a5905784
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:04 2015 +0800

      qga: implement qmp_guest_set_memory_blocks() for Linux with sysfs

      We can change guest's online/offline state of memory blocks, by using
      command 'guest-set-memory-blocks'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit bd240fca42d5f072fb758a71720d9de9990ac553
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:03 2015 +0800

      qga: implement qmp_guest_get_memory_blocks() for Linux with sysfs

      We can get guest's memory block information by using command
      "guest-get-memory-blocks", the returned value contains a list of memory block
      info, such as phys-index, online state, can-offline info.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *replaced guest-triggerable assertion with an error msg

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a065aaa9204ecd4a0d18f5eae49aa350a5f76b63
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:02 2015 +0800

      qga: introduce three guest memory block commmands with stubs

      Introduce three new guest commands:
      guest-get-memory-blocks, guest-set-memory-blocks, guest-get-memory-block-size.

      With these three commands, we can support online/offline guest's memory block
      (logical memory hotplug/unplug) as required from host.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *generalized guest-get-memory-block-size to get-get-memory-block-info
       for future extensibility

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit fa193594fbc27fde7c9062b3bf5c232534887ec7
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Fri Feb 6 20:59:55 2015 +0300

      qga: implement file commands for Windows guest

      The following commands are implemented:
      - guest_file_open
      - guest_file_close
      - guest_file_write
      - guest_file_read
      - guest_file_seek
      - guest_file_flush

      Motivation is quite simple: Windows guests should be supported with the
      same set of features as Linux one. Also this patch is a prerequisite for
      Windows guest-exec command support.

      Signed-off-by: Olga Krishtal <okrishtal@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 85b6f6f53596fd29eee0a6d2475c6a4322eede6b
  Author: Simon Zolin <szolin@parallels.com>
  Date:   Fri Feb 6 20:59:54 2015 +0300

      guest agent: guest-file-open: refactoring

      Moved the code that sets non-blocking flag on fd into a separate function.

      Signed-off-by: Simon Zolin <szolin@parallels.com>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      CC: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 459db780be10f7adac723a5d3a4ffeac8ae6e768
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Fri Feb 6 20:59:53 2015 +0300

      utils: drop strtok_r from envlist_parse

      The problem is that mingw 4.9.1 fails to compile the code with the
      following warning:

      /mingw/include/string.h:88:9: note: previous declaration of 'strtok_r'
      was here
         char *strtok_r(char * __restrict__ _Str,
                        const char * __restrict__ _Delim,
                        char ** __restrict__ __last);
      /include/sysemu/os-win32.h:83:7: warning: redundant redeclaration of
         'strtok_r' [-Wredundant-decls]
         char *strtok_r(char *str, const char *delim, char **saveptr);

      The problem is that compiles just fine on previous versions of mingw.
      Compiler version check here is not a good idea. Though fortunately
      strtok_r is used only once in the code and we could simply rewrite
      the code without it.

      Signed-off-by: Olga Krishtal <okrishtal@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 215a2771a7b6b29037ee8deba484815d816b6fdd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Feb 11 11:26:12 2015 +0000

      qga: add guest-set-user-password command

      Add a new 'guest-set-user-password' command for changing the password
      of guest OS user accounts. This command is needed to enable OpenStack
      to support its API for changing the admin password of guests running
      on KVM/QEMU. It is not practical to provide a command at the QEMU
      level explicitly targetting administrator account password change
      only, since different guest OS have different names for the admin
      account. While UNIX systems use 'root', Windows systems typically
      use 'Administrator' and even that can be renamed. Higher level apps
      like OpenStack have the ability to figure out the correct admin
      account name since they have info that QEMU/libvirt do not.

      The command accepts either the clear text password string, encoded
      in base64 to make it 8-bit safe in JSON:

      $ echo -n "123456" | base64
      MTIzNDU2
      $ virsh -c qemu:///system  qemu-agent-command f21x86_64 \
         '{ "execute": "guest-set-user-password",
            "arguments": { "crypted": false,
                           "username": "root",
                           "password": "MTIzNDU2" } }'
        {"return":{}}

      Or a password that has already been run though a crypt(3) like
      algorithm appropriate for the guest, again then base64 encoded:

      $ echo -n '$6$n01A2Tau$e...snip...DfMOP7of9AJ1I8q0' | base64
      JDYkb...snip...YT2Ey
      $ virsh -c qemu:///system  qemu-agent-command f21x86_64 \
         '{ "execute": "guest-set-user-password",
            "arguments": { "crypted": true,
                           "username": "root",
                           "password": "JDYkb...snip...YT2Ey" } }'

      NB windows support is desirable, but not implemented in this
      patch.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0dc3f44aca18b1be8b425f3f4feb4b3e8d68de2e
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu Sep 5 14:41:35 2013 -0400

      Convert ram_list to RCU

      Allow "unlocked" reads of the ram_list by using an RCU-enabled QLIST.

      The ramlist mutex is kept.  call_rcu callbacks are run with the iothread
      lock taken, but that may change in the future.  Writers still take the
      ramlist mutex, but they no longer need to assume that the iothread lock
      is taken.

      Readers of the list, instead, no longer require either the iothread
      or ramlist mutex, but they need to use rcu_read_lock() and
      rcu_read_unlock().

      One place in arch_init.c was downgrading from write side to read side
      like this:

          qemu_mutex_lock_iothread()
          qemu_mutex_lock_ramlist()
          ...
          qemu_mutex_unlock_iothread()
          ...
          qemu_mutex_unlock_ramlist()

      and the equivalent idiom is:

          qemu_mutex_lock_ramlist()
          rcu_read_lock()
          ...
          qemu_mutex_unlock_ramlist()
          ...
          rcu_read_unlock()

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0d53d9fe8a0dcb849bc7c9836e9e6a287f9aa787
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Wed Jan 21 13:45:24 2015 +0100

      exec: convert ram_list to QLIST

      QLIST has RCU-friendly primitives, so switch to it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae3a7047d00cfa7ed221beda08f98487b7e17501
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu Sep 5 14:41:35 2013 -0400

      cosmetic changes preparing for the following patches

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43771539d4666cba16298fc6b0ea63867425277c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Sep 9 17:58:40 2013 +0200

      exec: protect mru_block with RCU

      Hence, freeing a RAMBlock has to be switched to call_rcu.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 439c5e02d59659876e1a2cf019c55e419adab195
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:00:12 2015 +0100

      rcu: add g_free_rcu

      This simplifies calling g_free from an RCU callback.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 341774fe6ccdc0fe42fb79a4ed642e78237da428
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Tue Aug 27 11:38:45 2013 -0400

      rcu: introduce RCU-enabled QLIST

      Add RCU-enabled variants on the existing bsd DQ facility. Each
      operation has the same interface as the existing (non-RCU)
      version. Also, each operation is implemented as macro.

      Using the RCU-enabled QLIST, existing QLIST users will be able to
      convert to RCU without using a different list interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 79e2b9aeccedbfde762b05da662132c7fda292be
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 21 12:09:14 2015 +0100

      exec: RCUify AddressSpaceDispatch

      Note that even after this patch, most callers of address_space_*
      functions must still be under the big QEMU lock, otherwise the memory
      region returned by address_space_translate can disappear as soon as
      address_space_translate returns.  This will be fixed in the next part
      of this series.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d82b5a792236db31a75b9db5c93af69ac07c7c5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Aug 16 08:26:30 2013 +0200

      exec: make iotlb RCU-friendly

      After the previous patch, TLBs will be flushed on every change to
      the memory mapping.  This patch augments that with synchronization
      of the MemoryRegionSections referred to in the iotlb array.

      With this change, it is guaranteed that iotlb_to_region will access
      the correct memory map, even once the TLB will be accessed outside
      the BQL.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 76e5c76f2e2e0d20bab2cd5c7a87452f711654fb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 15 12:46:47 2015 +0100

      exec: introduce cpu_reload_memory_map

      This for now is a simple TLB flush.  This can change later for two
      reasons:

      1) an AddressSpaceDispatch will be cached in the CPUState object

      2) it will not be possible to do tlb_flush once the TCG-generated code
      runs outside the BQL.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8b5c216025c312ab01542c4595393e0fdcbed015
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 13 13:42:03 2015 +0100

      docs: clarify memory region lifecycle

      Now that objects actually obey the rules, document them.

      Reviewed-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5cd5e7015962d8d559afb5154888fd34a8526ddd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Feb 12 21:39:20 2015 +0100

      pci: split shpc_cleanup and shpc_free

      object_unparent should not be called until the parent device is going to be
      destroyed.  Only remove the capability and do memory_region_del_subregion
      at unrealize time.  Freeing the data structures is left in shpc_free, to
      be called from the instance_finalize callback.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a8f2a9ce51036ab2d25bcc31114b5cbb72ab44b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 11:18:58 2015 +0100

      pcie: remove mmconfig memory leak and wrap mmconfig update with transaction

      This memory leak was introduced inadvertently by omitting object_unparent.
      A better fix is to use the new memory_region_set_size instead of destroying
      and recreating the MMIO region on the fly.

      Also, ensure that unmapping and remapping the region is done atomically.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c4bacafb717de55538311b80a185ce9166b8daa2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:01 2015 +0100

      qdev: Improve qdev_init_nofail()'s error reporting

      We get two error messages: a specific one from qdev_init(), and a
      generic one from qdev_init_nofail().  The specific one gets suppressed
      in QMP context.  qdev_init_nofail() failing there is a bug, though.

      Cut out the qdev_init() middle-man: realize the device, and on error
      exit with a single error message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b9c649470ba0d4056b2d486105a0f8fb982654ae
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:25 2015 -0500

      block: Keep bdrv_check*_request()'s return value

      Do not throw away the value returned by bdrv_check_request() and
      bdrv_check_byte_request().

      Fix up some coding style issues in the proximity of the affected hunks.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-17-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c0191e763b2f77cc5311d3aa6e487f3fe8a4c96f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:24 2015 -0500

      block: Remove "growable" from BDS

      Now that request clamping is done in the BlockBackend, the "growable"
      field can be removed from the BlockDriverState. All BDSs are now treated
      as being "growable" (that is, they are allowed to grow; they are not
      necessarily actually able to).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-16-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e7f7d676c1397291ef7d2892f86045d79ee1a1ec
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:23 2015 -0500

      block: Clamp BlockBackend requests

      BlockBackend is used as the interface between the block layer and guest
      devices. It should therefore assure that all requests are clamped to the
      image size.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-15-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4c7b7e9b94b4e81aa85de7c13e209017fc7f61dc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:22 2015 -0500

      qemu-io: Use BlockBackend

      qemu-io should behave like a guest, therefore it should use BlockBackend
      to access the block layer.

      There are a couple of places where that is infeasible: First, the
      bdrv_debug_* functions could theoretically be mirrored in the
      BlockBackend, but since these are functions internal to the block layer,
      they should not be visible externally (qemu-io as a test tool is exempt
      from this).

      Second, bdrv_get_info() and bdrv_get_specific_info() work on a single
      BDS alone, therefore they should stay BDS-specific.

      Third, bdrv_is_allocated() mainly works on a single BDS as well. Some
      data may be passed through from the BDS's file (if sectors which are
      apparently allocated in the file are not really allocated there but just
      zero).

      [Fixed conflicts around block_acct_start() usage from Fam Zheng's
      "qemu-io: Account IO by aio_read and aio_write" commit.  Use
      BlockBackend and blk_get_stats() instead of BlockDriverState.
      --Stefan]

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-14-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 10d9d75ce4cfb568b4845d8c4d0e65968f740edf
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:21 2015 -0500

      qemu-io: Remove "growable" option

      Remove "growable" option from the "open" command and from the qemu-io
      command line. qemu-io is about to be converted to BlockBackend which
      will make sure that no request exceeds the image size, so the only way
      to keep "growable" would be to use BlockBackend if it is not given and
      to directly access the BDS if it is.

      qemu-io is a debugging tool, therefore removing a rarely used option
      will have only a very small impact, if any. There was only one
      qemu-iotest which used the option; since it is not critical, this patch
      just removes it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-13-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1b58b43802a0158d74f4ea7e52f852363e63fe2f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:20 2015 -0500

      qemu-io: Use blk_new_open() in openfile()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-12-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4fbec260aec4cda50f399377b18c844113751146
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:19 2015 -0500

      qemu-nbd: Use blk_new_open() in main()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-11-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f1d3cd792b93a7f4446517213b02c6f050a47e9d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:18 2015 -0500

      qemu-img: Use BlockBackend as far as possible

      Although qemu-img already creates BlockBackends, it does not do accesses
      to the images through them. This patch converts all of the bdrv_* calls
      for which this is currently possible to blk_* calls. Most of the
      remaining calls will probably stay bdrv_* calls because they really do
      operate on the BDS level instead of the BB level.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-10-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 644483d97e6f7a740b5a82156fe32944573a0ed1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:17 2015 -0500

      qemu-img: Use blk_new_open() in img_rebase()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-9-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5bd313266bc5874dae9833be95e5dcfce787f1b7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:16 2015 -0500

      qemu-img: Use blk_new_open() in img_open()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-8-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a925356e3a109c412240721890c1e6c1a86d286
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:15 2015 -0500

      block/xen: Use blk_new_open() in blk_connect()

      As part of the required changes, this fixes a bug where specifying an
      invalid driver would result in the block layer probing the image format;
      now it will result in an error, unless "<unset>" is specified as the
      driver name. Fixing this would require further work on the xen_disk code
      which does not seem worth it (at this point and for this patch).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-7-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4342ce5a2bc7742c7193d1a3291ae513ca4857a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:14 2015 -0500

      blockdev: Use blk_new_open() in blockdev_init()

      Due to different error propagation, this breaks tests 051 and 087; fix
      their output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-6-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80495fdf44ff7e44bafe9f4d8367700a197f1106
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:13 2015 -0500

      iotests: Add test for driver=qcow2, format=qcow2

      While specifying a different driver and format is obviously invalid,
      specifying the same driver once through driver and once through format
      is invalid as well. Add a test for it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-5-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b65a5e12a4136b20f9d06675d597b52d64ac903c
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:12 2015 -0500

      block: Add Error parameter to bdrv_find_protocol()

      The argument given to bdrv_find_protocol() is just a file name, which
      makes it difficult for the caller to reconstruct what protocol
      bdrv_find_protocol() was hoping to find. This patch adds an Error
      parameter to that function to solve this issue.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca49a4fdb39d7b00b20e8500cba11aedc87755bd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:11 2015 -0500

      block: Add blk_new_open()

      blk_new_with_bs() creates a BlockBackend with an empty BlockDriverState
      attached to it. Empty BDSs are not nice, therefore add an alternative
      function which combines blk_new_with_bs() with bdrv_open().

      Note: In contrast to bdrv_open() which takes a BlockDriver parameter,
      blk_new_open() does not take such a parameter. This is because
      bdrv_open() opens a BlockDriverState, therefore it is natural to be able
      to set the BlockDriver for that BDS. The fact that bdrv_open() can open
      more than a single BDS is merely some form of a byproduct.

      blk_new_open() on the other hand is intended to be used to create a
      whole tree of BlockDriverStates. Therefore, setting a single BlockDriver
      does not make much sense. Instead, the drivers to be used for each of
      the nodes must be configured through the "options" QDict; including the
      driver of the root BDS.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ef01253eb90d0c69129c817e85fa92f9d45602a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:10 2015 -0500

      block: Lift some BDS functions to the BlockBackend

      Create the blk_* counterparts for the following bdrv_* functions (which
      make sense to call on the BlockBackend level):
      - bdrv_co_write_zeroes()
      - bdrv_write_compressed()
      - bdrv_truncate()
      - bdrv_nb_sectors()
      - bdrv_discard()
      - bdrv_load_vmstate()
      - bdrv_save_vmstate()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 723bfab5cb229436ab31498a19aed931723cd3be
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 11 09:58:47 2015 -0500

      iotests: Add test for qemu-img convert to NBD

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423666727-20777-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2e024cde1f632d7098f5da742e54186156c6aca9
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 11 09:58:46 2015 -0500

      qemu-img: Fix qemu-img convert -n

      If -n is specified, it does not matter whether the output format and
      protocol support image creation; building the creation options should
      simply be skipped.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423666727-20777-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fb13bbf2fd5292d0aab617709017a4032f328730
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:46 2015 +0800

      qemu-iotests: Add 093 for IO throttling

      This case utilizes qemu-io command "aio_{read,write} -q" to verify the
      effectiveness of IO throttling options.

      It's implemented by driving the vm timer from qtest protocol, so the
      throttling timers are signaled with determinied time duration. Then we
      verify the completed IO requests are within 10% error of bps and iops
      limits.

      "null" protocol is used as the disk backend so that no actual disk IO is
      performed on host, this will make the blockstats much more
      deterministic. Both "null-aio" and "null-co" are covered, which is also
      a simple cross validation test for the driver code.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit df89d112279779609d50db93b024ed71f0402854
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:45 2015 +0800

      qemu-iotests: Allow caller to disable underscore convertion for qmp

      QMP command "block_set_io_throttle" expects underscores in parameters
      instead of dashes: {iops,bps}_{rd,wr,max}.

      Add optional argument conv_keys (defaults to True, backward compatible),
      it will be used in IO throttling test case.

      Reviewed-by: Benoit Canet <benoit@irqsave.net>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ed338bb07504091dbf36d9cc741e8363f1962a74
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:44 2015 +0800

      qemu-iotests: Add VM method qtest() to iotests.py

      This will allow test cases to run command in qtest protocol. It's
      write-only for now.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a628daa42db50a3fc1203dd81bba5a2879b76656
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:43 2015 +0800

      qtest: Add scripts/qtest.py

      This adds scripts/qtest.py as a python library for qtest protocol.

      This is a skeleton with a basic "cmd" method to execute a command,
      reading and parsing of qtest output could be added later on demand.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a91f9584565901635295b08f98d5f3048981c2f5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:42 2015 +0800

      qemu-io: Account IO by aio_read and aio_write

      This will enable accounting of aio requests issued from qemu-io aio
      read/write commands.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit efef88b3d9ad4325172ed288032807fa88d683cc
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jan 19 17:51:43 2015 +0800

      qtest: Fix deadloop by running main loop AIO context's timers

      qemu_clock_run_timers() only takes care of main_loop_tlg, we shouldn't
      forget aio timer list groups.

      Currently, the qemu_clock_deadline_ns_all (a few lines above) counts all
      the timergroups of this clock type, including aio tlg, but we don't fire
      them, so they are never cleared, which makes a dead loop.

      For example, this function hangs when trying to drive throttled block
      request queue with qtest clock_step.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421661103-29153-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a7be17bee855f26c317e99aa6582e1dc9b8ebd71
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Feb 10 13:22:56 2015 -0500

      block: vmdk - fixed sizeof() error

      The size compared should be PATH_MAX, rather than sizeof(char *).

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 46d873261433f4527e88885582f96942d61758d6.1423592487.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5d80448c3fc566e505adfa2b566ec8074442c8e1
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 14:25:02 2015 +0100

      savevm: Improve error message for blocked migration

      If an internal snapshot can't be saved because migration is blocked
      (most commonly probably because of AHCI), we had a really bad error
      message:

      $ echo -e "savevm foo\nquit" | qemu -M q35 /tmp/test.qcow2 -monitor stdio
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) savevm foo
      Error -22 while writing VM
      (qemu) quit

      This patch converts qemu_savevm_state() to the Error infrastructure so
      that a useful error pointing to the problematic device is produced now:

      $ echo -e "savevm foo\nquit" | qemu -M q35 /tmp/test.qcow2 -monitor stdio
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) savevm foo
      State blocked by non-migratable device '0000:00:1f.2/ich9_ahci'
      (qemu) quit

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423574702-23072-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 141cabe6f144a1acb128186caf686f8fbde0a7e4
  Author: Bin Wu <wu.wubin@huawei.com>
  Date:   Tue Feb 10 15:20:46 2015 +0800

      nbd: fix the co_queue multi-adding bug

      When we tested the VM migartion between different hosts with NBD
      devices, we found if we sent a cancel command after the drive_mirror
      was just started, a coroutine re-enter error would occur. The stack
      was as follow:

      (gdb) bt
      00)  0x00007fdfc744d885 in raise () from /lib64/libc.so.6
      01)  0x00007fdfc744ee61 in abort () from /lib64/libc.so.6
      02)  0x00007fdfca467cc5 in qemu_coroutine_enter (co=0x7fdfcaedb400, opaque=0x0)
      at qemu-coroutine.c:118
      03)  0x00007fdfca467f6c in qemu_co_queue_run_restart (co=0x7fdfcaedb400) at
      qemu-coroutine-lock.c:59
      04)  0x00007fdfca467be5 in coroutine_swap (from=0x7fdfcaf3c4e8,
      to=0x7fdfcaedb400) at qemu-coroutine.c:96
      05)  0x00007fdfca467cea in qemu_coroutine_enter (co=0x7fdfcaedb400, opaque=0x0)
      at qemu-coroutine.c:123
      06)  0x00007fdfca467f6c in qemu_co_queue_run_restart (co=0x7fdfcaedbdc0) at
      qemu-coroutine-lock.c:59
      07)  0x00007fdfca467be5 in coroutine_swap (from=0x7fdfcaf3c4e8,
      to=0x7fdfcaedbdc0) at qemu-coroutine.c:96
      08)  0x00007fdfca467cea in qemu_coroutine_enter (co=0x7fdfcaedbdc0, opaque=0x0)
      at qemu-coroutine.c:123
      09)  0x00007fdfca4a1fa4 in nbd_recv_coroutines_enter_all (s=0x7fdfcaef7dd0) at
      block/nbd-client.c:41
      10) 0x00007fdfca4a1ff9 in nbd_teardown_connection (client=0x7fdfcaef7dd0) at
      block/nbd-client.c:50
      11) 0x00007fdfca4a20f0 in nbd_reply_ready (opaque=0x7fdfcaef7dd0) at
      block/nbd-client.c:92
      12) 0x00007fdfca45ed80 in aio_dispatch (ctx=0x7fdfcae15e90) at aio-posix.c:144
      13) 0x00007fdfca45ef1b in aio_poll (ctx=0x7fdfcae15e90, blocking=false) at
      aio-posix.c:222
      14) 0x00007fdfca448c34 in aio_ctx_dispatch (source=0x7fdfcae15e90, callback=0x0,
      user_data=0x0) at async.c:212
      15) 0x00007fdfc8f2f69a in g_main_context_dispatch () from
      /usr/lib64/libglib-2.0.so.0
      16) 0x00007fdfca45c391 in glib_pollfds_poll () at main-loop.c:190
      17) 0x00007fdfca45c489 in os_host_main_loop_wait (timeout=1483677098) at
      main-loop.c:235
      18) 0x00007fdfca45c57b in main_loop_wait (nonblocking=0) at main-loop.c:484
      19) 0x00007fdfca25f403 in main_loop () at vl.c:2249
      20) 0x00007fdfca266fc2 in main (argc=42, argv=0x7ffff517d638,
      envp=0x7ffff517d790) at vl.c:4814

      We find the nbd_recv_coroutines_enter_all function (triggered by a cancel
      command or a network connection breaking down) will enter a coroutine which
      is waiting for the sending lock. If the lock is still held by another coroutine,
      the entering coroutine will be added into the co_queue again. Latter, when the
      lock is released, a coroutine re-enter error will occur.

      This bug can be fixed simply by delaying the setting of recv_coroutine as
      suggested by paolo. After applying this patch, we have tested the cancel
      operation in mirror phase looply for more than 5 hous and everything is fine.
      Without this patch, a coroutine re-enter error will occur in 5 minutes.

      Signed-off-by: Bn Wu <wu.wubin@huawei.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423552846-3896-1-git-send-email-wu.wubin@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 81705ee4850b55ef4879c941e4a7703efd3cb760
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:30 2015 -0500

      qtest/ahci: Adding simple dma read-write test

      Adds a test case for AHCI wherein we write a 4K
      block of a changing pattern to sector 0, then
      read back that 4K and compare the transmit and
      receive buffers.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-20-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 122482a398db9f02287efce9eec26e08dac82bcd
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:29 2015 -0500

      qtest/ahci: Assert sector size in identify test

      A minor sanity check to assert that the sector size is 512.
      The current block layer code deeply assumes that the IDE
      sector size will be 512 bytes, so we carry forward that assumption
      here.

      This is useful for the DMA tests, which currently assume that
      a sector will always be 512 bytes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-19-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 259342d34dbdfb304374f569feec26317edd97c9
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:28 2015 -0500

      libqos/ahci: Add ahci_clean_mem

      Clean up guest memory being used in ahci_clean_mem, to be
      called during ahci_shutdown. With all guest memory leaks removed,
      add an option to the allocator to throw an assertion if a leak
      occurs.

      This test adds some sanity to both the AHCI library and the
      allocator.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ae029620173239f3643925299790ecc5e1d72db1
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:27 2015 -0500

      libqos/ahci: add ahci_io

      ahci_io is a wrapper around ahci_guest_io that takes a pointer to host
      memory instead, and will create a guest memory buffer and copy the data
      to/from as needed and as appropriate for a read/write command, such that
      after a read, the guest data will be in a host buffer, and for a write,
      the data will be transmitted to guest memory prior to the block operation.

      Now that we have all the syntactic sugar functions in place for AHCI,
      we can convert the identify test to be very, very short.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 113221956cb819837dda5350e3f9d52819183805
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:26 2015 -0500

      libqos/ahci: Add ahci_guest_io

      ahci_guest_io is a shorthand function that will, in one shot,
      execute a data command on the guest to the specified guest buffer
      location, in the requested amount.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit cbc97569dcce317f7bb32d766d4dfcbeb7fd3013
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:25 2015 -0500

      libqos/ahci: add ahci command size setters

      Adds setters for size, prd_size and both via set_sizes.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ea41deb6022c1468de094dac12610de74220e4b0
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:24 2015 -0500

      libqos/ahci: add ahci command verify

      Helps to verify that a command completed successfully.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 64a5a272e31c99cfb348f908d71c98d2eb83ba28
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:23 2015 -0500

      libqos/ahci: add ahci command functions

      This patch adds the AHCICommand structure, and a set of functions to
      operate on the structure.

      ahci_command_create - Initialize and create a new AHCICommand in memory
      ahci_command_free - Destroy this object.
      ahci_command_set_buffer - Set where the guest memory DMA buffer is.
      ahci_command_commit - Write this command to the AHCI HBA.
      ahci_command_issue - Issue the committed command synchronously.
      ahci_command_issue_async - Issue the committed command asynchronously.
      ahci_command_wait - Wait for an asynchronous command to finish.
      ahci_command_slot - Get the number of the command slot we committed to.

      Helpers:
      size_to_prdtl       - Calculate the required minimum PRDTL size from
                            a buffer size.
      ahci_command_find   - Given an ATA command mnemonic, look it up in the
                            properties table to obtain info about the command.
      command_header_init - Initialize the command header with sane values.
      command_table_init  - Initialize the command table with sane values.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      warning:

        tests/libqos/ahci.c:598:3: warning: redefinition
        of typedef 'AHCICommand' is a C11 feature
            [-Wtypedef-redefinition]
        } AHCICommand;

      I have replaced typedef struct ... AHCICommand; with struct ... ;
      --Stefan]

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 716b64079ceaa6fede724f8a24a24b0209fa5173
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:22 2015 -0500

      libqos/ahci: Add ide cmd properties

      Add a structure that defines some properties of various IDE commands.
      These will be used to simplify the interface to the libqos AHCI calls,
      lessening the redundancy of specifying and respecifying properties of
      commands to various helper functions.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 52515766f1e18b596a6dc31421ca14a63114c9eb
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:21 2015 -0500

      qtest/ahci: add ahci_write_fis

      Similar to ahci_set_command_header, add a helper that takes an
      in-memory representation of a command FIS and writes it to guest
      memory, handling endianness as-needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1423158090-25580-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 36e367261c15f0fa9acfbe9f4301c96e19be7f52
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:20 2015 -0500

      qtest/ahci: Demagic ahci tests.

      Add human-readable command names and other miscellaneous #defines
      to help make the code more readable.

      Some of these definitions are not yet used in this current series,
      but for convenience and sanity they have been lumped together here,
      as it's more trouble than it is worth in a test suite to hand-pick,
      one-by-one, which preprocessor definitions are useful per-each test.

      These definitions include:

      ATA Command Mnemonics
      Current expected AHCI sector size
      FIS magic bytes
      REG_H2D_FIS flags
      Command Header flags

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1ef883894f0661f9994bc937ba09077a32a8bee
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:19 2015 -0500

      libqos/ahci: Add cmd response sanity check helpers

      This patch adds a few helpers to help sanity-check the response of the
      AHCI device after a command.

      ahci_d2h_check_sanity inspects the D2H Register FIS,
      ahci_pio_check_sanity inspects the PIO Setup FIS, and
      ahci_cmd_check_sanity inspects the command header.

      To support the PIO sanity check, a new structure is added for the
      PIO Setup FIS type. Existing FIS types (H2D and D2H) have had their
      members renamed slightly to condense reserved members into fewer
      fields; and LBA fields are now represented by arrays of 8 byte chunks
      instead of independent variables.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 89a46723668a35db3eac5cb59b32ba67948dee0d
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:18 2015 -0500

      libqos/ahci: Add port_check_nonbusy helper

      A simple helper that asserts a given port is not busy processing any
      commands via the TFD, Command Issue and SACT registers.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5bf99aa1cf67a210dd441ae4edf1e26df05360d5
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:17 2015 -0500

      libqos/ahci: Add ahci_port_check_interrupts helper

      A helper that compares a given port's current interrupts and checks them
      against a supplied list of expected interrupt bits, and throws an error
      if they do not match.

      The helper then resets the requested interrupts on this port, and asserts
      that the interrupt register is now empty.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 85c34e9395a97e49def6697537417ead2077c096
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:16 2015 -0500

      libqos/ahci: Add ahci_port_check_error helper

      ahci_port_check_error checks a given port's error registers and asserts
      that everything from the port-level view is still OK.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6cae27a6af159ab44f7c265d7f22d9e95880db25
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:15 2015 -0500

      libqos/ahci: Add command header helpers

      Adds command header helper functions:
      -ahci_command_header_set
      -ahci_command_header_get,
      -ahci_command_destroy, and
      -ahci_cmd_pick

      These helpers help to quickly manage the command header information in
      the AHCI device.

      ahci_command_header_set and get will store or retrieve an AHCI command
      header, respectively.

      ahci_cmd_pick chooses the first available but least recently used
      command slot to allow us to cycle through the available command slots.

      ahci_command_destroy obliterates all information contained within a
      given slot's command header, and frees its associated command table,
      but not its DMA buffer!

      Lastly, the command table pointer fields (dba and dbau) are merged into
      a single 64bit value to make managing 64bit tests simpler.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1423158090-25580-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c7f9c570b908a844aee393d93d01c332aea2a5a5
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:14 2015 -0500

      qtest/ahci: rename 'Command' to 'CommandHeader'

      The structure name is a bit of a misnomer; the structure currently named
      command is actually the commandheader. A future patch in this series
      will add an actual "Command" structure, so we'll rename it now before the
      rest of the functions in this series try to use it.

      In addition, rename the "b1" and "b2" fields
      to be a unified uint16_t named "flags."

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e83fd96bfab90298beaa8c8a31e48a905564180e
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:13 2015 -0500

      libqos/ahci: Add ahci_port_clear helper

      Add a helper that assists in clearing out potentially old error and FIS
      information from an AHCI port's data structures. This ensures we always
      start with a blank slate for interrupt and FIS receipt information.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e77448a385dc72fa671752ec11c84c931f316d09
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:12 2015 -0500

      libqos/ahci: Add ahci_port_select helper

      This helper identifies which port of the
      AHCI HBA has a device we may run tests on.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0e5d90ebc3edb5cfc1d5d33dd3334482dee6d46
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Jan 26 17:26:42 2015 +0100

      dataplane: endianness-aware accesses

      The vring.c code currently assumes that guest and host endianness match,
      which is not true for a number of cases:

      - emulating targets with a different endianness than the host
      - bi-endian targets, where the correct endianness depends on the virtio
        device
      - upcoming support for the virtio-1 standard mandates little-endian
        accesses even for big-endian targets and hosts

      Make sure to use accessors that depend on the virtio device.

      Note that dataplane now needs to be built per-target.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Fam Zheng <famz@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1422289602-17874-2-git-send-email-cornelia.huck@de.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a75b0a037e3a8030992244353f17b62f6daf2ab
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:03 2015 -0500

      libqos/ahci: create libqos/ahci.c

      With global state removed, code responsible for booting up,
      verifying, and initializing the AHCI HBA is extracted and
      inserted into libqos/ahci.c, which would allow for other
      qtests in the future to quickly grab a meaningfully initialized
      reference to an AHCI HBA.

      Even without other users, functionalizing and isolating the code
      assists future AHCI tests that exercise Q35 migration.

      For now, libqos/ahci.o will be PC-only, but can be expanded into
      something arch-agnostic in the future, if needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f3dd2da4cc8c17921cb50920600adafb02959abf
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:02 2015 -0500

      qtest/ahci: Bookmark FB and CLB pointers

      Instead of re-querying the AHCI device for the FB and CLB buffers, save
      the pointer we gave to the device during initialization and reference
      these values instead.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      compiler warnings:

        tests/libqos/ahci.c:256:40: warning: format specifies type 'unsigned
            long' but the argument has type 'uint64_t'
            (aka 'unsigned long long') [-Wformat]
              g_test_message("CLB: 0x%08lx", ahci->port[i].clb);
        tests/libqos/ahci.c:264:39: warning: format specifies type 'unsigned
            long' but the argument has type 'uint64_t'
            (aka 'unsigned long long') [-Wformat]
              g_test_message("FB: 0x%08lx", ahci->port[i].fb);

      The commit moved from uint32_t to uint64_t, so PRIx64 should be used for
      the format specifier.
      --Stefan]

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1a8bba4ddce44cff33bfd3d4976fb33923c06a1b
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:01 2015 -0500

      qtest/ahci: remove getter/setter macros

      These macros were a bad idea: They relied upon certain arguments being
      present locally with a specific name.

      With the endgoal being to factor out AHCI helper functions outside of
      the test file itself, these have to be replaced by more explicit helper
      setter/getter functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4882f359493cd02d7a5caa7b85d2e1bc4b2f8177
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:00 2015 -0500

      libqos/ahci: Functional register helpers

      Introduce a set of "static inline" register helpers that are intended to
      replace the current set of macros with more functional versions that are
      better suited to inclusion in libqos than porcelain macros.

      As a stopgap measure before eliminating the porcelain macros, define them
      to use the new functions defined in the ahci.h header.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c12e8293b8ed29d98f9ef563e997c9de8ff10e23
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:59 2015 -0500

      qtest/ahci: remove guest_malloc global

      Make helper routines rely on the earmarked
      guest allocator object with AHCIQState/QOSSTate instead.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7f410456652463db7312bc839d45396bf48a849e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:58 2015 -0500

      qtest/ahci: remove pcibus global

      Rely on the PCI Device's bus pointer instead.
      One less global to worry about.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8d5eeceddcb6464c7db3b4504c14766453db091e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:57 2015 -0500

      qtest/ahci: finalize AHCIQState consolidation

      Move barsize, ahci_fingerprint and capabilities registers into
      the AHCIQState object, removing global ahci-related state
      from the ahci-test.c file.

      More churn, less globals.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6100ddb0f9776555b581455be4707f2077eee42f
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:56 2015 -0500

      qtest/ahci: Store hba_base in AHCIQState

      Store the HBA memory base address in the new state object, to simplify
      function prototypes and encourage a more functional testing style.

      This causes a lot of churn, but this patch is as "simplified" as I could
      get it to be. This patch is therefore fairly mechanical and straightforward:
      Any case where we pass "hba_base" has been consolidated into the AHCIQState
      object and we pass the one unified parameter.

      Any case where we reference "ahci" and "hba_state" have been modified to use
      "ahci->dev" for the PCIDevice and "ahci->hba_state" to get at the base memory
      address, accordingly.

      Notes:

       - A needless return is removed from start_ahci_device.

       - For ease of reviewing, this patch can be reproduced (mostly) by:
         # Replace (ahci, hba_base) prototypes with unified parameter
         's/(QPCIDevice \*ahci, void \*\?\*hba_base/(AHCIQState *ahci/'

         # Replace (ahci->dev, hba_base) calls with unified parameter
         's/(ahci->dev, &\?hba_base)/(ahci)/'

         # Replace calls to PCI config space using "ahci" with "ahci->dev"
         's/qpci_config_\(read\|write\)\(.\)(ahci,/qpci_config_\1\2(ahci->dev,/'

         After these, the remaining differences are easy to review by hand.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 90e5add6f2fa0b0bd9a4c1d5a4de2304b5f3e466
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:55 2015 -0500

      libqos: add pc specific interface

      Create an operations structure so that the libqos interface can be
      architecture agnostic, and create a pc-specific interface to functions
      like qtest_boot.

      Move the libqos object in the Makefile from being ahci-test only to
      being linked with all tests that utilize the libqos features.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f6f363c1f4f962aee9f69c67ab2f3ff58c30f8c1
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:54 2015 -0500

      libqos: Update QGuestAllocator to be opaque

      To avoid the architecture-specific implementations of the generic qtest
      allocator having to know about fields within the allocator, add a
      page_size setter method for users or arch specializations to use.
      The allocator will assume a default page_size for general use, but it
      can always be overridden.

      Since this was the last instance of code directly using properties of the
      QGuestAllocator object directly, modify the type to be opaque and move
      the structure inside of malloc.c.

      mlist_new, which was previously exported, is made static local to malloc.c,
      as it has no external users.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      warning:
        tests/libqos/malloc.c:35:3: warning:
        redefinition of typedef 'QGuestAllocator' is a C11 feature
              [-Wtypedef-redefinition]
        } QGuestAllocator;

      I converted typedef struct ... QGuestAllocator; to struct ...;
      --Stefan]

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Message-id: 1421698563-6977-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fa02e6084f727191e15fc6b2d1328c4fae874741
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:53 2015 -0500

      libqos: add alloc_init_flags

      Allow a generic interface to alloc_init_flags,
      not just through pc_alloc_init_flags.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f1518d1192a1a9387f881919897fbb0101ad3426
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:52 2015 -0500

      libqos: add qtest_vboot

      Add a va_list variant of the qtest_boot function.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd0029c0f44d5121c64a02d3aa0440283fb72fcd
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:51 2015 -0500

      libqos: create libqos.c

      The intent of this file is to serve as a misc. utilities file to be
      shared amongst tests that are utilizing libqos facilities.

      In a later patch, migration test helpers will be added to libqos.c that
      will allow simplified testing of migration cases where libqos is
      "Just Enough OS" for migrations testing.

      The addition of the AHCIQState structure will also allow us to eliminate
      global variables inside of qtests to manage allocators and test instances
      in a better, more functional way.

      libqos.c:
              - Add qtest_boot
              - Add qtest_shutdown

      libqos.h:
              - Create QOSState structure for allocator and QTestState.

      ahci-test.c:
              - Move qtest_boot and qtest_shutdown to libqos.c/h
              - Create AHCIQState to interface with new qtest_boot/shutdown prototypes
              - Modify tests slightly to use new types.

      For now, the new object file is only linked to ahci-test, because it still
      relies on pc architecture specific code in libqos. The next two patches will
      reorganize the code to be more general.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 90fc5e097534765f30b11e34cc00aa6c6629e3ea
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:50 2015 -0500

      qtest/ahci: Create ahci.h

      Extract defines and other information to ahci.h, to be shared with other
      tests if they so please.

      At the very least, reduce clutter in the test file itself.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit af77f2cd7af1fa65a414c86767366bae95892e69
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:49 2015 -0500

      libqos: Split apart pc_alloc_init

      Move the list-specific initialization over into
      malloc.c, to keep all of the list implementation
      details within the same file.

      The allocation and freeing of these structures are
      now both back within the same layer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 21c7f3f74959f18c5feb9b44511cb1a965c25a36
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:18 2015 -0500

      iotests: Add test for drive-mirror with NBD target

      When the drive-mirror block job is completed, it will call bdrv_swap()
      on the source and the target BDS; this should obviously not result in a
      segmentation fault.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ea82aa42835e3f56b3649c92764ac40552aac789
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:17 2015 -0500

      iotests: Add "wait" functionality to _cleanup_qemu

      The qemu process does not always need to be killed, just waiting for it
      can be fine, too. This introduces a way to do so.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f53a829bb9ef14be800556cbc02d8b20fc1050a7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:16 2015 -0500

      nbd: Drop BDS backpointer

      Before this patch, the "opaque" pointer in an NBD BDS points to a
      BDRVNBDState, which contains an NbdClientSession object, which in turn
      contains a pointer to the BDS. This pointer may become invalid due to
      bdrv_swap(), so drop it, and instead pass the BDS directly to the
      nbd-client.c functions which then retrieve the NbdClientSession object
      from there.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f824e8ed03cfcda55531206b2ee6fce62a7206f3
  Author: Zhoujian <jianjay.zhou@huawei.com>
  Date:   Thu Feb 12 15:43:02 2015 +0800

      qom: Fix typo, 'my_class_init' -> 'derived_class_init'

      Signed-off-by: Zhoujian <jianjay.zhou@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 09d560177101d2ef1e333754a25cfa49b70583b3
  Author: Jun Li <junmuzi@gmail.com>
  Date:   Wed Nov 5 15:03:03 2014 +0800

      qdev: Avoid type assertion in qdev_build_hotpluggable_device_list()

      Currently when *obj is not a TYPE_DEVICE, QEMU will abort. This patch
      fixes it. When *obj is not a TYPE_DEVICE, just do not add it to hotpluggable
      device list.

      This patch also fixes the following issue:
      1. boot QEMU using cli:
      $ /opt/qemu-git-arm/bin/qemu-system-x86_64 -monitor stdio -enable-kvm \
      -device virtio-scsi-pci,id=scsi0

      2. device_del scsi0 via hmp using tab key(first input device_del, then press
      "Tab" key).
      (qemu) device_del

      After step 2, QEMU will abort.
      (qemu) device_del hw/core/qdev.c:930:qdev_build_hotpluggable_device_list:
      Object 0x5555563a2460 is not an instance of type device

      Signed-off-by: Jun Li <junmuzi@gmail.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 9e0ff75e5158c7dbb65ee447382bbdf4cafbef8b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Feb 11 17:33:33 2015 +0100

      vnc: fix coverity warning

      vnc_display_local_addr will not be called with an invalid display id.
      Add assert() to silence coverity warning about a null pointer dereference.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0e7d6f608339029404efd025ae9b8965ffe60087
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 16:25:34 2015 +0100

      ui/vnc: optimize full scanline updates

      in case we send and update for a complete scanline increment
      the y offset to avoid running to find_next_bit for that lines
      twice.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f7801c5ce42250bf1e84d21bceb1802cfe4485e8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 5 17:43:35 2015 +0800

      vnc: auto assian an id when calling change vnc qmp interface

      Only in this way, change vnc qmp interface can take effect,
      because qemu_opts_find(&qemu_vnc_opts, id) will return NULL
      in vnc_display_open(), It can't connect successfully vnc
      server forever.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2779672fa3f0680e63ecfd3ee2d6ff360ce948a2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 5 17:43:34 2015 +0800

      vnc: introduce an wrapper for auto assign vnc id

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2c72de09619ed4d2f4498a65027114f9c035f7f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:36 2015 +0800

      vnc: using bool type instead of int for QEMU_OPT_BOOL

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e2a11d9d5a7d8b8450cd644e73b829dcf4686528
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:35 2015 +0800

      vnc: correct missing property about vnc_display

      Missing three property for vnc socket connection,
      revalue display variable with correct way.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88428b7a93347efc51be015cc12cb71fab3976a3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:34 2015 +0800

      vnc: fix qemu crash when not configure vnc option

      Add missing vnc options: to, ipv4, ipv6 and fix
      qemu crash.

      Reproducer:
      $ x86_64-softmmu/qemu-system-x86_64
      qemu-system-x86_64: Invalid parameter 'to'
      Segmentation fault (core dumped)

      BTW the patch fix the below bug:
      https://bugs.launchpad.net/qemu/+bug/1414222

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e13fbe42d7aed77d1b1c62b342d080c2510af0e
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:16 2015 +0100

      s390x/ipl: make s390x ipl device aware of migration

      We have to migrate the reipl parameters, so a reboot on the migrated machine
      will behave just like on the origin. Otherwise, the reipl parameters configured
      by the guest would be lost.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e91e972ccfbaeba1d1416202ad1b667810a33e1f
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:15 2015 +0100

      s390x/ipl: drop reipl parameters on resets

      Whenever a reboot initiated by the guest is done, the reipl parameters should
      remain valid. The disk configured by the guest is to be used for
      ipl'ing. External reboot/reset request (e.g. via virsh reset guest) should
      completely reset the guest to the initial state, and therefore also reset the
      reipl parameters, resulting in an ipl behaviour of the initially configured
      guest. This could be an external kernel or a disk.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit df75a4e2c607836eee044d7e6b0d94724d6ebf21
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:14 2015 +0100

      s390x/ipl: support diagnose 308 subcodes 5 and 6

      To support dynamically updating the IPL device from inside the KVM
      guest on the s390 platform, DIAG 308 instruction is intercepted
      in QEMU to handle the request.

      Subcode 5 allows to specify a new boot device, which is saved for
      later in the s390_ipl device. This also allows to switch from an
      external kernel to a boot device.

      Subcode 6 retrieves boot device configuration that has been previously
      set.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f0180f913e3bcd04cb132f5f6036e823a78e0673
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:13 2015 +0100

      s390x/ipl: always load the bios for ccw machine

      We will need bios support in order to be able to support selecting a
      different boot device via diagnose 308 in the ccw machine, so let's
      make the bios mandatory for the ccw machine.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 1ab2aea2489f34a05dabfe5bd91a76d89dd8c922
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jan 30 15:08:05 2015 +0000

      linux-user: correct stat structure in MIPS N32

      Simple "hello world" MIPS N32 userland program crashes with segfault due to
      incorrectly defined stat structure in QEMU.

      Correct "target_stat" definition to match kernel's "stat64" as in MIPS N32
      there are only plain "stat" syscalls using 64-bit structure.

      Reported-by: Daniel Sanders <daniel.sanders@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Tested-by: Daniel Sanders <daniel.sanders@imgtec.com>
      Reviewed-by: James Hogan <james.hogan@imgtec.com>

  commit 5e88759a52934a32502298f2c78c6dfaa144364b
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:58:57 2015 +0000

      target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction

      Using rs = -1 in gen_logic_imm() for microMIPS LUI instruction is dangerous
      and may bite us when implementing microMIPS R6 because in R6 AUI and LUI
      are distinguished by rs value. Therefore use 0 for safety.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b40a1530f294b5fa4479dc3ca9bf46c269d08d87
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:49:42 2015 +0000

      target-mips: fix broken snapshotting

      Recently added CP0.BadInstr and CP0.BadInstrP registers ended up in cpu_load()
      under different offset than in cpu_save(). These and all registers between were
      incorrectly restored.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d3b1979d7b37c7fa6b187442e0990afa6f88fe3b
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:17:39 2015 +0000

      target-mips: use CP0EnLo_XI instead of magic number

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>

  commit 6489dd250a4d6e86ecbb4badf82cc102afe26f33
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:06:43 2015 +0000

      target-mips: ll and lld cause AdEL exception for unaligned address

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>

  commit fe2372910a09034591fd2cfc2d70cca43fccaa95
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 15:53:16 2015 +0000

      target-mips: fix detection of the end of the page during translation

      The test is supposed to terminate TB if the end of the page is reached.
      However, with current implementation it may never succeed for microMIPS or
      mips16.

      Reported-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 196a7958c65778d05a491309377a65c58f643a1c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Sat Dec 20 23:00:25 2014 +0000

      target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b19c1c08de4365df90207862f4f9f7c1cd512bd9
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:56 2015 +0100

      isa: remove isa_mem_base variable

      Now that isa_mem_base variable is always 0, we can remove its usage.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f720f20350cfdf7e9d267947238cd2e5acee53f3
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:55 2015 +0100

      gt64xxx: remove isa_mem_base usage

      Create a custom address space for PCI memory region and use it for the PCI bus.
      Dynamically handle PCI0 Mem0 and PCI0 Mem1 regions, as already done for PCI0 IO.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cdba1415c159975c33776c386b934d6cb772421b
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:54 2015 +0100

      piix4: use PCI address space instead of system memory

      piix4 is only used on MIPS Malta board, which gives get_system_memory()
      to pci_register_bus().

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 0c10962a033bfd4b6935389750e567eae18bd5e7
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:53 2015 +0100

      mips: remove isa_mem_base usage

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 5c63bcf7501527b844f61624957bdba254d75bfc
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:52 2015 +0100

      jazz: remove usage of isa_mem_base

      Do assorted changes in memory-mapped rtc interface.

      Also fix size of ISA I/O memory region, which should be 0x10000 bytes.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f33772c8510ffe31b29c4bd9fc949f32f02a3954
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:51 2015 +0100

      jazz: do not explode QEMUMachineInitArgs structure

      Also remove address_space and address_space_io parameters, which
      where always get_system_memory() and get_system_io().

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit bb2ed009e7e4b278c0234143f6b6c1126f68ba35
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:50 2015 +0100

      isa: add memory space parameter to isa_bus_new

      Currently, keep current behaviour by always using get_system_memory().

      Also use QOM casts when possible.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cd2d5541271f1934345d8ca42f5fafff1744eee7
  Merge: e344e7a 15fc7da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 11:44:49 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150212' into staging

      Convert to linked list.

      # gpg: Signature made Fri 13 Feb 2015 05:40:41 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150212:
        tcg: Remove unused opcodes
        tcg: Implement insert_op_before
        tcg: Remove opcodes instead of noping them out
        tcg: Put opcodes in a linked list
        tcg: Introduce tcg_op_buf_count and tcg_op_buf_full
        tcg: Move emit of INDEX_op_end into gen_tb_end
        tcg: Reduce ifdefs in tcg-op.c
        tcg: Move some opcode generation functions out of line

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e344e7afc1a04ab11c843c069cef0cdcc1c7787e
  Merge: 449008f c2ebd86
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 11:19:22 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150213' into staging

      target-arm queue:
       * PCIe support in virt board
       * Support 32-bit guests on 64-bit KVM hosts in virt board
       * Fixes to avoid C undefined behaviour

      # gpg: Signature made Fri 13 Feb 2015 05:53:07 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150213:
        target-arm: A64: Avoid signed shifts in disas_ldst_pair()
        target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
        target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
        target-arm: A64: Fix shifts into sign bit
        target-arm: Add AArch32 guest support to KVM64
        target-arm: Add 32/64-bit register sync
        target-arm: Add feature parsing to virt
        target-arm: Add CPU property to disable AArch64
        pci: Move PCI VGA to pci.mak
        arm: Add PCIe host bridge in virt machine
        pci: Add generic PCIe host bridge
        pci: Allocate PCIe host bridge PCI ID

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c2ebd862a54b7e12175d65c03ba259926cb2237a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Avoid signed shifts in disas_ldst_pair()

      Avoid shifting potentially negative signed offset values in
      disas_ldst_pair() by keeping the offset in a uint64_t rather
      than an int64_t.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-5-git-send-email-peter.maydell@linaro.org

  commit 037e1d009e2fcb80784d37f0e12aa999787d46d4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr

      Shifting a negative integer left is undefined behaviour in C.
      Avoid it by assembling and shifting the offset fields as
      unsigned values and then sign extending as the final action.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-4-git-send-email-peter.maydell@linaro.org

  commit e167adc9d9f5df4f8109aecd4552c407fdce094a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask

      The code in logic_imm_decode_wmask attempts to rotate a mask
      value within the bottom 'e' bits of the value with
          mask = (mask >> r) | (mask << (e - r));
      This has two issues:
       * if the element size is 64 then a rotate by zero results
         in a shift left by 64, which is undefined behaviour
       * if the element size is smaller than 64 then this will
         leave junk in the value at bit 'e' and above, which is
         not valid input to bitfield_replicate(). As it happens,
         the bits at bit 'e' to '2e - r' are exactly the ones
         which bitfield_replicate is going to copy in there,
         so this isn't a "wrong code generated" bug, but it's
         confusing and if we ever put an assert in
         bitfield_replicate it would fire on valid guest code.

      Fix the former by not doing anything if r is zero, and
      the latter by masking with bitmask64(e).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-3-git-send-email-peter.maydell@linaro.org

  commit 1743d55c8b38bcee632cf6eb2de81131635bb3d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: A64: Fix shifts into sign bit

      Fix attempts to shift into the sign bit of an int, which is undefined
      behaviour in C and warned about by the clang sanitizer.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-2-git-send-email-peter.maydell@linaro.org

  commit 560739702764d4882662f0e70b584fa5dff7241a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add AArch32 guest support to KVM64

      Add 32-bit to/from 64-bit register synchronization on register gets and puts.
      Set EL1_32BIT feature flag passed to KVM

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1423736974-14254-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ce02049dbf1828b4bc77d921b108a9d84246e5aa
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add 32/64-bit register sync

      Add AArch32 to AArch64 register sychronization functions.
      Replace manual register synchronization with new functions in
      aarch64_cpu_do_interrupt() and HELPER(exception_return)().

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f313369fdb78f849ecbbd8e5d88f01ddf38786c8
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add feature parsing to virt

      Added machvirt parsing of feature keywords added to the -cpu command line
      option.  Parsing occurs during machine initialization.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb8d6c24b095c426151b9bba8c8b0e58b03d6503
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add CPU property to disable AArch64

      Adds registration and get/set functions for enabling/disabling the AArch64
      execution state on AArch64 CPUs.  By default AArch64 execution state is enabled
      on AArch64 CPUs, setting the property to off, will disable the execution state.
      The below QEMU invocation would have AArch64 execution state disabled.

          $ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off

      Also adds stripping of features from CPU model string in acquiring the ARM CPU
      by name.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 332261de2b979610aacde22eb15ef6e59f3c2da9
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      pci: Move PCI VGA to pci.mak

      Every platform that supports PCI can also spawn the Bochs VGA PCI adapter. Move
      it to pci.mak to enable it for everyone.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ab29b8214cc4b54e0c1a8270b610a340311470e
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      arm: Add PCIe host bridge in virt machine

      Now that we have a working "generic" PCIe host bridge driver, we can plug
      it into ARM's virt machine to always have PCIe available to normal ARM VMs.

      I've successfully managed to expose a Bochs VGA device, XHCI and an e1000
      into an AArch64 VM with this and they all lived happily ever after.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      [PMM: Squashed in fix for off-by-one error in bus-range DT property
       from Laszlo Ersek <lersek@redhat.com>]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4d8fde1126419c5a858926a457a9b320a27a921a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:07 2015 +0000

      pci: Add generic PCIe host bridge

      With simple exposure of MMFG, ioport window, mmio window and an IRQ line we
      can successfully create a workable PCIe host bridge that can be mapped anywhere
      and only needs to get described to the OS using whatever means it likes.

      This patch implements such a "generic" host bridge. It handles 4 legacy IRQ
      lines. MSIs need to be handled external to the host bridge.

      This device is particularly useful for the "pci-host-ecam-generic" driver in
      Linux.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf439db4993b02033d4fba8460ca4dc45b15071a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:07 2015 +0000

      pci: Allocate PCIe host bridge PCI ID

      We are going to introduce a PCIe host controller that doesn't exist that
      way in real hardware, but still needs to expose some PCIe root device which
      has PCI IDs.

      Allocate a PCI ID in the Red Hat space that we use for other devices of this
      kind.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 15fc7daa770764cc795158cbb525569f156f3659
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 20:40:35 2014 -0700

      tcg: Remove unused opcodes

      We no longer need INDEX_op_end to terminate the list, nor do we
      need 5 forms of nop, since we just remove the TCGOp instead.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit a4ce099a7a4b4734c372f6bf28f3362e370f23c1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 17:14:02 2014 -0700

      tcg: Implement insert_op_before

      Rather reserving space in the op stream for optimization,
      let the optimizer add ops as necessary.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0c627cdca20155753a536c51385abb73941a59a0
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 16:51:54 2014 -0700

      tcg: Remove opcodes instead of noping them out

      With the linked list scheme we need not leave nops in the stream
      that we need to process later.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c45cb8bb89fc798489869982c4c463b26ce43d7b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 13:49:15 2014 -0700

      tcg: Put opcodes in a linked list

      The previous setup required ops and args to be completely sequential,
      and was error prone when it came to both iteration and optimization.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit fe700adb3db5b028b504423b946d4ee5200a8f2f
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 15:36:56 2014 -0700

      tcg: Introduce tcg_op_buf_count and tcg_op_buf_full

      The method by which we count the number of ops emitted
      is going to change.  Abstract that away into some inlines.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0a7df5da986bd7ee0789f2d7b8611f2e8eee5046
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 14:50:30 2014 -0700

      tcg: Move emit of INDEX_op_end into gen_tb_end

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3a13c3f34ce2058e0c2decc3b0f9f56be24c9400
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 11:41:05 2014 -0700

      tcg: Reduce ifdefs in tcg-op.c

      Almost completely eliminates the ifdefs in this file, improving
      confidence in the lesser used 32-bit builds.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 951c6300f74ace35d87c079affc57cfc513a6a35
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 11:39:20 2014 -0700

      tcg: Move some opcode generation functions out of line

      Some of these functions are really quite large.  We have a number of
      things that ought to be circularly dependent, but we duplicated code
      to break that chain for the inlines.

      This saved 25% of the code size of one of the translators I examined.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ac95190ea92f7625bb0065c2864321607b95c26b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:21:04 2015 +0100

      memory: keep the owner of the AddressSpace alive until do_address_space_destroy

      This fixes a use-after-free if do_address_space_destroy is executed
      too late.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a464982499b2f637f6699e3d03e0a9d2e0b5288b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 17:15:18 2015 +0100

      rcu: run RCU callbacks under the BQL

      This needs to go away sooner or later, but one complication is the
      complex VFIO data structures that are modified in instance_finalize.
      Take a shortcut for now.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a7d1d636797ec1b30ca4dae02f9e1eb2d6b2c439
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:51:54 2015 +0100

      rcu: do not let RCU callbacks pile up indefinitely

      Always process them within a short time.  Even though waiting a little
      is useful, it is not okay to delay e.g. qemu_opts_del forever.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 444c7e0d92b5eb35fb85dc654f4bd991b0d3a0f2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:55 2015 +0800

      vhost-scsi: set the bootable value of channel/target/lun

      At present, the target is valued boot_tpgt, In addition,
      channel and lun both are 0 for bootable vhost-scsi device.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Bo Su <subo7@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9143d5f0f14c1eef92a362b3b976606ad2874daa
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:54 2015 +0800

      vhost-scsi: add a property for booting

      Because Qemu only accept an wwpn argument for vhost-scsi, we
      cannot assign a tpgt. That's say tpg is transparent for Qemu, Qemu
      doesn't know which tpg can boot, but vhost-scsi driver module
      doesn't know too for one assigned wwpn.

      At present, we assume that the first tpg can boot only, and add
      a boot_tpgt property that defaults to 0. Of course, people can
      pass a valid value by qemu command line.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1956cf6fa1039647327ef333dc09b43775907305
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:53 2015 +0800

      vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface

      In the way, we can make the bootindex property take effect.
      At the meanwhile, the firmware path name of vhost-scsi is
      "channel@channel/vhost-scsi@target,lun".

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d4433f32116dc597f895e62cde3572b400c3ee96
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:52 2015 +0800

      vhost-scsi: add bootindex property

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0be63901d2a33a6ed25caa5df3f530df75338f6a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:51 2015 +0800

      qdev: support to get a device firmware path directly

      commit 6b1566c (qdev: Introduce FWPathProvider interface) did a
      good job for supproting to get firmware path on some different
      architectures.

      Moreover further more, we can use the interface to get firmware
      path name for a device which isn't attached a specific bus,
      such as virtio-bus, scsi-bus etc.

      When the device (such as vhost-scsi) realize the TYPE_FW_PATH_PROVIDER
      interface, we should introduce a new function to get the correct firmware
      path name for it.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit edecf5eced082cb45e213cb4e791b2fcf9f867c1
  Author: Wei Huang <wei@redhat.com>
  Date:   Fri Jan 30 13:17:08 2015 -0500

      kvm_stat: Add kvm_exit reasons for aarch64

      This patch defines the list of kvm_exit reasons for aarch64. This list is
      based on the Exception Class (EC) field of HSR register. With this patch
      users can trace the execution of guest VMs better. A sample output from
      command "kvm_stat -1 -t" is shown as the following:
      <...>
      kvm_exit(WATCHPT_HYP)          0         0
      kvm_exit(WFI)               9422      9361

      NOTE: This patch requires TRACE_EVENT(kvm_exit) to include exit_reason
      field in TP_ARGS. A patch to upstream kernel has been submitted.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 449008f86418583a1f0fb946cf91ee7b4797317d
  Merge: 5c697ae bc5baff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 11 05:14:41 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging

      RCU fixes and cleanup (Paolo Bonzini)
      Switch to v2 IOMMU interface (Alex Williamson)
      DEBUG build fix (Alexey Kardashevskiy)

      # gpg: Signature made Tue 10 Feb 2015 17:37:06 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150210.0:
        vfio: Fix debug message compile error
        vfio: Use vfio type1 v2 IOMMU interface
        vfio: unmap and free BAR data in instance_finalize
        vfio: free dynamically-allocated data in instance_finalize
        vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback
        memory: unregister AddressSpace MemoryListener within BQL

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc5baffa3554e4c0d20c1dbe879aec931866bd69
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: Fix debug message compile error

      This fixes a compiler error which occurs if DEBUG_VFIO is defined.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 2e6e697e166568fdd09ceaa8c7c8c8c53a5e345b
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: Use vfio type1 v2 IOMMU interface

      The difference between v1 and v2 is fairly subtle, simply more
      deterministic behavior for unmaps.  The v1 interface allows the user
      to attempt to unmap sub-regions of previous mappings, returning
      success with zero size if unable to comply.  This was a reflection of
      the underlying IOMMU API.  The v2 interface requires that the user
      may only unmap fully contained mappings, ie. an unmap cannot intersect
      or bisect a previous mapping, but may cover multiple mappings.  QEMU
      never made use of the sub-region v1 support anyway, so we can support
      either v1 or v2.  We'll favor v2 since it's newer.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ba5e6bfa1aee29a8f72c5538c565dfb9889cf273
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: unmap and free BAR data in instance_finalize

      In the case of VFIO, the unrealize callback is too early to munmap the
      BARs.  The munmap must be delayed until memory accesses are complete.
      To do this, split vfio_unmap_bars in two.  The removal step, now called
      vfio_unregister_bars, remains in vfio_exitfn.  The reclamation step
      is vfio_unmap_bars and is moved to the instance_finalize callback.

      Similarly, quirk MemoryRegions have to be removed during
      vfio_unregister_bars, but freeing the data structure must be delayed
      to vfio_unmap_bars.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 77a10d04d033484a913a5ee76eed31a9acc57bae
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: free dynamically-allocated data in instance_finalize

      In order to enable out-of-BQL address space lookup, destruction of
      devices needs to be split in two phases.

      Unrealize is the first phase; once it complete no new accesses will
      be started, but there may still be pending memory accesses can still
      be completed.

      The second part is freeing the device, which only happens once all memory
      accesses are complete.  At this point the reference count has dropped to
      zero, an RCU grace period must have completed (because the RCU-protected
      FlatViews hold a reference to the device via memory_region_ref).  This is
      when instance_finalize is called.

      Freeing data belongs in an instance_finalize callback, because the
      dynamically allocated memory can still be used after unrealize by the
      pending memory accesses.

      This starts the process by creating an instance_finalize callback and
      freeing most of the dynamically-allocated data in instance_finalize.
      Because instance_finalize is also called on error paths or also when
      the device is actually not realized, the common code needs some changes
      to be ready for this.  The error path in vfio_initfn can be simplified too.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 217e9fdcadb1dc7462f4d92866314f626426fa82
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback

      Now that vfio_put_base_device is called unconditionally at instance_finalize
      time, it can be called twice if vfio_populate_device fails.  This works
      but it is slightly harder to follow.

      Change vfio_get_device to not touch the vbasedev struct until it will
      definitely succeed, moving the vfio_populate_device call back to vfio-pci.
      This way, vfio_put_base_device will only be called once.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6e48e8f9e0f5b6b15c41f6f8a68c9bf330147d45
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      memory: unregister AddressSpace MemoryListener within BQL

      address_space_destroy_dispatch is called from an RCU callback and hence
      outside the iothread mutex (BQL).  However, after address_space_destroy
      no new accesses can hit the destroyed AddressSpace so it is not necessary
      to observe changes to the memory map.  Move the memory_listener_unregister
      call earlier, to make it thread-safe again.

      Reported-by: Alex Williamson <alex.williamson@redhat.com>
      Fixes: 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 5c697ae74170d43928cb185f5ac1a9058adcae0b
  Merge: 89db217 43d7355
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 10 09:51:46 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-02-10' into staging

      trivial patches for 2015-02-10

      # gpg: Signature made Tue 10 Feb 2015 07:27:11 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-02-10: (45 commits)
        virtio: Fix warning caused by missing 'static' attribute
        vga: Fix warning caused by missing 'static' attribute
        stubs: Fix warning caused by missing include statement
        spice: Add missing 'static' attribute
        serial: Fix warnings caused by missing 'static' attribute
        moxie: Fix warning caused by missing include statement
        migration: Fix warnings caused by missing 'static' attribute
        migration: Fix warning caused by missing declaration of vmstate_dummy
        disas/sh4: Fix warning caused by missing 'static' attribute
        translate-all: Use g_try_malloc() for dynamic translator buffer
        vnc: g_realloc() can't fail, bury dead error handling
        rdma: g_malloc0() can't fail, bury dead error handling
        kvm: g_malloc() can't fail, bury dead error handling
        rtl8139: g_malloc() can't fail, bury dead error handling
        onenand: g_malloc() can't fail, bury dead error handling
        Fix name error in migration stream analyzation script
        QJSON: fix typo in author's email address
        util/uri: URI member path can be null, compare more carfully
        util/uri: realloc2n() can't fail, drop dead error handling
        util/uri: uri_new() can't fail, drop dead error handling
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43d735547b2a29cafd7d9529ac38734950b235f7
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:17 2015 +0100

      virtio: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      hw/char/virtio-serial-bus.c:31:3:
       warning: symbol 'vserdevices' was not declared. Should it be static?

      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 73d22cafcaea7cb7b5f3ebbff2df5458d3f3c570
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:16 2015 +0100

      vga: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      hw/display/vga.c:2012:26: warning:
       symbol 'vmstate_vga_endian' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2822c1b65b54341dee33a85c96d419512f2b2da2
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:15 2015 +0100

      stubs: Fix warning caused by missing include statement

      Warning from the Sparse static analysis tool:

      stubs/qtest.c:14:6:
       warning: symbol 'qtest_allowed' was not declared. Should it be static?

      Add the missing include statement which declares qtest_allowed.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 51575c3fca79b90953502dd1fa574711155a167e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:14 2015 +0100

      spice: Add missing 'static' attribute

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 92013cf8ca10adafec9a92deb5df993e7df22cb9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:13 2015 +0100

      serial: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      hw/char/serial.c:630:26: warning: symbol
       'vmstate_serial_thr_ipending' was not declared. Should it be static?
      hw/char/serial.c:646:26: warning: symbol
       'vmstate_serial_tsr' was not declared. Should it be static?
      hw/char/serial.c:665:26: warning: symbol
       'vmstate_serial_recv_fifo' was not declared. Should it be static?
      hw/char/serial.c:681:26: warning: symbol
       'vmstate_serial_xmit_fifo' was not declared. Should it be static?
      hw/char/serial.c:697:26: warning: symbol
       'vmstate_serial_fifo_timeout_timer' was not declared. Should it be static?
      hw/char/serial.c:713:26: warning: symbol
       'vmstate_serial_timeout_ipending' was not declared. Should it be static?
      hw/char/serial.c:729:26: warning: symbol
       'vmstate_serial_poll' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 302fe1235cf61df432cb3e5ff7e4fb7cc8561679
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:12 2015 +0100

      moxie: Fix warning caused by missing include statement

      Warning from the Sparse static analysis tool:

      target-moxie/machine.c:4:26:
       warning: symbol 'vmstate_moxie_cpu' was not declared. Should it be static?

      machine.h includes the missing declaration.

      Cc: Anthony Green <green@moxielogic.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ae31aea21853c121968560138a817f103aafb92
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:11 2015 +0100

      migration: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      migration-rdma.c:151:12: warning:
       symbol 'wrid_desc' was not declared. Should it be static?
      migration-rdma.c:190:12: warning:
       symbol 'control_desc' was not declared. Should it be static?
      migration-rdma.c:3301:19: warning:
       symbol 'rdma_read_ops' was not declared. Should it be static?
      migration-rdma.c:3308:19: warning:
       symbol 'rdma_write_ops' was not declared. Should it be static?

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6afc14e92ac81b29c25f097468f7751d5df1b5bc
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:10 2015 +0100

      migration: Fix warning caused by missing declaration of vmstate_dummy

      Warning from the Sparse static analysis tool:

      stubs/vmstate.c:4:26: warning:
       symbol 'vmstate_dummy' was not declared. Should it be static?

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 084cc83996d1414d4713a84291a0fadf4199b9d2
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:09 2015 +0100

      disas/sh4: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      disas/sh4.c:335:22: warning:
       symbol 'sh_table' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b98ade31ed7994d6bcbb0600ad0ea3f3d881088
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:07 2015 +0100

      translate-all: Use g_try_malloc() for dynamic translator buffer

      The USE_MMAP code can fail, and the caller handles the failure
      already.  Let the !USE_MMAP code fail as well, for consistency.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4b3be73006d5d65d44bd482cc6e3cf2f4ab12c34
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:06 2015 +0100

      vnc: g_realloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e75bef035a80a1bd406375f22e32e37010bbdcd7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:05 2015 +0100

      rdma: g_malloc0() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9834fe02b00552648d498ca561b51f8ff1d7df31
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:04 2015 +0100

      kvm: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 66c5f3e596398a84949fb39e3d7b5f2c0ce3ea0f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:03 2015 +0100

      rtl8139: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6b0126f94099db15fb0110218b17eeccefa077d1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:02 2015 +0100

      onenand: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit be7433efbf8b4134ab9763abdecaf2e6a35e1ed1
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Sat Feb 7 11:25:14 2015 +0100

      Fix name error in migration stream analyzation script

      It fixes the following error:

      Traceback (most recent call last):
        File "./scripts/analyze-migration.py", line 584, in <module>
          dump.read(dump_memory = args.memory)
        File "./scripts/analyze-migration.py", line 528, in read
          self.sections[section_id].read()
        File "./scripts/analyze-migration.py", line 250, in read
          self.file.readvar(n_valid * HASH_PTE_SIZE_64)
      NameError: global name 'HASH_PTE_SIZE_64' is not defined

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 559782cc94581481cb7748eb17c4790e418bf86e
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Sat Feb 7 11:25:50 2015 +0100

      QJSON: fix typo in author's email address

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit afb30dde3ad71349fc65726946d58e5d3c61f8af
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:52 2015 +0100

      util/uri: URI member path can be null, compare more carfully

      uri_resolve_relative() calls strcmp(bas->path, ref->path).  However,
      either argument could be null!  Evidence: the code checks for null
      after the comparison.  Spotted by Coverity.

      I suspect this was screwed up when we stole the code from libxml2.
      There the conditional reads

          xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)

      with

          int
          xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
      	if (str1 == str2) return(1);
      	if (str1 == NULL) return(0);
      	if (str2 == NULL) return(0);
      	do {
      	    if (*str1++ != *str2) return(0);
      	} while (*str2++);
      	return(1);
          }

      Fix by replicating libxml2's logic faithfully.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit afd5ea3671f936f511015a71af9cd0ed23788515
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:51 2015 +0100

      util/uri: realloc2n() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c89c6e80a66aac16d7b14ff21e0aaeb99ebfe165
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:50 2015 +0100

      util/uri: uri_new() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0c6f807f4a98e7e258765dcf22619a582995fce0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:04 2015 +0100

      usb: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5f1d1fc5928a6f8f63089b3d0768e0dc42c05fbb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:03 2015 +0100

      spapr_vio: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c0462f6d75fa481f7660c15a5ca3a60205aa4eca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:02 2015 +0100

      qemu-option: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 96c044afdf600e9418b3e509e60ef51a841eed20
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:01 2015 +0100

      qemu-option: Replace pointless use of g_malloc0() by g_malloc()

      get_opt_value() takes a write-only buffer, so zeroing it is pointless.
      We don't do it elsewhere, either.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b41112c46b93f781669c0eb89e51d3a87af6bb49
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Feb 3 11:31:30 2015 +0000

      libcacard: stop linking against every single 3rd party library

      Building QEMU results in a libcacard.so that links against
      practically the entire world

      	linux-vdso.so.1 =>  (0x00007fff71e99000)
      	libssl3.so => /usr/lib64/libssl3.so (0x00007f49f94b6000)
      	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f49f928e000)
      	libnss3.so => /usr/lib64/libnss3.so (0x00007f49f8f67000)
      	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f49f8d3b000)
      	libplds4.so => /usr/lib64/libplds4.so (0x00007f49f8b36000)
      	libplc4.so => /usr/lib64/libplc4.so (0x00007f49f8931000)
      	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f49f86f2000)
      	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f49f84ed000)
      	libm.so.6 => /usr/lib64/libm.so.6 (0x00007f49f81e5000)
      	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f49f7fe3000)
      	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f49f7dda000)
      	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f49f7bc4000)
      	libcap-ng.so.0 => /usr/lib64/libcap-ng.so.0 (0x00007f49f79be000)
      	libuuid.so.1 => /usr/lib64/libuuid.so.1 (0x00007f49f77b8000)
      	libgnutls.so.28 => /usr/lib64/libgnutls.so.28 (0x00007f49f749a000)
      	libSDL-1.2.so.0 => /usr/lib64/libSDL-1.2.so.0 (0x00007f49f71fd000)
      	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f49f6fe0000)
      	libvte.so.9 => /usr/lib64/libvte.so.9 (0x00007f49f6d3f000)
      	libXext.so.6 => /usr/lib64/libXext.so.6 (0x00007f49f6b2d000)
      	libgtk-x11-2.0.so.0 => /usr/lib64/libgtk-x11-2.0.so.0 (0x00007f49f64a0000)
      	libgdk-x11-2.0.so.0 => /usr/lib64/libgdk-x11-2.0.so.0 (0x00007f49f61de000)
      	libpangocairo-1.0.so.0 => /usr/lib64/libpangocairo-1.0.so.0 (0x00007f49f5fd1000)
      	libatk-1.0.so.0 => /usr/lib64/libatk-1.0.so.0 (0x00007f49f5daa000)
      	libcairo.so.2 => /usr/lib64/libcairo.so.2 (0x00007f49f5a9d000)
      	libgdk_pixbuf-2.0.so.0 => /usr/lib64/libgdk_pixbuf-2.0.so.0 (0x00007f49f5878000)
      	libgio-2.0.so.0 => /usr/lib64/libgio-2.0.so.0 (0x00007f49f5500000)
      	libpangoft2-1.0.so.0 => /usr/lib64/libpangoft2-1.0.so.0 (0x00007f49f52eb000)
      	libpango-1.0.so.0 => /usr/lib64/libpango-1.0.so.0 (0x00007f49f50a0000)
      	libgobject-2.0.so.0 => /usr/lib64/libgobject-2.0.so.0 (0x00007f49f4e4e000)
      	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f49f4b15000)
      	libfontconfig.so.1 => /usr/lib64/libfontconfig.so.1 (0x00007f49f48d6000)
      	libfreetype.so.6 => /usr/lib64/libfreetype.so.6 (0x00007f49f462b000)
      	libX11.so.6 => /usr/lib64/libX11.so.6 (0x00007f49f42e8000)
      	libxenstore.so.3.0 => /usr/lib64/libxenstore.so.3.0 (0x00007f49f40de000)
      	libxenctrl.so.4.4 => /usr/lib64/libxenctrl.so.4.4 (0x00007f49f3eb6000)
      	libxenguest.so.4.4 => /usr/lib64/libxenguest.so.4.4 (0x00007f49f3c8b000)
      	libseccomp.so.2 => /usr/lib64/libseccomp.so.2 (0x00007f49f3a74000)
      	librdmacm.so.1 => /usr/lib64/librdmacm.so.1 (0x00007f49f385d000)
      	libibverbs.so.1 => /usr/lib64/libibverbs.so.1 (0x00007f49f364a000)
      	libutil.so.1 => /usr/lib64/libutil.so.1 (0x00007f49f3447000)
      	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f49f3089000)
      	/lib64/ld-linux-x86-64.so.2 (0x00007f49f9902000)
      	libp11-kit.so.0 => /usr/lib64/libp11-kit.so.0 (0x00007f49f2e23000)
      	libtspi.so.1 => /usr/lib64/libtspi.so.1 (0x00007f49f2bb2000)
      	libtasn1.so.6 => /usr/lib64/libtasn1.so.6 (0x00007f49f299f000)
      	libnettle.so.4 => /usr/lib64/libnettle.so.4 (0x00007f49f276d000)
      	libhogweed.so.2 => /usr/lib64/libhogweed.so.2 (0x00007f49f2545000)
      	libgmp.so.10 => /usr/lib64/libgmp.so.10 (0x00007f49f22cd000)
      	libncurses.so.5 => /usr/lib64/libncurses.so.5 (0x00007f49f20a5000)
      	libtinfo.so.5 => /usr/lib64/libtinfo.so.5 (0x00007f49f1e7a000)
      	libgmodule-2.0.so.0 => /usr/lib64/libgmodule-2.0.so.0 (0x00007f49f1c76000)
      	libXfixes.so.3 => /usr/lib64/libXfixes.so.3 (0x00007f49f1a6f000)
      	libXrender.so.1 => /usr/lib64/libXrender.so.1 (0x00007f49f1865000)
      	libXinerama.so.1 => /usr/lib64/libXinerama.so.1 (0x00007f49f1662000)
      	libXi.so.6 => /usr/lib64/libXi.so.6 (0x00007f49f1452000)
      	libXrandr.so.2 => /usr/lib64/libXrandr.so.2 (0x00007f49f1247000)
      	libXcursor.so.1 => /usr/lib64/libXcursor.so.1 (0x00007f49f103c000)
      	libXcomposite.so.1 => /usr/lib64/libXcomposite.so.1 (0x00007f49f0e39000)
      	libXdamage.so.1 => /usr/lib64/libXdamage.so.1 (0x00007f49f0c35000)
      	libharfbuzz.so.0 => /usr/lib64/libharfbuzz.so.0 (0x00007f49f09dd000)
      	libpixman-1.so.0 => /usr/lib64/libpixman-1.so.0 (0x00007f49f072f000)
      	libEGL.so.1 => /usr/lib64/libEGL.so.1 (0x00007f49f0505000)
      	libpng16.so.16 => /usr/lib64/libpng16.so.16 (0x00007f49f02d2000)
      	libxcb-shm.so.0 => /usr/lib64/libxcb-shm.so.0 (0x00007f49f00cd000)
      	libxcb-render.so.0 => /usr/lib64/libxcb-render.so.0 (0x00007f49efec3000)
      	libxcb.so.1 => /usr/lib64/libxcb.so.1 (0x00007f49efca1000)
      	libGL.so.1 => /usr/lib64/libGL.so.1 (0x00007f49efa06000)
      	libffi.so.6 => /usr/lib64/libffi.so.6 (0x00007f49ef7fe000)
      	libselinux.so.1 => /usr/lib64/libselinux.so.1 (0x00007f49ef5d8000)
      	libresolv.so.2 => /usr/lib64/libresolv.so.2 (0x00007f49ef3be000)
      	libexpat.so.1 => /usr/lib64/libexpat.so.1 (0x00007f49ef193000)
      	libbz2.so.1 => /usr/lib64/libbz2.so.1 (0x00007f49eef83000)
      	libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007f49eed6c000)
      	liblzma.so.5 => /usr/lib64/liblzma.so.5 (0x00007f49eeb46000)
      	libnl-route-3.so.200 => /usr/lib64/libnl-route-3.so.200 (0x00007f49ee8e2000)
      	libnl-3.so.200 => /usr/lib64/libnl-3.so.200 (0x00007f49ee6c4000)
      	libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f49ee2d6000)
      	libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f49ee067000)
      	libgraphite2.so.3 => /usr/lib64/libgraphite2.so.3 (0x00007f49ede48000)
      	libX11-xcb.so.1 => /usr/lib64/libX11-xcb.so.1 (0x00007f49edc46000)
      	libxcb-dri2.so.0 => /usr/lib64/libxcb-dri2.so.0 (0x00007f49eda41000)
      	libxcb-xfixes.so.0 => /usr/lib64/libxcb-xfixes.so.0 (0x00007f49ed838000)
      	libxcb-shape.so.0 => /usr/lib64/libxcb-shape.so.0 (0x00007f49ed634000)
      	libgbm.so.1 => /usr/lib64/libgbm.so.1 (0x00007f49ed426000)
      	libwayland-client.so.0 => /usr/lib64/libwayland-client.so.0 (0x00007f49ed217000)
      	libwayland-server.so.0 => /usr/lib64/libwayland-server.so.0 (0x00007f49ed005000)
      	libglapi.so.0 => /usr/lib64/libglapi.so.0 (0x00007f49ecddb000)
      	libdrm.so.2 => /usr/lib64/libdrm.so.2 (0x00007f49ecbce000)
      	libXau.so.6 => /usr/lib64/libXau.so.6 (0x00007f49ec9ca000)
      	libxcb-glx.so.0 => /usr/lib64/libxcb-glx.so.0 (0x00007f49ec7b0000)
      	libxcb-dri3.so.0 => /usr/lib64/libxcb-dri3.so.0 (0x00007f49ec5ad000)
      	libxcb-present.so.0 => /usr/lib64/libxcb-present.so.0 (0x00007f49ec3aa000)
      	libxcb-randr.so.0 => /usr/lib64/libxcb-randr.so.0 (0x00007f49ec19b000)
      	libxcb-sync.so.1 => /usr/lib64/libxcb-sync.so.1 (0x00007f49ebf94000)
      	libxshmfence.so.1 => /usr/lib64/libxshmfence.so.1 (0x00007f49ebd91000)
      	libXxf86vm.so.1 => /usr/lib64/libXxf86vm.so.1 (0x00007f49ebb8a000)
      	libpcre.so.1 => /usr/lib64/libpcre.so.1 (0x00007f49eb91d000)
      	libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00007f49eb6cf000)
      	libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00007f49eb3ec000)
      	libcom_err.so.2 => /usr/lib64/libcom_err.so.2 (0x00007f49eb1e8000)
      	libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00007f49eafb4000)
      	libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00007f49eada5000)
      	libkeyutils.so.1 => /usr/lib64/libkeyutils.so.1 (0x00007f49eaba0000)

      All libcacard actually needs are the NSS libs. Linking against the entire
      world is a regression caused by

        commit 9d171bd9375e4d08feff9adda15163e0811f5f42
        Author: Michael Tokarev <mjt@tls.msk.ru>
        Date:   Thu May 8 16:48:27 2014 +0400

          libcacard: remove libcacard-specific CFLAGS and LIBS from global vars

      Which removed the setting of the LIBS variable in libcacard/Makefile.

      Adding it back as an empty assignment brings the linked libs back to a more
      reasonable set

      	linux-vdso.so.1 =>  (0x00007fff575c1000)
      	libssl3.so => /usr/lib64/libssl3.so (0x00007f7f753b1000)
      	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f7f75189000)
      	libnss3.so => /usr/lib64/libnss3.so (0x00007f7f74e62000)
      	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f7f74c36000)
      	libplds4.so => /usr/lib64/libplds4.so (0x00007f7f74a31000)
      	libplc4.so => /usr/lib64/libplc4.so (0x00007f7f7482c000)
      	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f7f745ed000)
      	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f7f743d0000)
      	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f7f741cc000)
      	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f7f73fca000)
      	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f7f73c90000)
      	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f7f738d3000)
      	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f7f736bd000)
      	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f7f734b4000)
      	/lib64/ld-linux-x86-64.so.2 (0x00007f7f757fd000)

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Cc: <qemu-stable@nongnu.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aa5e03d2aa4ed19bfb7f4ce80092758018c6a71c
  Author: Maxim Ostapenko <m.ostapenko@partner.samsung.com>
  Date:   Mon Feb 2 18:18:29 2015 +0400

      linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

      Fix TARGET_SI_PAD_SIZE calculation to match the way the kernel does it.
      Use different TARGET_SI_PREAMBLE_SIZE for 32-bit and 64-bit targets.

      Signed-off-by: Maxim Ostapenko <m.ostapenko@partner.samsung.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 55a10996034cb2e633f0437cedd97f345183c0ec
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jan 30 20:37:55 2015 +0100

      qemu-sockets: Fix buffer overflow in inet_parse()

      The size of the stack allocated host[] array didn't account for the
      terminating '\0' byte that sscanf() writes. Fix the array size.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 02f292d9051f616511f482275b571c6153e3a48b
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Jan 28 16:07:17 2015 +0100

      vl.c: fix memory leak spotted by valgrind

      valgrind complains about:
      ==42062== 16 bytes in 1 blocks are definitely lost in loss record 387 of 1,048
      ==42062==    at 0x402DCB2: malloc (vg_replace_malloc.c:299)
      ==42062==    by 0x40C1BE3: g_malloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x40DA133: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x40DB2E5: g_slist_prepend (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x801637FF: object_class_get_list_tramp (object.c:690)
      ==42062==    by 0x40A96C9: g_hash_table_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x80164885: object_class_foreach (object.c:665)
      ==42062==    by 0x80164975: object_class_get_list (object.c:698)
      ==42062==    by 0x800100A5: machine_parse (vl.c:2447)
      ==42062==    by 0x800100A5: main (vl.c:3756)

      Lets free machines in case of mc.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a50c7c869a4fa1c78b4c38d3419566dd25d32e90
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:26 2015 +0100

      aes: remove a dead return statement

      bits is checked to be 128, 192 or 256 at the beginning of the function.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b658c53d2b87c1e9e0ade887a70ecb0de1474a7b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:24 2015 +0100

      qemu-sockets: improve error reporting in unix_listen_opts

      Coverity complains about not checking the returned value of mkstemp.  While
      at it, also improve error checking for snprintf, and refine error messages
      in general.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52851b7e3d816502b8ae4e8353f31fd9ee801509
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:22 2015 +0100

      cpu-exec: simplify icount code

      Use MIN instead of an "if" statement.  Move "tb" assignment where
      the value is actually used.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a7fa2e9783ee957635d23ddab151a8be97df5b2a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:21 2015 +0100

      cpu-exec: drop dead assignment

      All uses of TB inside cpu_exec are dominated by "tb = tb_find_fast(env)",
      and there are no uses after the switch statement.  So the assignment
      is dead, as reported by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dbfe1b6aef1751bced58cbd4a7a3868721ace2ba
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Jan 27 13:11:26 2015 +0100

      qemu-log: Correct help text of 'log cpu_reset'

      The logging of the CPU state during reset is done for all architectures
      nowadays (see cpu_common_reset() in qom/cpu.c), so the "x86 only" text
      does not apply here anymore.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dec0473dc683ac0ddd7946acdebd285728966a02
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 08:00:42 2015 +0800

      linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

      In abi_long do_ioctl_dm(), after lock_user() call, the code does
      not call unlock_user() before going to failure return in default case.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a86b3c64d45f2bf306fd4bf879abb4ac21d761f9
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 19:35:58 2015 +0800

      linux-user/main.c: Use TARGET_SIG* instead of SIG*

      In main.c, all SIG* should be TARGET_SIG*, since the relevant functions
      (queue_signal() and gdb_handlesig()) expect TARGET_SIG*.

      The corresponding vi command is "1,$ s/\<SIG/TARGET_SIG/g".

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 71ec7cef01b0f855cb9f774300f80d1ddcb91fc9
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Fri Jan 23 18:07:50 2015 +0800

      linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base

      It is only a typo issue, need use tswapal(target_vec[i].iov_len) for the
      len.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7eff518b6c91bdd62710dd9868ec7a17bd6f1434
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Fri Jan 23 18:01:09 2015 +0800

      linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block

      When failure occurs during locking of vec[i], we also need to unlock all
      already locked vec[i] in failure processing code block before return.

      Code in unlock_user() checks vec[i].iov_base for NULL, so there's no
      need not check it .

      If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just
      skip it, so can still use "while (--i >= 0)" loop condition.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 88ea8ed74cb6956f43199a098ca4963ae73bba57
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 20:17:06 2014 +0800

      virtfs-proxy-helper: Fix possible socket leak.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 46ede58bb461c1171251988e7fb1db6590350975
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 14:19:13 2015 +0100

      vl: Fix bogus error message for implied mon ID clashing

      monitor_parse() desugars --monitor, --qmp and -qmp-pretty to --mon.
      The ID it picks can clash with a user-specified ID.  When it happens,
      the error message is misleading.

      Reproducer:

          $ qemu --mon id=compat_monitor0 --monitor stdio

      Message before the patch:

          duplicate chardev: compat_monitor0

      There's no "duplicate chardev" here.  The problem is a duplicate
      monitor ID.  Moreover, the message provides no clue which option
      caused the problem.  The patch changes the message to:

          qemu: --monitor stdio: Duplicate ID 'compat_monitor0' for mon

      monitor_parse() is also used for creating a default monitor, but
      that's not done when the user specifies a monitor, so an ID clash is
      impossible then.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 15cae340094402bfe77565d7c6d09e2bb9d6601b
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:39 2015 -0500

      Convert some debugging printfs to trace calls in pcnet.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 32c952498b6ab740894fe83513bf43e872bf56a2
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:38 2015 -0500

      Add/convert trace calls in pcnet-pci.c.

      Add trace calls. Convert some #ifdef DEBUG printfs to trace.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5edab03d40408564212887f7674591230784a1a8
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:37 2015 -0500

      Add trace to ps2.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 91043dadc47cfb939e34eb9e02ee595b16100808
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:36 2015 -0500

      Add tracing to xenfb.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 627b84f4060c6d39f347dd3d4f9d60612615091c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Jan 19 11:45:12 2015 +0800

      fw_cfg: fix typos in comments: patch -> path

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b6f3b233eabb4df5d65ae9fbfb3d3c8befea0de7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:59:23 2015 +0100

      target-mips: Clean up switch fall through after commit fecd264

      Commit fecd264 added a number of fall-throughs, but neglected to
      properly document them as intentional.  Commit d922445 cleaned that up
      for many, but not all cases.  Take care of the remaining ones.

      Spotted by Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 89db21771782fd6050335e73542064f1187c9ced
  Author: Leon Yu <chianglungyu@gmail.com>
  Date:   Mon Feb 2 05:08:51 2015 +0000

      qmp: unbreak build for non-vnc configuration

      Signed-off-by: Leon Yu <chianglungyu@gmail.com>
      Message-id: 1422853731-5282-1-git-send-email-chianglungyu@gmail.com
      Fixes: df887684603a ("monitor: add query-vnc-servers command")
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d815ac82b0a3e816fd7a6d2561a73e780c3b685
  Merge: a2f2d28 728dacb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 18:06:07 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Fri 06 Feb 2015 17:14:10 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (47 commits)
        block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices
        block: Eliminate silly QERR_ macros used for encryption keys
        block: New bdrv_add_key(), convert monitor to use it
        blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
        blockdev: Give find_block_job() an Error ** parameter
        qcow2: Rewrite qcow2_alloc_bytes()
        block: Give always priority to unused entries in the qcow2 L2 cache
        nbd: fix max_discard/max_transfer_length
        block: introduce BDRV_REQUEST_MAX_SECTORS
        nbd: Improve error messages
        iotests: Fix 104 for NBD
        iotests: Fix 100 for nbd
        iotests: Fix 083
        block: fix off-by-one error in qcow and qcow2
        qemu-iotests: add 116 invalid QED input file tests
        qed: check for header size overflow
        block/dmg: improve zeroes handling
        block/dmg: support bzip2 block entry types
        block/dmg: factor out block type check
        block/dmg: use SectorNumber from BLKX header
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 728dacbda817b2ca259e9d337fab06bcf14e94a6
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Mon Jan 19 17:12:55 2015 -0500

      block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices

      This patch replaces the dummy code in raw_getlength() for block devices
      on OS X, which always returned LLONG_MAX, with a real implementation
      that returns the actual block device size.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8333c0dff14a8a16c8ad3a95c6ea09f9d6f395b3
  Merge: 8c44dfb b1ca639
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Feb 6 18:00:14 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        block: Eliminate silly QERR_ macros used for encryption keys
        block: New bdrv_add_key(), convert monitor to use it
        blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
        blockdev: Give find_block_job() an Error ** parameter

  commit b1ca639184d93984551b423d8e538ad4add5eb15
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:37:01 2015 +0100

      block: Eliminate silly QERR_ macros used for encryption keys

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      up QERR_DEVICE_ENCRYPTED and QERR_DEVICE_NOT_ENCRYPTED.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-5-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 4d2855a348c5e90f56584ab9777fc877965ca2e0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:37:00 2015 +0100

      block: New bdrv_add_key(), convert monitor to use it

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-4-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2e3a0266bd84a9be9f5e23c1568db6eb7f3e9e94
  Author: Markus Armbruster <armbru@pond.sub.org>
  Date:   Thu Jan 29 10:36:59 2015 +0100

      blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      this one up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-3-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 24d6bffe8ab523b1dcd8b8a2be678775f3e26b1c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:36:58 2015 +0100

      blockdev: Give find_block_job() an Error ** parameter

      When find_block_job() fails, all its callers build the same Error
      object.  Build it in find_block_job() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-2-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 8c44dfbc62a50a8bc4113f199b8662861f757591
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 09:39:16 2015 -0500

      qcow2: Rewrite qcow2_alloc_bytes()

      qcow2_alloc_bytes() is a function with insufficient error handling and
      an unnecessary goto. This patch rewrites it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8e8cb375e0964b4ed099cb8563029028db26a834
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Feb 5 14:55:31 2015 +0200

      block: Give always priority to unused entries in the qcow2 L2 cache

      The current algorithm to replace entries from the L2 cache gives
      priority to newer hits by dividing the hit count of all existing
      entries by two everytime there is a cache miss.

      However, if there are several cache misses the hit count of the
      existing entries can easily go down to 0. This will result in those
      entries being replaced even when there are others that have never been
      used.

      This problem is more noticeable with larger disk images and cache
      sizes, since the chances of having several misses before the cache is
      full are higher.

      If we make sure that the hit count can never go down to 0 again,
      unused entries will always have priority.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fa21e6faa6f1d7de49fd030ebdb0722b59cf9a41
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Feb 6 14:24:43 2015 +0300

      nbd: fix max_discard/max_transfer_length

      nbd_co_discard calls nbd_client_session_co_discard which uses uint32_t
      as the length in bytes of the data to discard due to the following
      definition:

      struct nbd_request {
          uint32_t magic;
          uint32_t type;
          uint64_t handle;
          uint64_t from;
          uint32_t len; <-- the length of data to be discarded, in bytes
      } QEMU_PACKED;

      Thus we should limit bl_max_discard to UINT32_MAX >> BDRV_SECTOR_BITS to
      avoid overflow.

      NBD read/write code uses the same structure for transfers. Fix
      max_transfer_length accordingly.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Peter Lieven <pl@kamp.de>
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 75af1f34cd5b07c3c7fcf86dfc99a42de48a600d
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Feb 6 11:54:11 2015 +0100

      block: introduce BDRV_REQUEST_MAX_SECTORS

      we check and adjust request sizes at several places with
      sometimes inconsistent checks or default values:
       INT_MAX
       INT_MAX >> BDRV_SECTOR_BITS
       UINT_MAX >> BDRV_SECTOR_BITS
       SIZE_MAX >> BDRV_SECTOR_BITS

      This patches introdocues a macro for the maximal allowed sectors
      per request and uses it at several places.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1ce52846d3ce0e4b58caebcae84719bef6401fbb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:59 2015 -0500

      nbd: Improve error messages

      This patch makes use of the Error object for nbd_receive_negotiate() so
      that errors during negotiation look nicer.

      Furthermore, this patch adds an additional error message if the received
      magic was wrong, but would be correct for the other protocol version,
      respectively: So if an export name was specified, but the NBD server
      magic corresponds to an old handshake, this condition is explicitly
      signaled to the user, and vice versa.

      As these messages are now part of the "Could not open image" error
      message, additional filtering has to be employed in iotest 083, which
      this patch does as well.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a231cb272611c758d45135f6a35a4dd1beaf5585
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:58 2015 -0500

      iotests: Fix 104 for NBD

      _make_test_img sets up an NBD server, _cleanup_test_img shuts it down;
      thus, _cleanup_test_img has to be called before _make_test_img is
      invoked another time.

      Furthermore, the pipe through _filter_test_img was unnecessary;
      _make_test_img already takes care of that.

      And finally, a filter is added to _filter_img_info to replace
      "nbd://127.0.0.1:10810" by "TEST_DIR/t.IMGFMT", since the former is the
      way to express the full image path (normally the latter) for NBD tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 23ab6953f4675b8663888ce6cfe40f4191be3e48
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:57 2015 -0500

      iotests: Fix 100 for nbd

      In case of NBD, _make_test_img starts a new NBD server. Therefore,
      _cleanup_test_img (which shuts that server down) has to be invoked
      before the next _make_test_img call in order to make 100 work for NBD.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 53f9e77f4ed898a4ea4ad2bc118c06c336ba30dd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:56 2015 -0500

      iotests: Fix 083

      As of 8f9e835fd2e687d2bfe936819c3494af4343614d, probing should be
      disabled in the qemu-iotests (at least when using qemu-io). This broke
      083's reference output (which consisted mostly of "Could not read image
      for determining its format").

      This patch fixes it.

      Note that one case which failed before is now successful: Disconnect
      after data. This is due to qemu having read twice before (once for
      probing, once for the qemu-io read command), but only once now (the
      qemu-io read command). Therefore, reading is successful (which is
      correct).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e729fa6afed3aa917287b63034244f548b79ec60
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Jan 27 08:33:55 2015 -0500

      block: fix off-by-one error in qcow and qcow2

      This fixes an off-by-one error introduced in 9a29e18.  Both qcow and
      qcow2 need to make sure to leave room for string terminator '\0' for
      the backing file, so the max length of the non-terminated string is
      either 1023 or PATH_MAX - 1.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 319fc53e344d5cead970c74f088ae5c607d426b3
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jan 12 12:31:33 2015 +0000

      qemu-iotests: add 116 invalid QED input file tests

      These tests exercise error code paths in the QED image format.  The
      tests are very simple, they just prove that the error path exits
      cleanly.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1421065893-18875-3-git-send-email-stefanha@redhat.com
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0adfa1ed655904d5bf17fe047635a563f0229789
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jan 12 12:31:32 2015 +0000

      qed: check for header size overflow

      Header size is denoted in clusters.  The maximum cluster size is 64 MB
      but there is no limit on header size.  Check for uint32_t overflow in
      case the header size field has a whacky value.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1421065893-18875-2-git-send-email-stefanha@redhat.com
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 177b75104da3e3a9af84975c32a44782d903c41f
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:15 2015 +0100

      block/dmg: improve zeroes handling

      Disk images may contain large all-zeroes gaps (1.66k sectors or 812 MiB
      is seen in the real world). These blocks (type 2) do not need to be
      extracted into a temporary buffer, there is no need to allocate memory
      for these blocks nor to check its length.

      (For the test image, the maximum uncompressed size is 1054371 bytes,
      probably for a bzip2-compressed block.)

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-13-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6b383c08c46468ecee98ecf71ffd8362e9bd7f42
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:14 2015 +0100

      block/dmg: support bzip2 block entry types

      This patch adds support for bzip2-compressed block entries as introduced
      with OS X 10.4 (source: https://en.wikipedia.org/wiki/Apple_Disk_Image).

      It was tested against a 5.2G "OS X Yosemite" installation image which
      stores the BLXX block in the XML property list (instead of resource
      forks) and has over 5k chunks.

      New configure entries are added (--enable-bzip2 / --disable-bzip2) to
      control inclusion of bzip2 functionality (which requires linking against
      libbz2). The help message suggests that this option is needed for DMG
      files, but the tests are generic enough that other parts of QEMU can use
      bzip2 if needed.

      The identifiers are based on http://newosxbook.com/DMG.html.

      The decompression routines are based on the zlib case, but as there is
      no way to reset the decompression state (unlike zlib), memory is
      allocated and deallocated for every decompression. This should not be
      problematic as the decompression takes most of the time and as blocks
      are typically about/over 1 MiB in size, only one allocation is done
      every 2000 sectors.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1420566495-13284-12-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a8b10c6ead7f62e8eadbdaf944f371889c3c4c29
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:13 2015 +0100

      block/dmg: factor out block type check

      In preparation for adding bzip2 support, split the type check into a
      separate function. Make all offsets relative to the begin of a chunk
      such that it is easier to recognize the position without having to
      add up all offsets. Some comments are added to describe the fields.

      There is no functional change.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-11-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 66ec3bba972b6d4433698397d25d039c230949dc
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:12 2015 +0100

      block/dmg: use SectorNumber from BLKX header

      Previously the sector table parsing relied on the previous offset of
      the DMG file. Now it uses the sector number from the BLKX header
      (see http://newosxbook.com/DMG.html).

      The implementation of dmg2img (from vu1tur) does not base the output
      sector on the location of the terminator (0xffffffff) either so it
      should be safe to drop this dependency on the previous state.

      (It makes somehow makes sense, a terminator should halt further
      processing of a block and is perhaps used to preallocate some space.)

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-10-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6d34865fa02463cf34634f45369ebcc725b101b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:11 2015 +0100

      block/dmg: fix sector data offset calculation

      This patch addresses two issues:

       - The data fork offset was not taken into account, resulting in failure
         to read an InstallESD.dmg file (5164763151 bytes) which had a
         non-zero DataForkOffset field.
       - The offset of the previous block ("partition") was unconditionally
         added to the current block because older files would start the input
         offset of a new block at zero. Newer files (including vlc-2.1.5.dmg,
         tuxpaint-0.9.15-macosx.dmg and OS X Yosemite [MAS].dmg) failed in
         reads because these files have chunk offsets, relative to the begin
         of a data fork.

      Now the data offset of the mish is taken into account. While we could
      check that the data_offset is within the data fork, let's not do that
      here as it would only result in parse failures on invalid files (rather
      than gracefully handling such bad files). dmg_read will error out if
      the offset is incorrect.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-9-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8daf425794ed624083de98caab04b9fedb873420
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:10 2015 +0100

      block/dmg: set virtual size to a non-zero value

      Right now the virtual size is always reported as zero which makes it
      impossible to convert between formats.

      After this patch, the number of sectors will be read from the trailer
      ("koly" block).

      To verify the behavior, the output of `dmg2img foo.dmg foo.img` was
      compared against `qemu-img convert -f dmg -O raw foo.dmg foo.raw`. The
      tests showed that the file contents are exactly the same, except that
      QEMU creates a slightly larger file (it matches the total sectors
      count).

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-8-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0599e56ed468d245148530eb194be4a5056a0583
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:09 2015 +0100

      block/dmg: process XML plists

      The format is simple enough to avoid using a full-blown XML parser. It
      assumes that all BLKX items begin with the "mish" magic word, therefore
      it is not a problem if other values get matched which are not a BLKX
      block.

      The offsets are based on the description at
      http://newosxbook.com/DMG.html

      For compatibility with glib 2.12, use g_base64_decode (which
      additionally requires an extra buffer allocation) instead of
      g_base64_decode_inplace (which is only available since glib 2.20).

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-7-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f6e6652d7c9251236fc1ecc6cece36104c7af15b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:08 2015 +0100

      block/dmg: validate chunk size to avoid overflow

      Previously the chunk size was not checked, allowing for a large memory
      allocation. This patch checks whether the chunks size is within the
      resource fork length, and whether the resource fork is below the
      trailer of the dmg file.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-6-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7aee37b93a4f694cdd670807f30b8efd33d0c721
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:07 2015 +0100

      block/dmg: process a buffer instead of reading ints

      As the decoded plist XML is not a pointer in the file,
      dmg_read_mish_block must be able to process a buffer instead of a file
      pointer. Since the full buffer must be processed, let's change the
      return value again to just a success flag.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-5-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b0e8dc5d54225d2e7012bd306e62ac90ba6fc1ea
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:06 2015 +0100

      block/dmg: extract processing of resource forks

      Besides the offset, also read the resource length. This length is now
      used in the extracted function to verify the end of the resource fork
      against "count" from the resource fork.

      Instead of relying on the value of offset to conclude whether the
      resource fork is available or not (info_begin==0), check the
      rsrc_fork_length instead. This would allow a dmg file to begin with a
      resource fork. This seemingly unnecessary restriction was found while
      trying to craft a DMG file by hand.

      Other changes:

       - Do not require resource data offset to be 0x100 (but check that it
         is within bounds though).
       - Further improve boundary checking (resource data must be within
         the resource fork).
       - Use correct value for resource data length (spotted by John Snow)
       - Consider the resource data offset when determining info_end.
         This fixes an EINVAL on the tuxpaint dmg example.

      The resource fork format is documented at
      https://developer.apple.com/legacy/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf#page=151

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-4-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 65a1c7c96a64cd69269c9ba854fa347dd0bbda0b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:05 2015 +0100

      block/dmg: extract mish block decoding functionality

      Extract the mish block decoder such that this can be used for other
      formats in the future. A new DmgHeaderState struct is introduced to
      share state while decoding.

      The code is kept unchanged as much as possible, a "fail" label is added
      for example where a simple return would probably do. In dmg_open, the
      variable "tmp" is renamed to "rsrc_data_offset" for clarity and comments
      have been added explaining various data.

      Note that this patch has one subtle difference with the previous
      version which should not affect functionality. In the previous code,
      the end of a resource was inferred from the mish block (the offsets
      would be increased by the fields). In this patch, the resource length
      is used instead to avoid the need to rely on the previous offsets.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1420566495-13284-3-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fa8354bd226617e2afcc45c27a74959c15291cc0
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:04 2015 +0100

      block/dmg: properly detect the UDIF trailer

      DMG files have a variable length with a UDIF trailer at the end of a
      file. This UDIF trailer is essential as it describes the contents of
      the image. At the moment however, the start of this trailer is almost
      always incorrect as bdrv_getlength() returns a multiple of the block
      size (rounded up). This results in a failure to recognize DMG files,
      resulting in Invalid argument (EINVAL) errors.

      As there is no API to retrieve the real file size, look for the magic
      header in the last two sectors to find the start of this 512-byte UDIF
      trailer (the "koly" block).

      The resource fork offset ("info_begin") has its offset adjusted as the
      initial value of offset does not mean "end of file" anymore, but "begin
      of UDIF trailer".

      [Replaced error_set(errp, ERROR_CLASS_GENERIC_ERROR, ...) with
      error_setg(errp, ...) as discussed with Peter.
      --Stefan]

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1420566495-13284-2-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e2462113b2003085ad16f15e1442ded64e2d9a29
  Author: Francesco Romani <fromani@redhat.com>
  Date:   Mon Jan 12 14:11:13 2015 +0100

      block: add event when disk usage exceeds threshold

      Managing applications, like oVirt (http://www.ovirt.org), make extensive
      use of thin-provisioned disk images.
      To let the guest run smoothly and be not unnecessarily paused, oVirt sets
      a disk usage threshold (so called 'high water mark') based on the occupation
      of the device,  and automatically extends the image once the threshold
      is reached or exceeded.

      In order to detect the crossing of the threshold, oVirt has no choice but
      aggressively polling the QEMU monitor using the query-blockstats command.
      This lead to unnecessary system load, and is made even worse under scale:
      deployments with hundreds of VMs are no longer rare.

      To fix this, this patch adds:
      * A new monitor command `block-set-write-threshold', to set a mark for
        a given block device.
      * A new event `BLOCK_WRITE_THRESHOLD', to report if a block device
        usage exceeds the threshold.
      * A new `write_threshold' field into the `BlockDeviceInfo' structure,
        to report the configured threshold.

      This will allow the managing application to use smarter and more
      efficient monitoring, greatly reducing the need of polling.

      [Updated qemu-iotests 067 output to add the new 'write_threshold'
      property. --Stefan]
      [Changed g_assert_false() to !g_assert() to fix the build on older glib
      versions. --Kevin]

      Signed-off-by: Francesco Romani <fromani@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1421068273-692-1-git-send-email-fromani@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6440d44cea84451ee9facb1237a4e7251631df80
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Jan 23 14:28:34 2015 -0500

      iotests: Specify format for qemu-nbd

      This patch is necessary to suppress the "probed raw" warning when
      running raw over nbd tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 79e7a01954d5b171186ef1e946e9159417befc1e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 16 09:38:42 2015 +0800

      qemu-iotests: Fix supported_oses check

      There is a bug in the recently added sys.platform test, and we no longer
      run python tests, because "linux2" is the value to compare here. So do a
      prefix match. According to python doc [1], the way to use sys.platform
      is "unless you want to test for a specific system version, it is
      therefore recommended to use the following idiom":

      if sys.platform.startswith('freebsd'):
          # FreeBSD-specific code here...
      elif sys.platform.startswith('linux'):
          # Linux-specific code here...

      [1]: https://docs.python.org/2.7/library/sys.html#sys.platform

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c99495ac1b4a27cb57bf04ed1a169177aeea2649
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:22 2015 +0100

      virtio-blk: add a knob to disable request merging

      this adds a knob to disable request merging for debugging or benchmarks if dedired.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 95f7142abc86a916682bd735aecd90172ffa0d30
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:21 2015 +0100

      virtio-blk: introduce multiread

      this patch finally introduces multiread support to virtio-blk. While
      multiwrite support was there for a long time, read support was missing.

      The complete merge logic is moved into virtio-blk.c which has
      been the only user of request merging ever since. This is required
      to be able to merge chunks of requests and immediately invoke callbacks
      for those requests. Secondly, this is required to switch to
      direct invocation of coroutines which is planned at a later stage.

      The following benchmarks show the performance of running fio with
      4 worker threads on a local ram disk. The numbers show the average
      of 10 test runs after 1 run as warmup phase.

                    |        4k        |       64k        |        4k
      MB/s          | rd seq | rd rand | rd seq | rd rand | wr seq | wr rand
      --------------+--------+---------+--------+---------+--------+--------
      master        | 1221   | 1187    | 4178   | 4114    | 1745   | 1213
      multiread     | 1829   | 1189    | 4639   | 4110    | 1894   | 1216

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 454057b7d9b9ad141bd5df8c4075745e56b4870f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:20 2015 +0100

      block-backend: expose bs->bl.max_transfer_length

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d901f3c457ade0b4934427c0e8608dea31610720
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:19 2015 +0100

      hw/virtio-blk: add a constant for max number of merged requests

      As it was not obvious (at least for me) where the 32 comes from;
      add a constant for it.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f4564d53c6952c61fb3ed8ee17a6e0f2f6bf0857
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:18 2015 +0100

      block: add accounting for merged requests

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 35f5a49374098733247c640cbdcbafcfc792c11f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jan 28 09:51:13 2015 +0800

      qed: Really remove unused field QEDAIOCB.finished

      The commit 533ffb17a that removed qed_aiocb_info.cancel said to remove
      this but didn't do it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 61979a6adfc1c4590f31ca295998e160226785c4
  Author: Don Slutz <dslutz@verizon.com>
  Date:   Fri Jan 9 10:17:35 2015 -0500

      qemu-img: Add QEMU_PKGVERSION to QEMU_IMG_VERSION

      This is the same way vl.c handles this.

      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 98764152ad8ec9fa4e7bb6d8e10f8a7a7ce273d7
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 15:48:34 2015 +0100

      block: change default for discard and write zeroes to INT_MAX

      do not trim requests if the driver does not supply a limit
      through BlockLimits. For write zeroes we still keep a limit
      for the unsupported path to avoid allocating a big bounce buffer.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Suggested-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1cdc3239f1bb8c8f18954defe3cb813edc9df4a0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:16 2015 +0300

      block: use fallocate(FALLOC_FL_PUNCH_HOLE) & fallocate(0) to write zeroes

      This sequence works efficiently if FALLOC_FL_ZERO_RANGE is not supported.
      Unfortunately, FALLOC_FL_ZERO_RANGE is supported on really modern systems
      and only for a couple of filesystems. FALLOC_FL_PUNCH_HOLE is much more
      mature.

      The sequence of 2 operations FALLOC_FL_PUNCH_HOLE and 0 is necessary due
      to the following reasons:
      - FALLOC_FL_PUNCH_HOLE creates a hole in the file, the file becomes
        sparse. In order to retain original functionality we must allocate
        disk space afterwards. This is done using fallocate(0) call
      - fallocate(0) without preceeding FALLOC_FL_PUNCH_HOLE will do nothing
        if called above already allocated areas of the file, i.e. the content
        will not be zeroed

      This should increase the performance a bit for not-so-modern kernels.

      CC: Max Reitz <mreitz@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d50d82221934696633296975aa433fe8aeeac714
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:15 2015 +0300

      block/raw-posix: call plain fallocate in handle_aiocb_write_zeroes

      There is a possibility that we are extending our image and thus writing
      zeroes beyond the end of the file. In this case we do not need to care
      about the hole to make sure that there is no data in the file under
      this offset (pre-condition to fallocate(0) to work). We could simply call
      fallocate(0).

      This improves the performance of writing zeroes even on really old
      platforms which do not have even FALLOC_FL_PUNCH_HOLE.

      Before the patch do_fallocate was used when either
      CONFIG_FALLOCATE_PUNCH_HOLE or CONFIG_FALLOCATE_ZERO_RANGE are defined.
      Now the story is different. CONFIG_FALLOCATE is defined when Linux
      fallocate is defined, posix_fallocate is completely different story
      (CONFIG_POSIX_FALLOCATE). CONFIG_FALLOCATE is mandatory prerequite
      for both CONFIG_FALLOCATE_PUNCH_HOLE and CONFIG_FALLOCATE_ZERO_RANGE
      thus we are on the safe side.

      CC: Max Reitz <mreitz@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b953f075007a7860adce9fa410b2e116a3d5e29c
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:14 2015 +0300

      block: use fallocate(FALLOC_FL_ZERO_RANGE) in handle_aiocb_write_zeroes

      This efficiently writes zeroes on Linux if the kernel is capable enough.
      FALLOC_FL_ZERO_RANGE correctly handles all cases, including and not
      including file expansion.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 37cc9f7f684ed035da63274daca1594c7ee16213
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:13 2015 +0300

      block/raw-posix: refactor handle_aiocb_write_zeroes a bit

      move code dealing with a block device to a separate function. This will
      allow to implement additional processing for ordinary files.

      Please note, that xfs_code has been moved before checking for
      s->has_write_zeroes as xfs_write_zeroes does not touch this flag inside.
      This makes code a bit more consistent.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b99171230bcdfe49956f283fc2e51a37efc7bfc
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:12 2015 +0300

      block/raw-posix: create do_fallocate helper

      The pattern
          do {
              if (fallocate(s->fd, mode, offset, len) == 0) {
                  return 0;
              }
          } while (errno == EINTR);
          ret = translate_err(-errno);
      will be commonly useful in next patches. Create helper for it.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1486df0e312613c6f235ee08488c90cc6b987094
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:11 2015 +0300

      block/raw-posix: create translate_err helper to merge errno values

      actually the code
          if (ret == -ENODEV || ret == -ENOSYS || ret == -EOPNOTSUPP ||
              ret == -ENOTTY) {
              ret = -ENOTSUP;
          }
      is present twice and will be added a couple more times. Create helper
      for this.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a71754e5b03fd3b8b8c6d3bc2a39f75bead729de
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Dec 9 18:15:09 2014 +0000

      atapi migration: Throw recoverable error to avoid recovery

      (With the previous atapi_dma flag recovery)
      If migration happens between the ATAPI command being written and the
      bmdma being started, the DMA is dropped.  Eventually the guest times
      out and recovers, but that can take many seconds.
      (This is rare, on a pingpong reading the CD continuously I hit
      this about ~1/30-1/50 migrates)

      I don't think we've got enough state to be able to recover safely
      at this point, so I throw a 'medium error, no seek complete'
      that I'm assuming guests will try and recover from an apparently
      dirty CD.

      OK, it's a hack, the real solution is probably to push a lot of
      ATAPI state into the migration stream, but this is a fix that
      works with no stream changes. Tested only on Linux (both RHEL5
      (pre-libata) and RHEL7).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 819fa276311ce328a8e38ad9306c1093961b3f4b
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Dec 9 18:15:08 2014 +0000

      Restore atapi_dma flag across migration

      If a migration happens just after the guest has kicked
      off an ATAPI command and kicked off DMA, we lose the atapi_dma
      flag, and the destination tries to complete the command as PIO
      rather than DMA.  This upsets Linux; modern libata based kernels
      stumble and recover OK, older kernels end up passing bad data
      to userspace.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a2f2d288b5a06e6c680c387c9980d91363f59c61
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 18:57:35 2015 +0000

      softfloat: expand out STATUS macro

      Expand out and remove the STATUS macro.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ff32e16e865c78fb54187723f3fd09650cd9b962
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 18:47:16 2015 +0000

      softfloat: expand out STATUS_VAR

      Expand out and remove the STATUS_VAR macro.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e5a41ffa870ad096eb2f084447fea5dd00a51b31
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 30 12:04:16 2015 +0000

      softfloat: Expand out the STATUS_PARAM macro

      Expand out STATUS_PARAM wherever it is used and delete the definition.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit cebbae86b4f7ee3d3dd9df906b97d269e70d9cc7
  Merge: b93acb9 2c4681f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 14:35:52 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri 06 Feb 2015 14:10:40 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        monitor: more accurate completion for host_net_remove()
        net: del hub port when peer is deleted
        net: remove the wrong comment in net_init_hubport()
        monitor: print hub port name during info network
        rtl8139: simplify timer logic
        MAINTAINERS: add Jason Wang as net subsystem maintainer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2c4681f512822b4aa35371683e164d4818f21dce
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:38 2015 +0800

      monitor: more accurate completion for host_net_remove()

      Current completion for host_net_remove will show hub ports and clients
      that were not peered with hub ports. Fix this.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-4-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 64a55d60665245174acf6445e0e3f1ec7a53cfe0
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:37 2015 +0800

      net: del hub port when peer is deleted

      We should del hub port when peer is deleted since it will not be reused
      and will only be freed during exit.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-3-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 07636d53999092daa9e3d281ea137be0795d7078
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:36 2015 +0800

      net: remove the wrong comment in net_init_hubport()

      Not only nic could be the one to peer.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-2-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6efd6ae7b8696bfeb0336826b01bfe0e1840154
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:35 2015 +0800

      monitor: print hub port name during info network

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-1-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 237c255c6cefefda9c5dd077860cfa20a77d9a6a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 15:44:59 2015 +0100

      rtl8139: simplify timer logic

      Pavel Dovgalyuk reports that TimerExpire and the timer are not restored
      correctly on the receiving end of migration.

      It is not clear to me whether this is really the case, but we can take
      the occasion to get rid of the complicated code that computes PCSTimeout
      on the fly upon changes to IntrStatus/IntrMask.  Just always keep a
      timer running, it will fire every ~130 seconds at most if the interrupt
      is masked with TimerInt != 0.

      This makes rtl8139_set_next_tctr_time idempotent (when the virtual clock
      is stopped between two calls, as is the case during migration).

      Tested with Frediano's qtest.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421765099-26190-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b93acb92cad1f38737e481fc85cb5c41a559d855
  Merge: b3cd91e dd9fe29
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 13:46:12 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

      # gpg: Signature made Fri 06 Feb 2015 13:45:06 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/tracing-pull-request:
        trace: Print PID and time in stderr traces

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dd9fe29c80b8a35f12d98928a97be3aded80cf69
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Jan 20 09:41:15 2015 +0000

      trace: Print PID and time in stderr traces

      When debugging migration it's useful to know the PID of
      each trace message so you can figure out if it came from the source
      or the destination.

      Printing the time makes it easy to do latency measurements or timings
      between trace points.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Message-id: 1421746875-9962-1-git-send-email-dgilbert@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b3cd91e0eaf5c962cf139ce6ca59392c8b00f177
  Merge: 651621b bb42631
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 17:11:50 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150205' into staging

      migration/next for 20150205

      # gpg: Signature made Thu 05 Feb 2015 16:17:08 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150205:
        fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail
        Tracify migration/rdma.c
        Add migration stream analyzation script
        migration: Append JSON description of migration stream
        qemu-file: Add fast ftell code path
        QJSON: Add JSON writer
        Print errors in some of the early migration failure cases.
        Migration: Add lots of trace events
        savevm: Convert fprintf to error_report
        vmstate-static-checker: update whitelist

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 651621b780515f35711c5d7305310ab1d241c7e2
  Merge: cd07b19 8c413e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 16:40:00 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-02-05' into staging

      coverity: Improve and extend model

      # gpg: Signature made Thu 05 Feb 2015 16:20:49 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-02-05:
        MAINTAINERS: Add myself as Coverity model maintainer
        coverity: Model g_free() isn't necessarily free()
        coverity: Model GLib string allocation partially
        coverity: Improve model for GLib memory allocation

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bb426311901776b95b021cece831b69dce4ef5ee
  Author: Zhang Haoyu <zhanghy@sangfor.com.cn>
  Date:   Thu Feb 5 19:33:11 2015 +0800

      fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail

      fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail
      during incoming migration or loadvm.

      Signed-off-by: Zhang Haoyu <zhanghy@sangfor.com.cn>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8c413e7902ef0c19ced516f575db989ccc3785f8
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 11:29:57 2015 +0100

      MAINTAINERS: Add myself as Coverity model maintainer

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 733252deb8b7d37beacda5976c2769e18642b2fa
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Feb 2 19:53:33 2015 +0000

      Tracify migration/rdma.c

      Turn all the D/DD/DDDPRINTFs into trace events
      Turn most of the fprintf(stderr, into error_report

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b17425701d66e4fd380fc492a1da9fc4152ba909
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:40 2015 +0100

      Add migration stream analyzation script

      This patch adds a python tool to the scripts directory that can read
      a dumped migration stream if it contains the JSON description of the
      device states. I constructs a human readable JSON stream out of it.

      It's very simple to use:

        $ qemu-system-x86_64
          (qemu) migrate "exec:cat > mig"
        $ ./scripts/analyze_migration.py -f mig

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8118f0950fc77cce7873002a5021172dd6e040b5
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:39 2015 +0100

      migration: Append JSON description of migration stream

      One of the annoyances of the current migration format is the fact that
      it's not self-describing. In fact, it's not properly describing at all.
      Some code randomly scattered throughout QEMU elaborates roughly how to
      read and write a stream of bytes.

      We discussed an idea during KVM Forum 2013 to add a JSON description of
      the migration protocol itself to the migration stream. This patch
      adds a section after the VM_END migration end marker that contains
      description data on what the device sections of the stream are composed of.

      This approach is backwards compatible with any QEMU version reading the
      stream, because QEMU just stops reading after the VM_END marker and ignores
      any data following it.

      With an additional external program this allows us to decipher the
      contents of any migration stream and hopefully make migration bugs easier
      to track down.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 972214001120e4cf2f4ac35b6ccbd1777b11e060
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:38 2015 +0100

      qemu-file: Add fast ftell code path

      For ftell we flush the output buffer to ensure that we don't have anything
      lingering in our internal buffers. This is a very safe thing to do.

      However, with the dynamic size measurement that the dynamic vmstate
      description will bring this would turn out quite slow.

      Instead, we can fast path this specific measurement and just take the
      internal buffers into account when telling the kernel our position.

      I'm sure I overlooked some corner cases where this doesn't work, so
      instead of tuning the safe, existing version, this patch adds a fast
      variant of ftell that gets used by the dynamic vmstate description code
      which isn't critical when it fails.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 190c882ce219ed89ac7d0633cfd11ad75fb0b46e
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:37 2015 +0100

      QJSON: Add JSON writer

      To support programmatic JSON assembly while keeping the code that generates it
      readable, this patch introduces a simple JSON writer. It emits JSON serially
      into a buffer in memory.

      The nice thing about this writer is its simplicity and low memory overhead.
      Unlike the QMP JSON writer, this one does not need to spawn QObjects for every
      element it wants to represent.

      This is a prerequisite for the migration stream format description generator.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0457d07342b175e3d2f0835bef1a67cf75dbc9d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:49 2015 +0000

      Print errors in some of the early migration failure cases.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit a5df2a0222f424d86d0fd0b50e909af892da7eea
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:48 2015 +0000

      Migration: Add lots of trace events

      Mostly on the load side, so that when we get a complaint about
      a migration failure we can figure out what it didn't like.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 6a64b644ac593aca3762644b9585033d7cac0a29
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:47 2015 +0000

      savevm: Convert fprintf to error_report

      Convert a bunch of fprintfs to error_reports

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 027f15696d145803fbafbfcce691444fbf0488fc
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Wed Jan 21 18:35:33 2015 +0530

      vmstate-static-checker: update whitelist

      Commit 22382bb96c8bd88370c1ff0cb28c3ee6bee79ed3 renamed the
      'hw_cursor_x' and 'hw_cursor_y' fields in cirrus_vga.  Update the static
      checker's whitelist to allow matching against the old and new names.

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7ad4c7200111d20eb97eed4f46b6026e3f0b0eef
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 26 21:37:15 2015 +0100

      coverity: Model g_free() isn't necessarily free()

      Memory allocated with GLib needs to be freed with GLib.  Freeing it
      with free() instead of g_free() is a common error.  Harmless when
      g_free() is a trivial wrapper around free(), which is commonly the
      case.  But model the difference anyway.

      In a local scan, this flags four ALLOC_FREE_MISMATCH.  Requires
      --enable ALLOC_FREE_MISMATCH, because the checker is still preview.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e4b77daa5724a9dd41aaa44d2dea4b8e92351081
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 26 15:05:11 2015 +0100

      coverity: Model GLib string allocation partially

      Without a model, Coverity can't know that the result of g_strdup()
      needs to be fed to g_free().

      One way to get such a model is to scan GLib, build a derived model
      file with cov-collect-models, and use that when scanning QEMU.
      Unfortunately, the Coverity Scan service we use doesn't support that.

      Thus, we're stuck with the other way: write a user model.  Doing that
      for all of GLib is hardly practical.  I'm doing it for the "String
      Utility Functions" we actually use that return dynamically allocated
      strings.

      In a local scan, this flags 20 additional RESOURCE_LEAKs.  The ones I
      checked look genuine.

      It also loses a NULL_RETURNS about ppce500_init() using
      qemu_find_file() without error checking.  I don't understand why.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d7a4c6690ef9962a3b20034f65008f1ea15c1d6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 22 11:21:37 2015 +0100

      coverity: Improve model for GLib memory allocation

      In current versions of GLib, g_new() may expand into g_malloc_n().
      When it does, Coverity can't see the memory allocation, because we
      don't model g_malloc_n().  Similarly for g_new0(), g_renew(),
      g_try_new(), g_try_new0(), g_try_renew().

      Model g_malloc_n(), g_malloc0_n(), g_realloc_n().  Model
      g_try_malloc_n(), g_try_malloc0_n(), g_try_realloc_n() by adding
      indeterminate out of memory conditions on top.

      To avoid undue duplication, replace the existing models for g_malloc()
      & friends by trivial wrappers around g_malloc_n() & friends.

      In a local scan, this flags four additional RESOURCE_LEAKs and one
      NULL_RETURNS.

      The NULL_RETURNS is a false positive: Coverity can now see that
      g_try_malloc(l1_sz * sizeof(uint64_t)) in
      qcow2_check_metadata_overlap() may return NULL, but is too stupid to
      recognize that a loop executing l1_sz times won't be entered then.

      Three out of the four RESOURCE_LEAKs appear genuine.  The false
      positive is in ppce500_prep_device_tree(): the pointer dies, but a
      pointer to a struct member escapes, and we get the pointer back for
      freeing with container_of().  Too funky for Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd07b19307bd185dccfd39052ac66d2730b32857
  Merge: 2c918a2 fc1792e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 14:22:51 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150205' into staging

      target-arm queue:
       * refactor/clean up armv7m_init()
       * some initial cleanup in the direction of supporting 64-bit EL3
       * fix broken synchronization of registers between QEMU and KVM
         for 32-bit ARM hosts (which among other things broke memory
         access via gdbstub)
       * fix flush-to-zero handling in FMULX, FRECPS, FRSQRTS and FRECPE
       * don't crash QEMU for UNPREDICTABLE BFI insns in A32 encoding
       * explain why virt board's device-to-transport mapping code is
         the way it is
       * implement mmu_idx values which match the architectural
         distinctions, and introduce the concept of a translation
         regime to get_phys_addr() rather than incorrectly looking
         at the current CPU state
       * update to upstream VIXL 1.7 (gives us correct code addresses
         when dissassembling pc-relative references)
       * sync system register state between KVM and QEMU for 64-bit ARM
       * support virtio on big-endian guests by implementing the
         "which endian is the guest now?" CPU method

      # gpg: Signature made Thu 05 Feb 2015 14:02:16 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150205: (28 commits)
        target-arm: fix for exponent comparison in recpe_f64
        target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64
        target-arm: KVM64: Get and Sync up guest register state like kvm32.
        disas/arm-a64.cc: Tell libvixl correct code addresses
        disas/libvixl: Update to upstream VIXL 1.7
        target-arm: Fix brace style in reindented code
        target-arm: Reindent ancient page-table-walk code
        target-arm: Use mmu_idx in get_phys_addr()
        target-arm: Pass mmu_idx to get_phys_addr()
        target-arm: Split AArch64 cases out of ats_write()
        target-arm: Don't define any MMU_MODE*_SUFFIXes
        target-arm: Use correct mmu_idx for unprivileged loads and stores
        target-arm: Define correct mmu_idx values and pass them in TB flags
        target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT
        target-arm: Make arm_current_el() return sensible values for M profile
        cpu_ldst.h: Allow NB_MMU_MODES to be 7
        hw/arm/virt: explain device-to-transport mapping in create_virtio_devices()
        target-arm: check that LSB <= MSB in BFI instruction
        target-arm: Squash input denormals in FRECPS and FRSQRTS
        Fix FMULX not squashing denormalized inputs when FZ is set.
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc1792e9aa36227ee9994757974f9397684e1a48
  Author: Ildar Isaev <ild@inbox.ru>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: fix for exponent comparison in recpe_f64

      f64 exponent in HELPER(recpe_f64) should be compared to 2045 rather than 1023
      (FPRecipEstimate in ARMV8 spec). This fixes incorrect underflow handling when
      flushing denormals to zero in the FRECPE instructions operating on 64-bit
      values.

      Signed-off-by: Ildar Isaev <ild@inbox.ru>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 84f2bed3cf505f90b7918e2de32e11da27160563
  Author: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64

      This patch implements a fucntion pointer "virtio_is_big_endian"
      from "CPUClass" structure for arm/arm64.
      Function arm_cpu_is_big_endian() is added to determine and
      return the guest cpu endianness to virtio.
      This is required for running cross endian guests with virtio on ARM/ARM64.

      Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
      Message-id: 1423130382-18640-3-git-send-email-pranavkumar@linaro.org
      [PMM: check CPSR_E in env->cpsr_uncached, not env->pstate.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 568bab1fb8cb2237f0134c4c5ffbc2a8ea26df69
  Author: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: KVM64: Get and Sync up guest register state like kvm32.

      This patch adds:
      1. Call write_kvmstate_to_list() and write_list_to_cpustate()
         in kvm_arch_get_registers() to sync guest register state.
      2. Call write_list_to_kvmstate() in kvm_arch_put_registers()
         to sync guest register state.

      These changes are already there for kvm32 in target-arm/kvm32.c.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
      Message-id: 1423130382-18640-2-git-send-email-pranavkumar@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8d298bee09f0cb8997c87006c0ff3a49a419837b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      disas/arm-a64.cc: Tell libvixl correct code addresses

      disassembling relative branches in code which doesn't reside at
      what the guest CPU would think its execution address is. Use
      the new MapCodeAddress() API to tell libvixl where the code is
      from the guest CPU's point of view so it can get the target
      addresses right.

      Previous disassembly:

      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x7f6cb7020434)
      0x0000000040000004:  aa1f03e1      mov x1, xzr
      0x0000000040000008:  aa1f03e2      mov x2, xzr
      0x000000004000000c:  aa1f03e3      mov x3, xzr
      0x0000000040000010:  58000084      ldr x4, pc+16 (addr 0x7f6cb702042c)
      0x0000000040000014:  d61f0080      br x4

      Fixed disassembly:
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)
      0x0000000040000004:  aa1f03e1      mov x1, xzr
      0x0000000040000008:  aa1f03e2      mov x2, xzr
      0x000000004000000c:  aa1f03e3      mov x3, xzr
      0x0000000040000010:  58000084      ldr x4, pc+16 (addr 0x40000020)
      0x0000000040000014:  d61f0080      br x4

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422274779-13359-3-git-send-email-peter.maydell@linaro.org

  commit d4eba98df4cca016c3cc88f519164b5c0e434e69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      disas/libvixl: Update to upstream VIXL 1.7

      Update our copy of libvixl to upstream's 1.7 release.
      This includes upstream's fix for the issue we had a local
      patch for in commit 94cc44a9e.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422274779-13359-2-git-send-email-peter.maydell@linaro.org

  commit 87c3d486150917c8e286d29166c98a2035377b52
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Fix brace style in reindented code

      This patch fixes the brace style in the code reindented in the
      previous commit.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 554b0b09aec4579c8164f363b18a263150e91a2c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Reindent ancient page-table-walk code

      A few of the oldest parts of the page-table-walk code have broken indent
      (either hardcoded tabs or two-spaces). Reindent these sections.

      For ease of review, this patch does not touch the brace style and
      so is a whitespace-only change.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 0480f69abf849ca0d48928cc6c669c1c7264239b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Use mmu_idx in get_phys_addr()

      Now we have the mmu_idx in get_phys_addr(), use it correctly to
      determine the behaviour of virtual to physical address translations,
      rather than using just an is_user flag and the current CPU state.

      Some TODO comments have been added to indicate where changes will
      need to be made to add EL2 and 64-bit EL3 support.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit d364970287c0ba68979711928c15e5d37414f87f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Pass mmu_idx to get_phys_addr()

      Make all the callers of get_phys_addr() pass it the correct
      mmu_idx rather than just a simple "is_user" flag. This includes
      properly decoding the AT/ATS system instructions; we include the
      logic for handling all the opc1/opc2 cases because we'll need
      them later for supporting EL2/EL3, even if we don't have the
      regdef stanzas yet.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 060e8a48cb84d41d4ac36e4bb29d9c14ed7168b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Split AArch64 cases out of ats_write()

      Instead of simply reusing ats_write() as the handler for both AArch32
      and AArch64 address translation operations, use a different function
      for each with the common code in a third function. This is necessary
      because the semantics for selecting the right translation regime are
      different; we are only getting away with sharing currently because
      we don't support EL2 and only support EL3 in AArch32.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 0dfef7b58f0c24b463e36630f08a45e93012b33a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Don't define any MMU_MODE*_SUFFIXes

      target-arm doesn't use any of the MMU-mode specific cpu ldst
      accessor functions. Suppress their generation by not defining
      any of the MMU_MODE*_SUFFIX macros. ("user" and "kernel" are
      too simplistic as descriptions of indexes 0 and 1 anyway.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 579d21cce63f3dd2f6ee49c0b02a14e92cb4a836
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Use correct mmu_idx for unprivileged loads and stores

      The MMU index to use for unprivileged loads and stores is more
      complicated than we currently implement:
       * for A64, it should be "if at EL1, access as if EL0; otherwise
         access at current EL"
       * for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise
         access as if at EL0".

      In both cases, if we want to make the access for Secure EL0
      this is not the same mmu_idx as for Non-Secure EL0.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit c1e3781090b9d36c60e1a254ba297cb34011d3d4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Define correct mmu_idx values and pass them in TB flags

      We currently claim that for ARM the mmu_idx should simply be the current
      exception level. However this isn't actually correct -- secure EL0 and EL1
      should have separate indexes from non-secure EL0 and EL1 since their
      VA->PA mappings may differ. We also will want an index for stage 2
      translations when we properly support EL2.

      Define and document all seven mmu index values that we require, and
      pass the mmu index in the TB flags rather than exception level or
      priv/user bit.

      This change doesn't update the get_phys_addr() code, so our page
      table walking still assumes a simplistic "user or priv?" model for
      the moment.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      ---
      This leaves some odd gaps in the TB flags usage. I will circle
      back and clean this up later (including moving the other common
      flags like the singlestep ones to the top of the flags word),
      but I didn't want to bloat this patchseries further.

  commit 949013ce111eb64f8bc81cf9a9f1cefd6a1678c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT

      The LDT/STT (load/store unprivileged) instruction decode was using
      the wrong MMU index value. This meant that instead of these insns
      being "always access as if user-mode regardless of current privilege"
      they were "always access as if kernel-mode regardless of current
      privilege". This went unnoticed because AArch64 Linux doesn't use
      these instructions.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      ---
      I'm not counting this as a security issue because I'm assuming
      nobody treats TCG guests as a security boundary (certainly I
      would not recommend doing so...)

  commit 6d54ed3c93f1e05a483201b087142998381c9be8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Make arm_current_el() return sensible values for M profile

      Although M profile doesn't have the same concept of exception level
      as A profile, it does have a notion of privileged versus not, which
      we currently track in the privmode TB flag. Support returning this
      information if arm_current_el() is called on an M profile core, so
      that we can identify the correct MMU index to use (and put the MMU
      index in the TB flags) without having to special-case M profile.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit 8f3ae2ae2d02727f6d56610c09d7535e43650dd4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      cpu_ldst.h: Allow NB_MMU_MODES to be 7

      Support guest CPUs which need 7 MMU index values.
      Add a comment about what would be required to raise the limit
      further (trivial for 8, TCG backend rework for 9 or more).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 587078f0ed6371f83a54228faed70867d3137954
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      hw/arm/virt: explain device-to-transport mapping in create_virtio_devices()

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1422592273-4432-1-git-send-email-lersek@redhat.com
      [PMM: added note recommending UUIDs]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 45140a57675ecb4b0daee71bf145c24dbdf9429c
  Author: Kirill Batuzov <batuzovk@ispras.ru>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: check that LSB <= MSB in BFI instruction

      The documentation states that if LSB > MSB in BFI instruction behaviour
      is unpredictable. Currently QEMU crashes because of assertion failure in
      this case:

      tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

      While assertion failure may meet the "unpredictable" definition this
      behaviour is undesirable because it allows an unprivileged guest program
      to crash the emulator with the OS and other programs.

      This patch addresses the issue by throwing illegal instruction exception
      if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
      has this check in place.

      To reproduce issue run the following program

      int main(void) {
          asm volatile (".long 0x07c00c12" :: );
          return 0;
      }

      compiled with
        gcc -marm -static badop_arm.c -o badop_arm

      Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8eb6e19991d1a7a6a7b04ac447548d30d75eb4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Squash input denormals in FRECPS and FRSQRTS

      The helper functions for FRECPS and FRSQRTS have special case
      handling that includes checks for zero inputs, so squash input
      denormals if necessary before those checks. This fixes incorrect
      output when the FPCR DZ bit is set to enable squashing of input
      denormals.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

  commit dabf005808f0830313f313c76a492294ef3bce6a
  Author: Xiangyu Hu <libhu.so@gmail.com>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      Fix FMULX not squashing denormalized inputs when FZ is set.

      While FMULX returns a 2.0f float when two operators are infinity and
      zero, those operators should be unpacked from raw inputs first. Inconsistent
      cases would occur when operators are denormalized floats in flush-to-zero
      mode. A wrong codepath will be entered and 2.0f will not be returned
      without this patch.
      Fix by checking whether inputs need to be flushed before running into
      different codepaths.

      Signed-off-by: Xiangyu Hu <libhu.so@gmail.com>
      Message-id: 1422459650-12490-1-git-send-email-libhu.so@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 375421ccaeebae8212eb8f9a36835ad4d9dc60a8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add checks that cpreg raw accesses are handled

      Add assertion checking when cpreg structures are registered that they
      either forbid raw-access attempts or at least make an attempt at
      handling them. Also add an assert in the raw-accessor-of-last-resort,
      to avoid silently doing a read or write from offset zero, which is
      actually AArch32 CPU register r0.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422282372-13735-3-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit 7a0e58fa648736a75f2a6943afd2ab08ea15b8e0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Split NO_MIGRATE into ALIAS and NO_RAW

      We currently mark ARM coprocessor/system register definitions with
      the flag ARM_CP_NO_MIGRATE for two different reasons:
      1) register is an alias on to state that's also visible via
         some other register, and that other register is the one
         responsible for migrating the state
      2) register is not actually state at all (for instance the TLB
         or cache maintenance operation "registers") and it makes no
         sense to attempt to migrate it or otherwise access the raw state

      This works fine for identifying which registers should be ignored
      when performing migration, but we also use the same functions for
      synchronizing system register state between QEMU and the kernel
      when using KVM. In this case we don't want to try to sync state
      into registers in category 2, but we do want to sync into registers
      in category 1, because the kernel might have picked a different
      one of the aliases as its choice for which one to expose for
      migration. (In particular, on 32 bit hosts the kernel will
      expose the state in the AArch32 version of the register, but
      TCG's convention is to mark the AArch64 version as the version
      to migrate, even if the CPU being emulated happens to be 32 bit,
      so almost all system registers will hit this issue now that we've
      added AArch64 system emulation.)

      Fix this by splitting the NO_MIGRATE flag in two (ALIAS and NO_RAW)
      corresponding to the two different reasons we might not want to
      migrate a register. When setting up the TCG list of registers to
      migrate we honour both flags; when populating the list from KVM,
      only ignore registers which are NO_RAW.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1422282372-13735-2-git-send-email-peter.maydell@linaro.org
      [PMM: changed ARM_CP_NO_MIGRATE to ARM_CP_ALIAS on new SP_EL1 and
       SP_EL2 reginfo stanzas since there was a (semantic) merge conflict
       with the patchset that added those]

  commit 884b4deeeb8b158ed3db5792161902bc8b41b62d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add missing SP_ELx register definition

      Added CP register definitions for SP_EL1 and SP_EL2.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5097227c15aa89baec1123aac25dd9500a62684d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Change reset to highest available EL

      Update to arm_cpu_reset() to reset into the highest available exception level
      based on the set ARM features.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be8e8128595b41b9f609c1507e67d121e65e7173
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add extended RVBAR support

      Added RVBAR_EL2 and RVBAR_EL3 CP register support.  All RVBAR_EL# registers
      point to the same location and only the highest EL version exists at any one
      time.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 569b49f864e7593a14182acae5a7f5981f6ec24f
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target-arm: Fix RVBAR_EL1 register encoding

      Fix the RVBAR_EL1 CP register opc2 encoding from 2 to 1

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8b47b7da29121ecddb173dd4afb82d6fb0eece37
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target_arm: Parameterise the irq lines for armv7m_init

      This patch allows the board to specifiy the number of NVIC interrupt
      lines when using armv7m_init.

      Signed-off-by: Alistair Francis <alistair23@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5a0b0fcc778df0340899f488053acc9493679e03.1422077994.git.alistair23@gmail.com
      [PMM: removed stale FIXME comment]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fe6ac447add80978c1bf988c3ef4a7ce8aab2fa0
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target_arm: Remove memory region init from armv7m_init

      This patch moves the memory region init code from the
      armv7m_init function to the stellaris_init function

      Signed-off-by: Alistair Francis <alistair23@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 4836be7e1d708554d6eb0bc639dc2fbf7dac0458.1422077994.git.alistair23@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2c918a245ca2a0b3339b8ded926b3f887d6d409e
  Merge: 32193cb 2ad28a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 11:11:56 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-05' into staging

      qmp hmp balloon: Cleanups around error reporting

      # gpg: Signature made Thu 05 Feb 2015 07:15:11 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-05:
        balloon: Eliminate silly QERR_ macros
        balloon: Factor out common "is balloon active" test
        balloon: Inline qemu_balloon(), qemu_balloon_status()
        qmp: Eliminate silly QERR_COMMAND_NOT_FOUND macro
        qmp: Simplify recognition of capability negotiation command
        qmp: Clean up qmp_query_spice() #ifndef !CONFIG_SPICE dummy
        hmp: Compile hmp_info_spice() only with CONFIG_SPICE
        qmp hmp: Improve error messages when SPICE is not in use
        qmp hmp: Factor out common "using spice" test

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 442469e61d276440d485b80514c0df89266fdc13
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jan 20 15:40:38 2015 +0000

      MAINTAINERS: add Jason Wang as net subsystem maintainer

      Jason Wang will be co-maintaining the QEMU net subsystem with me.  He
      has contributed improvements and reviewed patches over the past years as
      part of working on virtio-net and virtualized networking.

      Jason has already been backing me up with patch reviews.  For the time
      being I will continue to submit pull requests.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Jason Wang <jasowang@redhat.com>

  commit 32193cb421cecb98b48715e0740b2d948cda0779
  Merge: ec6f25e 3a4dbe6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 10:19:38 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150204.0' into staging

      VFIO fixes:
      - Fix wrong initializer (Chen Fan)
      - Add missing object_unparent (Alex Williamson)

      # gpg: Signature made Wed 04 Feb 2015 18:49:24 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150204.0:
        vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion
        vfio: fix wrong initialize vfio_group_list

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3a4dbe6aa934370a92372528c1255ee1504965ee
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Feb 4 11:45:32 2015 -0700

      vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion

      Commit d8d95814609e added explicit object_unparent() calls for
      dynamically allocated MemoryRegions.  The VFIOMSIXInfo structure also
      contains such a MemoryRegion, covering the mmap'd region of a PCI BAR
      above the MSI-X table.  This structure is freed as part of the class
      exit function and therefore also needs an explicit object_unparent().
      Failing to do this results in random segfaults due to fields within
      the structure, often the class pointer, being reclaimed and corrupted
      by the time object_finalize_child_property() is called for the object.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-stable@nongnu.org # 2.2

  commit 39cb514f02c7daf6378117e28be7a659a69e48b7
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Wed Feb 4 11:45:32 2015 -0700

      vfio: fix wrong initialize vfio_group_list

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ec6f25e788ef57ce1e9f734984ef8885172fd9e2
  Merge: 007c99f 9ef1473
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 3 21:37:16 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/pull-tg-s390-20150203' into staging

      s390 translator bug fixes

      # gpg: Signature made Tue 03 Feb 2015 20:39:15 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tg-s390-20150203:
        target-s390x: fix and optimize slb* and slbg* computation of carry/borrow flag
        target-s390x: support OC and NC in the EX instruction
        disas/s390.c: Remove unused variables
        target-s390x: Mark check_privileged() as !CONFIG_USER_ONLY
        target-s390: Implement ECAG
        target-s390: Implement LURA, LURAG, STURG
        target-s390: Fix STURA
        target-s390: Fix STIDP
        target-s390: Implement EPSW
        target-s390: Implement SAM specification exception

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9ef1473693a1400a903567489d3122fc9511765d
  Author: Torbjorn Granlund <torbjorng@google.com>
  Date:   Thu Jan 8 18:01:09 2015 +0100

      target-s390x: fix and optimize slb* and slbg* computation of carry/borrow flag

      This patch fixes the bug with borrow_in being set incorrectly, but it
      also simplifies the logic to be much more plain, improving speed.  It
      fixes both the 32-bit SLB* and 64-bit SLBG*.

      The SLBG* change has been well-tested.  I haven't tested the SLB* change
      explicitly, but the code was copy-pasted from the tested code.

      The error of these functions' current implementations would not likely
      be triggered by compiler-generated code, since the only error was in the
      state of the carry/borrow flag.  Compilers rarely generate an
      instruction sequence such as carry-set -> carry-set-and-use ->
      carry-use.

      (With Paolo's fix and mine, there are still a couple of failures from
      GMP's testsuite, but they are almost surely due to incorrect code
      generation from gcc 4.9.  But since this gcc is running under qemu, it
      might be qemu bugs.  I intend to investigate this.)

      Signed-off-by: Torbjorn Granlund <torbjorng@google.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8cf02f93dc37bc3de30dfb74eb0e904d1700dbf6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 8 18:01:08 2015 +0100

      target-s390x: support OC and NC in the EX instruction

      This is needed to run the GMP testsuite.

      Reported-by: Torbjorn Granlund <torbjorng@google.com>
      Tested-by: Torbjorn Granlund <torbjorng@google.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 5b279407704613dbee8bc0866817bf7006b487a5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 16:28:31 2015 +0000

      disas/s390.c: Remove unused variables

      The variables s390_opformats and s390_num_opformats are unused and
      provoke clang warnings:

      disas/s390.c:849:33: warning: variable 's390_opformats' is not needed and will not be emitted [-Wunneeded-internal-declaration]
      static const struct s390_opcode s390_opformats[] =
                                      ^
      disas/s390.c:875:18: warning: unused variable 's390_num_opformats' [-Wunused-const-variable]
      static const int s390_num_opformats =
                       ^

      Delete them, since QEMU doesn't use them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1419373100-17690-3-git-send-email-peter.maydell@linaro.org
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8841d9dfc7f871cec7c3401a8a2d31ad34e881f7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 16:28:30 2015 +0000

      target-s390x: Mark check_privileged() as !CONFIG_USER_ONLY

      The function check_privileged() is only used in the softmmu configs;
      wrap it in an #ifndef CONFIG_USER_ONLY to avoid clang warnings on the
      linux-user builds.

      [rth: Remove inline marker too; it was only there to prevent exactly
      this warning in GCC.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1419373100-17690-2-git-send-email-peter.maydell@linaro.org
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0774710f1bd052b05cc68ca3af06d8fc1a65664b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 15:34:34 2013 -0700

      target-s390: Implement ECAG

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9c3fd85b142f244ac1900b9da02f2d733d03c1b1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 13:04:28 2013 -0700

      target-s390: Implement LURA, LURAG, STURG

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 81822c2f42e0c3d7bf36f6eec92941de33ed92b8
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 12:46:49 2013 -0700

      target-s390: Fix STURA

      We were storing 16 bits instead of 32.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7f745b31b39cb9be8b3c3dfaf3173390ae07353e
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 11:33:41 2013 -0700

      target-s390: Fix STIDP

      The implementation had been incomplete, as we did not store the
      machine type.  Note that the machine_type member is still unset
      during initialization, so this has no effect yet.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit e30a9d3fea58c356000ce328421fe65e03143bb1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 6 09:48:08 2013 -0700

      target-s390: Implement EPSW

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8612c935831647c193281992738f96292428b9e6
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 6 09:31:37 2013 -0700

      target-s390: Implement SAM specification exception

      Also, these are user-mode instructions; allow their use
      in CONFIG_USER_ONLY.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 007c99fd0fb4e0f0579872bb71f5de99b5943dc2
  Merge: d5fbb4c 553ce81
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 3 13:19:52 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150203' into staging

      Some bugfixes and cleanups for s390x, both in the new pci code and
      in old code.

      # gpg: Signature made Tue 03 Feb 2015 13:01:04 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150203:
        pc-bios/s390-ccw: update binary
        pc-bios/s390-ccw: fix sparse warnings
        s390x/ipl: Improved code indentation in s390_ipl_init()
        s390x/kvm: unknown DIAGNOSE code should give a specification exception
        s390x/kvm: Fix diag-308 register decoding
        s390x/pci: fix dma notifications in rpcit instruction
        s390x/pci: check for invalid function handle
        s390x/pci: avoid sign extension in stpcifc
        s390: Plug memory leak on s390_pci_generate_event() error path

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 553ce81c31e49d834b1bf635ab486695a4694333
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Jan 26 15:51:37 2015 +0100

      pc-bios/s390-ccw: update binary

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f17a84300f3f3b5de45c8706a44d69d41d1727cb
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jan 22 13:44:26 2015 +0100

      pc-bios/s390-ccw: fix sparse warnings

      Fix some sparse warnings in the s390-ccw bios.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7691993c2b290dfedfb08a8eaa8cf7d5c6573fcb
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Feb 11 09:12:27 2014 +0100

      s390x/ipl: Improved code indentation in s390_ipl_init()

      The indentation of the code in s390_ipl_init() can be simplified
      a little bit by removing superfluous else-statements.

      Suggested-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 68540b1a1b505d9578699b03fe0b5da716a21dcc
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Dec 18 10:04:17 2014 +0100

      s390x/kvm: unknown DIAGNOSE code should give a specification exception

      As described in CP programming services an unimplemented DIAGNOSE
      function should return a specification exception. Today we give the
      guest an operation exception.
      As both exception types are suppressing and Linux as a guest does not
      care about the type of program check in its exception table handler
      as long as both types have the same kind of error handling (nullifying,
      terminating, suppressing etc.) this was unnoticed.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 20dd25bb67a51a4a57092b6381a6d4b0e64e2153
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Dec 8 14:19:13 2014 +0100

      s390x/kvm: Fix diag-308 register decoding

      Fix the decoding of the r1 register number in the diagnose 308 handler.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 4e99a0f7ae2a8392fd306c357148763ac4f820f9
  Author: Yi Min Zhao <zyimin@cn.ibm.com>
  Date:   Mon Jan 19 15:15:56 2015 +0800

      s390x/pci: fix dma notifications in rpcit instruction

      The virtual I/O address range passed to rpcit instruction might not
      map to consecutive physical guest pages. For this we have to translate
      and create mapping notifications for each vioa page separately.

      Signed-off-by: Yi Min Zhao <zyimin@cn.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 5b324bbafc4fe367bd9c5bfa6cff071081fb8b0e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Fri Jan 16 14:55:21 2015 +0100

      s390x/pci: check for invalid function handle

      broken guest may provide 0 (invalid) function handle to zpci
      instructions. Since we use function handle 0 to indicate an empty
      slot in the PHB we have to add an additional check to spot this
      kind of error.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit c0eb33ab5428edf85a29a4f91f64d6802b6cefaa
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Wed Jan 21 16:50:29 2015 +0100

      s390x/pci: avoid sign extension in stpcifc

      This patch avoids sign extension and fixes a data conversion
      bug in stpcifc. Both issues where found by Coverity.

      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b7022d9ac61311f92aef0994e2ab801b76d55f14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:56:37 2015 +0100

      s390: Plug memory leak on s390_pci_generate_event() error path

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d5fbb4c9ed52d97aebe5994d8a857c74c0d95a92
  Merge: 16017c4 2aeba9d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 19:36:02 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      The important bits here are the first part of RCU.

      v1->v2 changes are the new qemu-thread patch to fix Mac OS X,
      and cleaning up warnings.

      v2->v3 removed the patch to enable modules by default.

      # gpg: Signature made Mon 02 Feb 2015 19:28:03 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        scsi: Fix scsi_req_cancel_async for no aiocb req
        cpu-exec: simplify init_delay_params
        cpu-exec: simplify align_clocks
        memory: avoid ref/unref in memory_region_find
        memory: protect current_map by RCU
        memory: remove assertion on memory_region_destroy
        rcu: add call_rcu
        rcu: allow nesting of rcu_read_lock/rcu_read_unlock
        rcu: add rcutorture
        rcu: add rcu library
        qemu-thread: fix qemu_event without futexes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2aeba9d8a1b6121b98948fcd42fd2aa32f68b750
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 27 17:16:59 2015 +0800

      scsi: Fix scsi_req_cancel_async for no aiocb req

      scsi_req_cancel_complete is responsible for releasing the request, so we
      shouldn't skip it in any case. This doesn't affect the only existing
      caller, virtio-scsi, but is useful for other devices once they use it.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e91cc62f29a7359d00576a250a10892e00c95b4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 10:16:37 2015 +0100

      cpu-exec: simplify init_delay_params

      With the introduction of QEMU_CLOCK_VIRTUAL_RT, the computation of
      sc->diff_clk can be simplified nicely:

              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              qemu_clock_get_ns(QEMU_CLOCK_REALTIME) +
              cpu_get_clock_offset()

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - cpu_get_clock_offset())

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + timers_state.cpu_clock_offset)

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT)

      Cc: Sebastian Tanase <sebastian.tanase@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a498d0ef37cf23e1776240af61f558d113afdf4f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 10:09:55 2015 +0100

      cpu-exec: simplify align_clocks

      sc->diff_clk is already equal to sleep_delay (split in a second and a
      nanosecond part).  If you subtract sleep_delay - rem_delay, the result
      is exactly rem_delay.

      Cc: Sebastian Tanase <sebastian.tanase@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b647668c9092dbc26e36a2ece9647cc2f00e05b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri May 17 12:40:44 2013 +0200

      memory: avoid ref/unref in memory_region_find

      Do the entire lookup under RCU, which avoids atomic operations
      in flatview_ref and flatview_unref.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri May 17 12:37:03 2013 +0200

      memory: protect current_map by RCU

      Replace the flat_view_mutex with RCU, avoiding futex contention for
      dataplane on large systems and many iothreads.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b476c99d01519277e3494a10dc0329d07157ae02
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Tue Jul 2 16:51:15 2013 +0200

      memory: remove assertion on memory_region_destroy

      Now that memory_region_destroy can be called from an RCU callback,
      checking the BQL-protected global memory_region_transaction_depth
      does not make much sense.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 26387f86c9d6ac3a7a93b76108c502646afb6c25
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 13 17:49:24 2013 +0200

      rcu: add call_rcu

      Asynchronous callbacks provided by call_rcu are particularly important
      for QEMU, because the BQL makes it hard to use synchronize_rcu.

      In addition, the current RCU implementation is not particularly friendly
      to multiple concurrent synchronize_rcu callers, making call_rcu even
      more important.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d62cb4f2fdc0977f9ca9f41d297c3d2c44874171
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 13 17:34:15 2015 +0100

      rcu: allow nesting of rcu_read_lock/rcu_read_unlock

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8fda74a52bf3fa63cb80c877b6946cb9143f96cc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jun 21 09:09:34 2013 +0200

      rcu: add rcutorture

      rcutorture is the unit test for rcu.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7911747bd46123ef8d8eef2ee49422bb8a4b274f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 13 13:29:47 2013 +0200

      rcu: add rcu library

      This includes a (mangled) copy of the liburcu code.  The main changes
      are: 1) removing dependencies on many other header files in liburcu; 2)
      removing for simplicity the tentative busy waiting in synchronize_rcu,
      which has limited performance effects; 3) replacing futexes in
      synchronize_rcu with QemuEvents for Win32 portability.  The API is
      the same as liburcu, so it should be possible in the future to require
      liburcu on POSIX systems for example and use our copy only on Windows.

      Among the various versions available I chose urcu-mb, which is the
      least invasive implementation even though it does not have the
      fastest rcu_read_{lock,unlock} implementation.  The urcu flavor can
      be changed later, after benchmarking.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 158ef8cbb7e0fe8bb430310924b8bebe5f186e6e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 2 16:36:51 2015 +0100

      qemu-thread: fix qemu_event without futexes

      This had a possible deadlock that was visible with rcutorture.

          qemu_event_set                    qemu_event_wait
          ----------------------------------------------------------------
                                            cmpxchg reads FREE, writes BUSY
                                            futex_wait: pthread_mutex_lock
                                            futex_wait: value == BUSY
          xchg reads BUSY, writes SET
          futex_wake: pthread_cond_broadcast
                                            futex_wait: pthread_cond_wait
                                            <deadlock>

      The fix is simply to avoid condvar tricks and do the obvious locking
      around pthread_cond_broadcast:

          qemu_event_set        qemu_event_wait
          ----------------------------------------------------------------
                                            cmpxchg reads FREE, writes BUSY
                                            futex_wait: pthread_mutex_lock
                                            futex_wait: value == BUSY
          xchg reads BUSY, writes SET
          futex_wake: pthread_mutex_lock
          (blocks)
                                            futex_wait: pthread_cond_wait
          (mutex unlocked)
          futex_wake: pthread_cond_broadcast
          futex_wake: pthread_mutex_unlock
                                            futex_wait: pthread_mutex_unlock

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 16017c48547960539fcadb1f91d252124f442482
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:28 2015 +0000

      softfloat: Clarify license status

      The code in the softfloat source files is under a mixture of
      licenses: the original code and many changes from QEMU contributors
      are under the base SoftFloat-2a license; changes from Stefan Weil
      and RedHat employees are GPLv2-or-later; changes from Fabrice Bellard
      are under the BSD license. Clarify this in the comments at the
      top of each affected source file, including a statement about
      the assumed licensing for future contributions, so we don't need
      to remember to ask patch submitters explicitly to pick a license.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Aurelien Jarno <aurelien@aurel32.net>
      Acked-by: Avi Kivity <avi.kivity@gmail.com>
      Acked-by: Ben Taylor <bentaylor.solx86@gmail.com>
      Acked-by: Blue Swirl <blauwirbel@gmail.com>
      Acked-by: Christophe Lyon <christophe.lyon@st.com>
      Acked-by: Fabrice Bellard <fabrice@bellard.org>
      Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Acked-by: Juan Quintela <quintela@redhat.com>
      Acked-by: Max Filippov <jcmvbkbc@gmail.com>
      Acked-by: Paul Brook <paul@codesourcery.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Richard Henderson <rth@twiddle.net>
      Acked-by: Richard Sandiford <rdsandiford@googlemail.com>
      Acked-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-5-git-send-email-peter.maydell@linaro.org

  commit 332d5849708d11b835e0b36f4e26e8b36bfb3f5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:27 2015 +0000

      softfloat: Revert and reimplement remaining parts of b645bb4885 and 5a6932d51d

      Revert the parts of commits b645bb4885 and 5a6932d51d which are still
      in the codebase and under a SoftFloat-2b license.

      Reimplement support for architectures where the most significant bit
      in the mantissa is 1 for a signaling NaN rather than a quiet NaN,
      by adding handling for SNAN_BIT_IS_ONE being set to the functions
      which test values for NaN-ness.

      This includes restoring the bugfixes lost in the reversion where
      some of the float*_is_quiet_nan() functions were returning true
      for both signaling and quiet NaNs.

      [This is a mechanical squashing together of two separate "revert"
      and "reimplement" patches.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-4-git-send-email-peter.maydell@linaro.org

  commit 6bb8e0f130bd4aecfe835a0caa94390fa2235fde
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:26 2015 +0000

      softfloat: Revert and reimplement remaining portions of 75d62a5856 and 3430b0be36f

      Revert the remaining portions of commits 75d62a5856 and 3430b0be36f
      which are under a SoftFloat-2b license, ie the functions
      uint64_to_float32() and uint64_to_float64(). (The float64_to_uint64()
      and float64_to_uint64_round_to_zero() functions were completely
      rewritten in commits fb3ea83aa and 0a87a3107d so can stay.)

      Reimplement from scratch the uint64_to_float64() and uint64_to_float32()
      conversion functions.

      [This is a mechanical squashing together of two separate "revert"
      and "reimplement" patches.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-3-git-send-email-peter.maydell@linaro.org

  commit a7d1ac78e0f1101df2ff84502029a4b0da6024ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:25 2015 +0000

      softfloat: Apply patch corresponding to rebasing to softfloat-2a

      This commit applies the changes to master which correspond to
      replacing commit 158142c2c2df with a set of changes made by:
       * taking the SoftFloat-2a release
       * mechanically transforming the block comment style
       * reapplying Fabrice's original changes from 158142c2c2df

      This commit was created by:
       diff -u 158142c2c2df import-sf-2a
       patch  -p1 --fuzz 10 <../relicense-patch.txt
      (where import-sf-2a is the branch resulting from the changes above).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-2-git-send-email-peter.maydell@linaro.org

  commit 2ad28a088d2cc8fd404dfa58fa1b80f9225425ff
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:50:23 2015 +0100

      balloon: Eliminate silly QERR_ macros

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      up the balloon ones.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 422e0501a842fb4b3f42494f341707e809c3c6ad
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:44:14 2015 +0100

      balloon: Factor out common "is balloon active" test

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6502a14734e71b2f6dd079b0a1e546e6aa2d2f8d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:43:25 2015 +0100

      balloon: Inline qemu_balloon(), qemu_balloon_status()

      ... and simplify a bit.  Permits factoring out common error checks in
      the next commit.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a6c90cbccdc07d51d4bbff71d2680f1a2c287370
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 16:16:35 2015 +0100

      qmp: Eliminate silly QERR_COMMAND_NOT_FOUND macro

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      this one up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bb5224edfb1e6f94aabaa8070d11c8f95f8ae277
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 16:14:04 2015 +0100

      qmp: Simplify recognition of capability negotiation command

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ad0ec14bad645d9c0402047e858ea323151c8e9b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 15:56:11 2015 +0100

      qmp: Clean up qmp_query_spice() #ifndef !CONFIG_SPICE dummy

      QMP command query-spice exists only #ifdef CONFIG_SPICE.  Due to QAPI
      limitations, we need a dummy function anyway, but it's unreachable.

      Our current dummy function goes out of its way to produce the exact
      same error as the QMP core does for unknown commands.  Cute, but both
      unclean and unnecessary.  Replace by straight abort().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 206addd58f251666f5b64d43957ddcba465c0ef1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 15:46:39 2015 +0100

      hmp: Compile hmp_info_spice() only with CONFIG_SPICE

      It's dead code when CONFIG_SPICE is off.  If it wasn't, it would crash
      dereferencing the null pointer returned by the qmp_query_spice()
      dummy in qmp.c.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cfa9bb236911eaa30ac58072105881a65cbbb612
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:21:45 2015 +0100

      qmp hmp: Improve error messages when SPICE is not in use

      Commit 7572150 adopted QERR_DEVICE_NOT_ACTIVE for the purpose,
      probably because adding another error seemed cumbersome overkill.
      Produces "No spice device has been activated", which is awkward.

      We've since abandoned our quest for "rich" error objects.  Time to
      undo the damage to this error message.  Replace it by "SPICE is not in
      use".

      Keep the stupid DeviceNotActive ErrorClass for compatibility, even
      though Libvirt doesn't use it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b25d81ba332dc06757d40ffe64944ba27082de0a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:07:15 2015 +0100

      qmp hmp: Factor out common "using spice" test

      Into qemu_using_spice().  For want of a better place, put it next the
      existing monitor command handler dummies in qemu-spice.h.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 83761b9244ad2ed39d3cfabe8a0e901ab906f7bf
  Merge: b00c92e 30b8b68
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 22:25:56 2015 +0000

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150127' into staging

      linux-user updates since last pull request

      # gpg: Signature made Tue 27 Jan 2015 20:52:54 GMT using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150127:
        linux-user: support target-to-host SCM_CREDENTIALS
        linux-user: Fix broken m68k signal handling on 64 bit hosts
        mips64-linux-user: Fix definition of struct sigaltstack
        linux-user: Fix ioctl cmd type mismatch on 64-bit targets
        linux-user: translate resource also for prlimit64
        linux-user/signal.c: Remove unnecessary wrapper copy_siginfo_to_user
        linux-user/main.c: Mark end_exclusive() as possibly unused
        linux-user/main.c: Call cpu_exec_start/end on all target archs
        linux-user/arm/nwfpe: Delete unused aCC array
        linux-user/alpha: Add define for NR_shmat to enable shmat syscall
        linux-user/signal.c: Remove current_exec_domain_sig()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 30b8b68eb574fd68060eebcc4da790fdfe18d668
  Author: Alex Suykov <alex.suykov@gmail.com>
  Date:   Tue Dec 23 07:52:58 2014 +0200

      linux-user: support target-to-host SCM_CREDENTIALS

      When passing ancillary data through a unix socket, handle
      credentials properly instead of doing a simple copy and
      issuing a warning.

      Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1669add752d9f29283f8ebf6a863d7b1e2d0f146
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 17:47:00 2014 +0000

      linux-user: Fix broken m68k signal handling on 64 bit hosts

      The m68k signal frame setup code which writes the signal return
      trampoline code to the stack was assuming that a 'long' was 32 bits;
      on 64 bit systems this meant we would end up writing the 32 bit
      (2 insn) trampoline sequence to retaddr+4,retaddr+6 instead of
      the intended retaddr+0,retaddr+2, resulting in a guest crash when
      it tried to execute the invalid zero-bytes at retaddr+0.
      Fix by using uint32_t instead; also use uint16_t rather than short
      for consistency. This fixes bug LP:1404690.

      Reported-by: Michel Boaventura
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit ec355f15476fe91b95c4326836d3fe572d8075e1
  Author: Ed Swierk <eswierk@skyportsystems.com>
  Date:   Tue Dec 16 12:55:18 2014 -0800

      mips64-linux-user: Fix definition of struct sigaltstack

      Without this fix, qemu segfaults when emulating the sigaltstack syscall,
      because it incorrectly treats the ss_flags field as 64 bits rather than 32
      bits.

      Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 9c6bf9c7d71d7da18a024182b69569969449d6f9
  Author: Ed Swierk <eswierk@skyportsystems.com>
  Date:   Tue Dec 16 12:55:31 2014 -0800

      linux-user: Fix ioctl cmd type mismatch on 64-bit targets

      linux-user passes the cmd argument of the ioctl syscall as a signed long,
      but compares it to an unsigned int when iterating through the ioctl_entries
      list.  When the cmd is a large value like 0x80047476 (TARGET_TIOCSWINSZ on
      mips64) it gets sign-extended to 0xffffffff80047476, causing the comparison
      to fail and resulting in lots of spurious "Unsupported ioctl" errors.
      Changing the target_cmd field in the ioctl_entries list to a signed int
      causes those values to be sign-extended as well during the comparison.

      Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 95018018caeea209f58695645fd1d50a9d0ba6df
  Author: Felix Janda <felix.janda@posteo.de>
  Date:   Tue Dec 2 22:11:17 2014 +0100

      linux-user: translate resource also for prlimit64

      The resource argument is translated from host to target for
      [gs]etprlimit but not for prlimit64. Fix this.

      Signed-off-by: Felix Janda <felix.janda@posteo.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit f6c7a05b8985df7eaf9942ca78e19890204eee4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:48 2015 +0000

      linux-user/signal.c: Remove unnecessary wrapper copy_siginfo_to_user

      The function copy_siginfo_to_user() just calls tswap_siginfo(), so
      call the latter function directly and delete the wrapper function.
      The wrapper is actually misleading since it implies that the
      semantics are like the kernel function with the same name which
      copies the data to a guest user-space address. In fact tswap_siginfo()
      just does data-structure conversion between two structures whose
      addresses are host addresses (the copy to userspace is handled
      in QEMU by the lock_user/unlock_user calls).

      This also fixes clang complaints about the wrapper being unused
      in some configs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit f7e61b222b2796ee43c976ec44c61a15d55ff662
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:47 2015 +0000

      linux-user/main.c: Mark end_exclusive() as possibly unused

      The function end_exclusive() isn't used on all targets; mark it as
      such to avoid a clang warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b040bc9c0360106fab57bb1abe2d242bd17c4c32
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:46 2015 +0000

      linux-user/main.c: Call cpu_exec_start/end on all target archs

      The start_exclusive() infrastructure is used on all target
      architectures, even if only to do the "stop all CPUs before
      dumping core" in force_sig(), so be consistent and call
      cpu_exec_start/end in the main loop of every target.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1af2ee08f9b2f70d31676be14b26026223c9f660
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:45 2015 +0000

      linux-user/arm/nwfpe: Delete unused aCC array

      The aCC array in fpopcode.c is completely unused in QEMU; delete
      it (silencing a clang warning).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit ea2b5fb19d50c1cbdea9a40504e31e54d37b8bab
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:44 2015 +0000

      linux-user/alpha: Add define for NR_shmat to enable shmat syscall

      For historical reasons, the define for the shmat() syscall on Alpha is
      NR_osf_shmat; however it has the same semantics as this syscall does
      on all other architectures, so define TARGET_NR_shmat as well so that
      QEMU's code for the syscall is enabled.

      This patch brings our behaviour on the LTP shmat tests into line
      with that for ARM (still not a perfect pass rate but not "this syscall
      is completely broken" as we had before).

      (Problem detected via a clang warning that the do_shmat() function
      was unused on Alpha.)

      Cc: Richard Henderson <rth@twiddle.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b6e2c9353a5bd8649ee71a52c35344ce3fb1c7d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:43 2015 +0000

      linux-user/signal.c: Remove current_exec_domain_sig()

      Remove the function current_exec_domain_sig(), which always returns
      its argument. This was intended as a stub for supporting the kernel's
      exec_domain handling, but:
       * we don't have any of the other code for execution domains
       * in the kernel this handling is architecture-specific, not generic
       * we only call this function in the x86, ppc and sh4 signal code paths,
         and the PPC one is wrong anyway because the PPC kernel doesn't
         have this signal-remapping code

      So it's best to simply delete the function; any future attempt to
      implement exec domains will be better served by adding the correct
      code from scratch based on the kernel sources at that time.

      This change also fixes some clang warnings about the function being
      defined but not used for some target architectures.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b00c92e3ef59b78f6029d66353aaf995ceaa6605
  Merge: 7baef63 3715345
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 13:17:30 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, pc, virtio fixes and cleanups

      A bunch of fixes all over the place.  Also, beginning to generalize acpi build
      code for reuse by ARM.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Tue 27 Jan 2015 13:12:25 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        pc-dimm: Add Error argument to pc_existing_dimms_capacity
        pc-dimm: Make pc_existing_dimms_capacity global
        pc: Fix DIMMs capacity calculation
        smbios: Don't report unknown CPU speed (fix SVVP regression)
        smbios: Fix dimm size calculation when RAM is multiple of 16GB
        bios-linker-loader: move source to common location
        bios-linker-loader: move header to common location
        virtio: fix feature bit checks
        bios-tables-test: split piix4 and q35 tests
        acpi: build_append_nameseg(): add padding if necessary
        acpi: update generated hex files
        acpi-test: update expected DSDT
        pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
        pci: Split pcie_host_mmcfg_map()
        Add some trace calls to pci.c.
        ich9: add disable_s3, disable_s4, s4_val properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 37153450436f58449ce7e41d13a23821611e889e
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:02 2015 +0530

      pc-dimm: Add Error argument to pc_existing_dimms_capacity

      Now that pc_existing_dimms_capacity() is an API, include Error pointer
      as an argument and modify the caller appropriately.

      Suggested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 9967c94957f60c2d1cadbe0bfd4373a13fb1a226
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:01 2015 +0530

      pc-dimm: Make pc_existing_dimms_capacity global

      Move pc_existing_dimms_capacity() to pc-dimm.c since it would be needed
      by PowerPC memory hotplug code too.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 759048ac20174b34fa7a593f4da2e7fed34e599c
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:00 2015 +0530

      pc: Fix DIMMs capacity calculation

      pc_existing_dimms_capacity() is returning DIMMs count rather than capacity.
      Fix this to return the capacity. Also consider only realized devices for
      capacity calculation.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 07d01c9c1929e43216005fcc8eccea75776ee0d2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Jan 7 15:36:34 2015 -0200

      smbios: Don't report unknown CPU speed (fix SVVP regression)

      SVVP requires processor speed on Type 4 structures to not be unknown.
      This was fixed in SeaBIOS 0.5.0 (in 2009), but the bug was reintroduced
      in QEMU 2.1.

      Revert to old behavior and report CPU speed as 2000 MHz instead of
      unknown.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 744c6d474791ff3ad5c2f08edc732564199fd146
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Jan 7 15:36:33 2015 -0200

      smbios: Fix dimm size calculation when RAM is multiple of 16GB

      The Memory Device size calculation logic is broken when the RAM size is
      a multiple of 16GB, making the size of the last entry be 0 instead of
      16GB. Fix the logic to handle that case correctly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 09852232ee131d0bfa5bdf7f44a806158a5c8711
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jan 19 23:58:55 2015 +0200

      bios-linker-loader: move source to common location

      There are plans to use bios linker by MIPS, ARM.

      It's only used by ACPI ATM, so put it in hw/acpi
      and make it depend on CONFIG_ACPI.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0058ae1d9483f5f96c7798e2ae51cce42c69abfb
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jan 19 23:58:55 2015 +0200

      bios-linker-loader: move header to common location

      Will be usable by MIPS, ARM.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 91d5c57a2e98845c02cda026f3f6a88cb5e14225
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Dec 12 10:01:46 2014 +0100

      virtio: fix feature bit checks

      Several places check against the feature bit number instead of against
      the feature bit. Fix them.

      Cc: qemu-stable@nongnu.org
      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71f4be25d476c2865688da1e568257313cc2e511
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 19 17:50:38 2015 +0100

      bios-tables-test: split piix4 and q35 tests

      This makes it clear which one is failing.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit 6d848641b7a4da92840fb2f5c240d1668f5a9281
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Dec 19 11:47:00 2014 +0000

      acpi: build_append_nameseg(): add padding if necessary

      According to ACPI spec NameSeg shorter than 4 characters
      must be padded up to 4 characters with "_" symbol.
      ACPI 5.0:  20.2.2 "Name Objects Encoding"

      Do it in build_append_nameseg() so that caller shouldn't know
      or care about it.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e909c16d924c0dbb852de3c0dd3d9cb5213b90c5
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jan 27 14:40:44 2015 +0200

      acpi: update generated hex files

      Previous patch
          pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
      changed DSDT, update hex files for non-iasl builds.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 215d8d130be605c1927c764b027047c0ae0c6122
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jan 27 14:40:44 2015 +0200

      acpi-test: update expected DSDT

      Previous patch
          pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
      changed DSDT, update expected test files.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7baef630732a50fcbb7ca5b1e9cc0ecf4f2998c9
  Merge: 1ac0206 0953225
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 11:15:09 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150127' into staging

      tricore bugfixes and RR1, RR2, RRPW and RRR insn

      # gpg: Signature made Tue 27 Jan 2015 12:02:06 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150127:
        target-tricore: Add instructions of RRR opcode format
        target-tricore: Add instructions of RRPW opcode format
        target-tricore: Add instructions of RR2 opcode format
        target-tricore: Add instructions of RR1 opcode format, that have 0x93 as first opcode
        target-tricore: split up suov32 into suov32_pos and suov32_neg
        target-tricore: Fix bugs found by coverity
        target-tricore: calculate av bits before saturation
        target-tricore: Several translator and cpu model fixes
        target-tricore: Add missing ULL suffix on 64 bit constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0953225588ee30de2e92485331ad1bb3d7c7d089
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:43:07 2015 +0000

      target-tricore: Add instructions of RRR opcode format

      Add microcode generator function gen_cond_sub.

      Add helper functions:
          * ixmax/ixmin: search for the max/min value and its related index in a
                         vector of 16-bit values.
          * pack: dack two data registers into an IEEE-754 single precision floating
                  point format number.
          * dvadj: divide-adjust the result after dvstep instructions.
          * dvstep: divide a reg by a divisor, producing 8-bits of quotient at a time.

      OPCM_32_RRR_FLOAT -> OPCM_32_RRR_DIVIDE

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 8fb9d0eb68376363553d81525cc526842543e2dc
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:13:00 2015 +0000

      target-tricore: Add instructions of RRPW opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 12f323e66e2d850b0e27300d609deae6e7290457
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:05:01 2015 +0000

      target-tricore: Add instructions of RR2 opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f1cc6eafdd08817a234e0e1a9c8f03177a31faf1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 14:58:42 2015 +0000

      target-tricore: Add instructions of RR1 opcode format, that have 0x93 as first opcode

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 85d604af5f96c32734af9974ec6ddb625b6716a2
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 14:28:59 2015 +0000

      target-tricore: split up suov32 into suov32_pos and suov32_neg

      suov checks unsigned for an overflow and an underflow, after some arithmetic
      operations and saturates the result to either max_uint32 or 0. So far we
      handled this by expanding to the next bigger data type and compare whether
      the result is > max_uint32 or < 0.

      However this approach can fail for an 32 bit multiplication, if both operands of
      the multiplication are 0x80000000. This sets the sign bit of the 64 bit integer
      and would result in a false saturation to 0.

      Since unsigned operations, e.g add, sub, mul always result in either a positive
      or negative overflow, we split the functions for suov32 up into two functions
      (suov32_pos, suov32_neg) for each case.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 40a1f64b468ee247fca3b237f0b89f066e59626c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 16:16:01 2015 +0000

      target-tricore: Fix bugs found by coverity

      This fixes one bug and one false positive found by coverity. The bug is,
      that gen_mtcr was missing a mask to check the flag, which resulted in dead code.

      The false positive is a intentional missing break for a jump and link address
      insn followed by a jump and link insn. This adds a fall through comment to avoid
      the false positive in the future.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 811ea608e9721dc4f6933da440f235e7d3a39c0f
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 15:55:15 2015 +0000

      target-tricore: calculate av bits before saturation

      64 bit mac instructions calculated the av bits after the saturation, which
      resulted in a wrong PSW. This moves the av bit calculation before the
      saturation.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 5f30046f156c181fb4088da2f4b8ea25a7d07c7a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sat Jan 17 22:34:27 2015 +0000

      target-tricore: Several translator and cpu model fixes

      Fix tc1796 cpu model using wrong ISA version.
      Fix cond_add sometimes writing back wrong result.
      Fix RCR_SEL and RCR_SELN using wrong registers for result and cond.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 452e3d49d871f311f7b884dc69160c3e0973b050
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:24:09 2014 +0000

      target-tricore: Add missing ULL suffix on 64 bit constant

      Add a missing ULL suffix to a 64 bit constant: this suppresses a
      compiler warning from mingw32 gcc.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 6d4e4cb9985e24557abcf3932a0e7f8f6ab3c1d2
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Dec 19 11:46:57 2014 +0000

      pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled

      ACPI parser in XP considers PNP0A06 devices of CPU and
      memory hotplug as duplicates. Adding unique _UID
      to CPU hotplug device fixes BSOD.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 27fb9688f9162515901ebf29e3879788fd326ea7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Tue Jan 6 17:03:08 2015 +0100

      pci: Split pcie_host_mmcfg_map()

      The mmcfg space is a memory region that allows access to PCI config space
      in the PCIe world. To maintain abstraction layers, I would like to expose
      the mmcfg space as a sysbus mmio region rather than have it mapped straight
      into the system's memory address space though.

      So this patch splits the initialization of the mmcfg space from the actual
      mapping, allowing us to only have an mmfg memory region without the map.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>

  commit 7828d75045380ac659f2ad85fb5fec9bbb0746ac
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:20:51 2015 -0500

      Add some trace calls to pci.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6ac0d8d44c0966225b200cc25f8c5270f1191ec0
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Mon Jan 12 17:30:14 2015 +0530

      ich9: add disable_s3, disable_s4, s4_val properties

      PIIX4 has disable_s3 and disable_s4 properties to enable or disable PM
      functions.  Add such properties to the ICH9 chipset as well for the Q35
      machine type.

      S3 / S4 are not guaranteed to always work (needs work in the guest as
      well as QEMU for things to work properly), and disabling advertising of
      these features ensures guests don't go into zombie state if something
      isn't working right.

      The defaults are kept the same as in PIIX4: both S3 and S4 are enabled
      by default.

      These can be disabled via the cmdline:

        ... -global ICH9-LPC.disable_s3=1 -global ICH9-LPC.disable_s4=1

      Note: some guests can fake hibernation by writing a hibernate image and
      doing a shutdown instead of S4 if S4 isn't available; there's nothing we
      can do guests to stop doing this, and this patch can't affect that
      functionality.

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit 1ac0206b2ae1ffaeec564f110664a3a77bafafd2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 16:16:40 2015 +0000

      qemu-timer.c: Trim list of included headers

      qemu-timer.c was including a lot more headers than it needed to,
      presumably for historical reasons. In particular, it included
      ui/console.h; this now tries to pull in <pixman.h>, which will
      cause a compilation failure in --disable-tools --disable-system
      configurations when running "make check" (which builds qemu-timer.c,
      even though the linux-user binaries themselves don't need it).

      Fix this build failure by trimming down the set of included
      headers severely -- we only really need main-loop.h and timer.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421770600-17525-1-git-send-email-peter.maydell@linaro.org

  commit 074092d074f7a55378659223cf54ca06f6d0fbde
  Merge: 0c28d0d d01a5a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 13:11:16 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-26' into staging

      * remotes/sstabellini/xen-2015-01-26:
        fix QEMU build on Xen/ARM

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d01a5a3fe19645f3cdea1566f0e518ea2152a029
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Fri Jan 23 12:09:47 2015 +0000

      fix QEMU build on Xen/ARM

      xen_get_vmport_regs_pfn should take a xen_pfn_t argument, not an
      unsigned long argument (in fact xen_pfn_t is defined as uint64_t on
      ARM).

      Also use xc_hvm_param_get instead of the deprecated xc_get_hvm_param.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>

  commit 0c28d0d07fbcd7aa44d231241d444d00882256e2
  Merge: d109f80 fc116ef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 11:50:29 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - Many fixes from the floor as usual
      - New "edu" device (v1->v2: fix 32-bit compilation)
      - Disabling HLE and RTM on Haswell & Broadwell
      - kvm_stat updates
      - Added --enable-modules to Travis, in preparation for switching
        the default

      # gpg: Signature made Mon 26 Jan 2015 11:44:40 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        kvm_stat: Add RESET support for perf event ioctl
        target-i386: Disable HLE and RTM on Haswell & Broadwell
        sparse: Fix build with sparse on .S files
        exec: fix madvise of NULL pointer
        .travis.yml: Add "--enable-modules"
        apic: do not dereference pointer before it is checked for NULL
        kvm_stat: Print errno when syscall to perf_event_open() fails
        kvm_stat: Update exit reasons to the latest defintion
        kvm_stat: Add aarch64 support
        hw: misc, add educational driver
        vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*
        qemu-timer: introduce timer_deinit
        qemu-timer: add timer_init and timer_init_ns/us/ms
        target-i386: make xmm_regs 512-bit wide
        target-i386: use vmstate_offset_sub_array for AVX registers
        tests/multiboot: Add test for modules
        multiboot: Fix offset of bootloader name
        tests/multiboot: Update reference output
        pc: fix KVM features in pc-1.3 and earlier machine types

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc116efad0aadb2f8a49d51240bddbfe21b631a0
  Author: Wei Huang <wei@redhat.com>
  Date:   Fri Jan 23 15:56:04 2015 -0500

      kvm_stat: Add RESET support for perf event ioctl

      While running kvm_stat using tracepoint on ARM64 hardware (e.g. "kvm_stat
      -1 -t"), the initial values of some kvm_userspace_exit counters were found
      to be very suspecious. For instance the tracing tool showed that S390_TSCH
      was called many times on ARM64 machine, which apparently was wrong.

      This patch adds RESET ioctl support for perf monitoring. Before calling
      ioctl to enable a perf event, this patch resets the counter first. With
      this patch, the init counter values become correct on ARM64 hardware.

      Example:

      ==== before patch ====
      kvm_userspace_exit(S390_SIEIC)      1426         0
      kvm_userspace_exit(S390_TSCH)       339         0

      ==== after patch ====
      kvm_userspace_exit(S390_SIEIC)         0         0
      kvm_userspace_exit(S390_TSCH)         0         0

      Signed-off-by: Wei Huang <wei@redhat.com>

  commit 13704e4c455770d500d6b87b117e32f0d01252c9
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jan 22 17:22:54 2015 -0200

      target-i386: Disable HLE and RTM on Haswell & Broadwell

      All Haswell CPUs and some Broadwell CPUs were updated by Intel to have
      the HLE and RTM features disabled. This will prevent
      "-cpu Haswell,enforce" and "-cpu Broadwell,enforce" from running out of
      the box on those CPUs.

      Disable those features by default on Broadwell and Haswell CPU models,
      starting on pc-*-2.3. Users who want to use those features can enable
      them explicitly on the command-line.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 80fd48df4a53d01cc5d8a41e565f81af5978121f
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jan 22 10:53:46 2015 +0100

      sparse: Fix build with sparse on .S files

      rules.mak has a rule for .S files using CPP. This will result in
      errors like
        CPP   s390-ccw/start.asm
       cc: error: unrecognized command line option '-Wbitwise'

      Lets also redefine CPP in case of --enable-sparse.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a904c91196a9c5dbd7b9abcd3d40b0824286fb1c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 21 16:18:35 2015 +0100

      exec: fix madvise of NULL pointer

      Coverity flags this as "dereference after null check".  Not quite a
      dereference, since it will just EFAULT, but still nice to fix.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dd858343a73c5c47019c6ade282a91681e0d7105
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jan 23 10:43:49 2015 +0100

      .travis.yml: Add "--enable-modules"

      We will change the default to "--enable-modules", let's cover it before
      the switch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 927411fa42c5fcf16ed0fcc0447d5ee8c83b22ca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 11:07:09 2015 +0100

      apic: do not dereference pointer before it is checked for NULL

      Right now you only get to apic_init_reset if you have an APIC
      (do_cpu_init is reached only if CPU_INTERRUPT_INIT is set and
      that only happens in hw/intc/apic.c).  However, this is wrong
      because for example a port 92 or keyboard controller reset is
      really an INIT, and that can happen also with no APIC.  So
      keep the check and fix the error that Coverity reported.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 874b1cfad51e325d535f99261f91c92df444c18c
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:31 2015 -0500

      kvm_stat: Print errno when syscall to perf_event_open() fails

      kvm_stat uses syscall() to call perf_event_open(). If this function
      call fails, the returned value is -1, which doesn't tell the details
      of such failure (i.e. ENOSYS or EINVAL). This patch retrieves errno
      and prints it when syscall() fails. The error message will look like
      "Exception: perf_event_open failed, errno = 38".

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2c9d535a2e43699de32987b76cf548a39e4d04d2
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:30 2015 -0500

      kvm_stat: Update exit reasons to the latest defintion

      This patch updates the exit reasons for x86_vmx, x86_svm, and userspace
      to the latest definition.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit edcbc401f42077f9d62713d439839201a73a5966
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:29 2015 -0500

      kvm_stat: Add aarch64 support

      This patch enables aarch64 support for kvm_stat. The platform detection
      is based on OS uname.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b30934cb52a72a763da21dccc9994c64517d6f25
  Author: Jiri Slaby <jslaby@suse.cz>
  Date:   Wed Jan 21 17:48:33 2015 +0100

      hw: misc, add educational driver

      I am using qemu for teaching the Linux kernel at our university. I
      wrote a simple PCI device that can answer to writes/reads, generate
      interrupts and perform DMA. As I am dragging it locally over 2 years,
      I am sending it to you now.

      Signed-off-by: Jiri Slaby <jslaby@suse.cz>
      [Fix 32-bit compilation. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e720677e32e70b1f60637ebbcf2ffb23a4607f3e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 8 10:18:59 2015 +0100

      vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*

      Old users of VMSTATE_TIMER* are mechanically changed to VMSTATE_TIMER_PTR
      variants.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd1bd53a669c88f219ca47b538889cd918605fea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 24 10:57:04 2014 +0100

      qemu-timer: introduce timer_deinit

      In some cases, a timer was set to NULL so that we could check if it is
      initialized.  Use the timer_list field instead, and add a timer_deinit
      function that NULLs it.

      It then makes sense that timer_del be a no-op (instead of a crasher) on
      such a de-initialized timer.  It avoids the need to poke at the timerlist
      field to check if the timers are initialized.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 65a81af8df722714298f17d2b40da8e5f045e059
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 21:40:55 2014 +0100

      qemu-timer: add timer_init and timer_init_ns/us/ms

      These functions for the main loop TimerListGroup will replace
      timer_new and timer_new_ns/us/ms.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b7711471f551aa4419f9d46a11121f48ced422da
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 09:50:21 2014 +0200

      target-i386: make xmm_regs 512-bit wide

      Right now, the AVX512 registers are split in many different fields:
      xmm_regs for the low 128 bits of the first 16 registers, ymmh_regs
      for the next 128 bits of the same first 16 registers, zmmh_regs
      for the next 256 bits of the same first 16 registers, and finally
      hi16_zmm_regs for the full 512 bits of the second 16 bit registers.

      This makes it simple to move data in and out of the xsave region,
      but would be a nightmare for a hypothetical TCG implementation and
      leads to a proliferation of [XYZ]MM_[BWLSQD] macros.  Instead,
      this patch marshals data manually from the xsave region to a single
      32x512-bit array, simplifying the macro jungle and clarifying which
      bits are in which vmstate subsection.

      The migration format is unaffected.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a03c3e90e11976fb147904d537457984bb938ce2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 10:18:38 2014 +0200

      target-i386: use vmstate_offset_sub_array for AVX registers

      After the next patch, each vmstate field will extract parts of a larger
      (32x512-bit) array, so we cannot check the vmstate field against the
      type of the array.

      While changing this, change the macros to accept the index of the first
      element (which will not be 0 for Hi16_ZMM_REGS) instead of the number
      of elements (which is always CPU_NB_REGS).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a9c837d8ef573604328e4cb61e2e0cab61bba319
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:44 2015 +0100

      tests/multiboot: Add test for modules

      This test case is meant to detect corruptions of the Multiboot modules
      as well as the multiboot modules list and the module command lines.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4168498f613db3d908909106146001a9279e732
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:43 2015 +0100

      multiboot: Fix offset of bootloader name

      This fixes a bug introduced in commit 5eba5a66 ('Add bootloader name to
      multiboot implementation').

      The calculation of the bootloader name offset didn't consider space
      occupied by module command lines, so some unlucky module got its command
      line partially overwritten with a "qemu" string.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43bfb507f422a642ea2893555e13ccc2557d810a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:42 2015 +0100

      tests/multiboot: Update reference output

      The changes look okay (larger PCI hole, some rounding differences), so
      just update the reference output of the test case.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0034a0f239623388525c884dabf9a125eafb1acb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 17:53:55 2015 +0100

      pc: fix KVM features in pc-1.3 and earlier machine types

      Due to a typo, instead of disabling KVM_FEATURE_PV_EOI (bit
      6) these machine types are disabling bits 1 and 2, which are
      KVM_FEATURE_NOP_IO_DELAY and KVM_FEATURE_MMU_OP.  Not a big deal
      because they aren't very important and KVM_FEATURE_MMU_OP is
      disabled anyway.  The worst part is actually that KVM_FEATURE_PV_EOI
      is remaining enabled.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d109f80af3ad5c64c8c30e7ab21f2e342b5e9a8d
  Merge: a46b3aa bc63781
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 23 18:25:30 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Fri 23 Jan 2015 17:53:06 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        iotests: Lower 064's memory usage
        block: vhdx - force FileOffsetMB field to '0' for certain block states
        block: update string sizes for filename,backing_file,exact_filename
        block: mirror - change string allocation to 2-bytes
        block: remove unused variable in bdrv_commit
        block: qapi - move string allocation from stack to the heap
        block: vmdk - move string allocations from stack to the heap
        block: vmdk - make ret variable usage clear
        iotests: Add tests for more corruption cases
        qcow2: Add two more unalignment checks
        virtio-blk: Use blk_aio_ioctl
        virtio-blk: Pass req to virtio_blk_handle_scsi_req

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc63781ca350cad4c9eb142ce8f55bfaded4276e
  Merge: 9a29e18 e35053b
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jan 23 18:51:47 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        iotests: Lower 064's memory usage
        block: vhdx - force FileOffsetMB field to '0' for certain block states

  commit e35053b25aeeef5c67b38603e4ded526c2229371
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Jan 23 09:59:45 2015 -0500

      iotests: Lower 064's memory usage

      Test 064 reads a lot of data at once which currently results in qemu-io
      having to allocate up to about 1 GB of memory (958 MB, to be exact).
      This patch lowers that amount to 128 MB by making the test read smaller
      chunks.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1422025185-25229-1-git-send-email-mreitz@redhat.com

  commit cdf9634bdf76c8f59d9f7a04df30fa26d8e93d96
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Jan 20 16:01:43 2015 -0500

      block: vhdx - force FileOffsetMB field to '0' for certain block states

      The v1.0.0 spec calls out PAYLOAD_BLOCK_ZERO FileOffsetMB field as being
      'reserved'.  In practice, this means that Hyper-V will fail to read a
      disk image with PAYLOAD_BLOCK_ZERO block states with a FileOffsetMB
      value other than 0.

      The other states that indicate a block that is not there
      (PAYLOAD_BLOCK_UNDEFINED, PAYLOAD_BLOCK_NOT_PRESENT,
       PAYLOAD_BLOCK_UNMAPPED) have multiple options for what FileOffsetMB may
      be set to, and '0' is explicitly called out as an option.

      For all the above states, we will also just set the FileOffsetMB value
      to 0.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: a9fe92f53f07e6ab1693811e4312c0d1e958500b.1421787566.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 9a29e18f7dfd5a0e80d1c60fc856ebba18ddb738
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:30 2015 -0500

      block: update string sizes for filename,backing_file,exact_filename

      The string field entries 'filename', 'backing_file', and
      'exact_filename' in the BlockDriverState struct are defined as 1024
      bytes.

      However, many places that use these values accept a maximum of PATH_MAX
      bytes, so we have a mixture of 1024 byte and PATH_MAX byte allocations.
      This patch makes the BlockDriverStruct field string sizes match usage.

      This patch also does a few fixes related to the size that needs to
      happen now:

          * the block qapi driver is updated to use PATH_MAX bytes
          * the qcow and qcow2 drivers have an additional safety check
          * the block vvfat driver is updated to use PATH_MAX bytes
            for the size of backing_file, for systems where PATH_MAX is < 1024
            bytes.
          * qemu-img uses PATH_MAX rather than 1024.  These instances were not
            changed to be dynamically allocated, however, as the extra
            temporary 3K in stack usage for qemu-img does not seem worrisome.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1d33936ea847693a6d69f9049691a0341d6e0b9f
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:29 2015 -0500

      block: mirror - change string allocation to 2-bytes

      The backing_filename string in mirror_run() is only used to check
      for a NULL string, so we don't need to allocate 1024 bytes (or, later,
      PATH_MAX bytes), when we only need to copy the first 2 characters.

      We technically only need 1 byte, as we are just checking for NULL, but
      since backing_filename[] is populated by bdrv_get_backing_filename(), a
      string size of 1 will always only return '\0';

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a1a11d10abfff6638479b7510ee1df4f737d89d6
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:28 2015 -0500

      block: remove unused variable in bdrv_commit

      As Stefan pointed out, the variable 'filename' in bdrv_commit is unused,
      despite being maintained in previous patches.

      With this patch, get rid of the variable for good.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 564d64bdde8e0a6b732a56fa41670e73b19ee062
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:27 2015 -0500

      block: qapi - move string allocation from stack to the heap

      Rather than declaring 'backing_filename2' on the stack in
      bdrv_query_image_info(), dynamically allocate it on the heap.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fe2065629a9c256f836770ca54449ae77b22d188
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:26 2015 -0500

      block: vmdk - move string allocations from stack to the heap

      Functions 'vmdk_parse_extents' and 'vmdk_create' allocate several
      PATH_MAX sized arrays on the stack.  Make these dynamically allocated.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 395a22fae064df64d987d703cf70ae0f57306be8
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:25 2015 -0500

      block: vmdk - make ret variable usage clear

      Keep the variable 'ret' something that is returned by the function it is
      defined in.  For the return value of 'sscanf', use a more meaningful
      variable name.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f30136b35a271109b89353b9a5349cf32e6aeda7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 19 15:49:04 2015 -0500

      iotests: Add tests for more corruption cases

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8dd93d9339505376f6ce6737ead871ff6d7e676f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 19 15:49:03 2015 -0500

      qcow2: Add two more unalignment checks

      This adds checks for unaligned L2 table offsets and unaligned data
      cluster offsets (actually the preallocated offsets for zero clusters) to
      the zero cluster expansion function.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1dc936aa84b300940b2797c391cc3ca519bc78ce
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 20 11:28:47 2015 +0800

      virtio-blk: Use blk_aio_ioctl

      Use the asynchronous interface of ioctl. This will not make the VM
      unresponsive if the ioctl takes a long time.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 75344fa4c5d6a3ebe2dec2d87cbea8524f5d0f42
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 20 11:28:46 2015 +0800

      virtio-blk: Pass req to virtio_blk_handle_scsi_req

      In preparation for calling blk_aio_ioctl. Also make the function static
      as no other files need it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a46b3aaf6bb038d4f6f192a84df204f10929e75c
  Merge: c644145 4b45b05
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 23 13:24:17 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150123' into staging

      seccomp branch queue

      # gpg: Signature made Fri 23 Jan 2015 13:11:05 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150123:
        seccomp: add mlockall to whitelist

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b45b055491a319292beefb8080a81d96cf55cf6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 14:32:33 2015 +0100

      seccomp: add mlockall to whitelist

      This is used by "-realtime mlock=on".

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit c6441452b50c44fdbb362b239ce623f77cf3cd51
  Merge: 8f970ef 9939375
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 18:57:36 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-20150122-1' into staging

      b16: fix interrupt acknowledgement

      # gpg: Signature made Thu 22 Jan 2015 11:38:29 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-audio-20150122-1:
        sb16: fix interrupt acknowledgement

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f970eff6e318524f189f105c236e47633759890
  Merge: adeecf1 0ee4de5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 17:41:59 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150122-1' into staging

      input: misc fixes.

      # gpg: Signature made Thu 22 Jan 2015 11:27:37 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150122-1:
        hw/input/hid.c Fix capslock hid code
        hid: handle full ptr queues in post_load
        input: improve docs for input-send-event qmp command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adeecf14d668f5f0a73c9be91772e15b4f8727f3
  Merge: b3a4755 51a0909
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 13:56:11 2015 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150122-1' into staging

      spice: fix coverity defect, add unix address support

      # gpg: Signature made Thu 22 Jan 2015 11:17:24 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150122-1:
        spice: fix coverity reported defect in display code
        spice: add unix address support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b3a4755a67a52aa7297eb8927b482d09dabdefec
  Merge: a805ca5 4478aa7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 12:14:19 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150122-1' into staging

      vnc: add support for multiple vnc displays

      # gpg: Signature made Thu 22 Jan 2015 11:00:54 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150122-1:
        monitor: add vnc websockets
        monitor: add query-vnc-servers command
        vnc: factor out qmp_query_client_list
        vnc: track & limit connections
        vnc: update docs/multiseat.txt
        vnc: allow binding servers to qemu consoles
        vnc: switch to QemuOpts, allow multiple servers
        vnc: add display id to acl names
        vnc: remove unused DisplayState parameter, add id instead.
        vnc: remove vnc_display global

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ee4de5840ccc1072459ec68062bfb63c888a94d
  Author: Dinar Valeev <dvaleev@suse.com>
  Date:   Wed Jan 21 23:48:41 2015 +0100

      hw/input/hid.c Fix capslock hid code

      When ever USB keyboard is used, e.g. '-usbdevice keyboard' pressing
      caps lock key send 0x32 hid code, which is treated as backslash.
      Instead it should be 0x39 code. This affects sending uppercase keys,
      as they typed whith caps lock active.

      While on x86 this can be workarounded by using ps/2 protocol. On
      Power it is crusial as we don't have anything else than USB.

      This is fixes guest automation tasts over vnc.

      Signed-off-by: Dinar Valeev <dvaleev@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ba4d26064e8c42711a1a6eb287cedac75deb1478
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Nov 27 10:02:35 2014 +0100

      hid: handle full ptr queues in post_load

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 4083ae311d51edf93e2e163f4af2b22a1d0952cc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Nov 21 10:25:57 2014 +0100

      input: improve docs for input-send-event qmp command

      Text partly suggested by Markus Armbruster <armbru@redhat.com>

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a805ca54015bd123e2bc2454ec59619d0ed106c2
  Merge: 699eae1 7230818
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 11:16:20 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

      qemu-sparc update

      # gpg: Signature made Wed 21 Jan 2015 16:56:31 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-sparc-signed:
        disas/sparc: Remove unused data sparc_opcode_archs[]
        target-sparc: Mark gen_load_trap_state_at_tl() as !CONFIG_USER_ONLY
        target-sparc: is_translating_asi() is TARGET_SPARC64 only
        target-sparc: address_mask(), asi_address_mask() are TARGET_SPARC64 only
        target-sparc: Remove unused gen_op_subi_cc and gen_op_addi_cc

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4478aa768ccefcc5b234c23d035435fd71b932f6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 10 09:49:39 2014 +0100

      monitor: add vnc websockets

      Add websockets bool to VncBasicInfo, report websocket server sockets,
      flag websocket client connections.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit df887684603a4b3b0c623090a6b419dc70f22c32
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 17 15:49:44 2014 +0100

      monitor: add query-vnc-servers command

      Add new query vnc qmp command, for the lack of better ideas just name it
      "query-vnc-servers".  Changes over query-vnc:

       * It returns a list of vnc servers, so multiple vnc server instances
         are covered.
       * Each vnc server returns a list of server sockets.  Followup patch
         will use that to also report websockets.  In case we add support for
         multiple server sockets server sockets (to better support ipv4+ipv6
         dualstack) we can add them to the list too.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2d29a4368c3c00a5cf200f29b3dfd32bc4fb2c31
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Dec 9 15:27:39 2014 +0100

      vnc: factor out qmp_query_client_list

      so we can reuse it for the new vnc query command.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e5f34cdd2da54f28d90889a3afd15fad2d6105ff
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 2 12:09:34 2014 +0200

      vnc: track & limit connections

      Also track the number of connections in "connecting" and "shared" state
      (in addition to the "exclusive" state).  Apply a configurable limit to
      these connections.

      The logic to apply the limit to connections in "shared" state is pretty
      simple:  When the limit is reached no new connections are allowed.

      The logic to apply the limit to connections in "connecting" state (this
      is the state you are in *before* successful authentication) is
      slightly different:  A new connect kicks out the oldest client which is
      still in "connecting" state.  This avoids a easy DoS by unauthenticated
      users by simply opening connections until the limit is reached.

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 86fdcf23f4a9d8473844734907555b3a93ed686c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 2 15:53:37 2014 +0200

      vnc: update docs/multiseat.txt

      vnc joins the party ;)
      Also some s/head/seat/ to clarify.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1d0d59fe291967533f974e82213656d479475a1e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Sep 18 12:54:49 2014 +0200

      vnc: allow binding servers to qemu consoles

      This patch adds a display= parameter to the vnc options.  This allows to
      bind a vnc server instance to a specific display, allowing to create a
      multiseat setup with a vnc server for each seat.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4db14629c38611061fc19ec6927405923de84f08
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Sep 16 12:33:03 2014 +0200

      vnc: switch to QemuOpts, allow multiple servers

      This patch switches vnc over to QemuOpts, and it (more or less
      as side effect) allows multiple vnc server instances.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c8496408b443a2a34dd03ad4274c2575248aa3e8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Oct 21 14:50:42 2014 +0200

      vnc: add display id to acl names

      In case the display id is "default" (which is the one you get if you
      don't explicitly assign one) we keep the old name scheme, without
      display, for backward compatibility reasons.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 14f7143ede7c601cce02ce0f8c7f01c41148128b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 29 12:24:55 2014 +0200

      vnc: remove unused DisplayState parameter, add id instead.

      DisplayState isn't used anywhere, drop it.  Add the vnc server ID as
      parameter instead, so it is possible to specify the server instance.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit d616ccc5dd771024e04b9b15d7ca30bc7fe8fce3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 29 12:14:08 2014 +0200

      vnc: remove vnc_display global

      Replace with a vnc_displays list, so we can have multiple vnc server
      instances.  Add vnc_server_find function to lookup a display by id.
      With no id supplied return the first vnc server, for backward
      compatibility reasons.

      It is not possible (yet) to actually create multiple vnc server
      instances.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 51a090991449c7d3c6d428eda18b4f30a36e2c1b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jan 15 12:06:16 2015 +0100

      spice: fix coverity reported defect in display code

      Report:

      1. Condition surface, taking false branch
      406    if (surface && ssd->surface &&
      407        surface_width(surface) == pixman_image_get_width(ssd->surface) &&
      408        surface_height(surface) == pixman_image_get_height(ssd->surface)) {
      409        /* no-resize fast path: just swap backing store */
      ...

      10. alias_transfer: Assigning: ssd->ds = surface.
      440    ssd->ds = surface;

      11. var_deref_op: Dereferencing null pointer ssd->ds.
      CID 1264334 (#1 of 1): Dereference after null check (FORWARD_NULL)
      441    ssd->surface = pixman_image_ref(ssd->ds->image);

      Fix:

      Move code block dereferencing ssd->ds into the already existing
      if (ssd->ds) { ... } block.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fe4831b1e7e7007ae15ae0470a06898660ab3877
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Jan 13 17:57:51 2015 +0100

      spice: add unix address support

      Teach qemu to set up a Spice server with a UNIX socket using the
      following arguments -spice unix,addr=path.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9939375c282a0f97afa69dc6799d3c77aaf7d544
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 17:23:48 2015 +0100

      sb16: fix interrupt acknowledgement

      SoundBlaster 16 emulation is very broken and consumes a lot of CPU, but a
      small fix was suggested offlist and it is enough to fix some games.  I
      got Epic Pinball to work with the "SoundBlaster Clone" option.

      The processing of the interrupt register is wrong due to two missing
      "not"s.  This causes the interrupt flag to remain set even after the
      Acknowledge ports have been read (0x0e and 0x0f).

      The line was introduced by commit 85571bc (audio merge (malc), 2004-11-07),
      but the code might have been broken before because I did not look closely
      at the huge patches from 10 years ago.

      Reported-by: Joshua Bair <j_bair@bellsouth.net>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7230818a2b54df826e5ecdd83bd20632c9a8b07c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:21 2014 +0000

      disas/sparc: Remove unused data sparc_opcode_archs[]

      Remove sparc_opcode_archs and the macros which use it, because we don't
      use them in QEMU and they provoke clang warnings:

      disas/sparc.c:307:39: warning: unused variable 'sparc_opcode_archs' [-Wunused-const-variable]
      static const struct sparc_opcode_arch sparc_opcode_archs[] =
                                            ^

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit a2035e83fd60e5b66644d321816ed634b908b4ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:20 2014 +0000

      target-sparc: Mark gen_load_trap_state_at_tl() as !CONFIG_USER_ONLY

      The function gen_load_trap_state_at_tl() is only used in the softmmu
      configs; wrap it in #ifndef CONFIG_USER_ONLY to avoid clang compiler
      warnings in linux-user builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 69694625e86aebb135b56c4aaafefd5c1d17bb3c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:19 2014 +0000

      target-sparc: is_translating_asi() is TARGET_SPARC64 only

      Move the is_translating_asi() inside the TARGET_SPARC64 ifdef (and remove
      the unimplemented 32-bit codepath), as it is only called from TARGET_SPARC64
      code. This fixes a clang 3.4 unused-function warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit e60538c79fc7285e72f5b431281986737db1607b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:18 2014 +0000

      target-sparc: address_mask(), asi_address_mask() are TARGET_SPARC64 only

      The address_mask() and asi_address_mask() functions are only used in
      TARGET_SPARC64 configs, so guard with ifdefs to avoid warnings about
      unused functions in 32-bit builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 622302901065ebcb21201310d34b22d107fe851e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:17 2014 +0000

      target-sparc: Remove unused gen_op_subi_cc and gen_op_addi_cc

      The functions gen_op_addi_cc() and gen_op_subi_cc() are unused; remove them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 699eae17b841e6784dc3864bf357e26bff1e9dfe
  Merge: a5bd447 de5ee4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 16:19:58 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-misc-20150120' into staging

      Miscellaneous cross-tree patches:
       * load/store helper cleanup
       * drop TARGET_HAS_ICE define and checks
       * scripts/qapi-types.py: Add dummy member to empty structs
       * cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined

      # gpg: Signature made Tue 20 Jan 2015 15:43:38 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-misc-20150120:
        cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined
        cpu_ldst.h, cpu-all.h, bswap.h: Update documentation on ld/st accessors
        cpu_ldst_template.h: Drop unused cpu_ldfq/stfq/ldfl/stfl accessors
        cpu_ldst.h: Drop unused _raw macros, saddr() and laddr()
        cpu_ldst_template.h: Use ld*_p directly rather than via ld*_raw macros
        cpu_ldst.h: Use inline functions for usermode cpu_ld/st accessors
        cpu_ldst.h: Remove unused very short ld*/st* defines
        cpu_ldst.h: Drop unused ld/st*_kernel defines
        target-mips: Don't use _raw load/store accessors
        linux-user/main.c (m68k): Use get_user_u16 rather than lduw in cpu_loop
        linux-user/vm86.c: Use cpu_ldl_data &c rather than plain ldl &c
        bsd-user/elfload.c: Don't use ldl() or ldq_raw()
        linux-user/elfload.c: Don't use _raw accessor functions
        target-sparc: Don't use {ld, st}*_raw functions
        monitor.c: Use ld*_p() instead of ld*_raw()
        cpu_ldst.h: Remove unused ldul_ macros
        exec.c: Drop TARGET_HAS_ICE define and checks
        scripts/qapi-types.py: Add dummy member to empty structs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de5ee4a888667ca0a198f0743d70075d70564117
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:35 2015 +0000

      cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined

      Not all targets define a full set of suffix strings for the
      NB_MMU_MODES that they have. In this situation, don't define any
      helper functions for that mode, rather than defining helper functions
      with no suffix at all. The MMU mode is still functional; it is merely
      not directly accessible via cpu_ld*_MODE from target helper functions.

      Also add an "NB_MMU_MODES >= 2" check to the definition of the mode 1
      helpers -- some targets only define one MMU mode.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1421432008-6786-1-git-send-email-peter.maydell@linaro.org

  commit db5fd8d709fd57f4d4f11edfca9f421f657f4508
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:35 2015 +0000

      cpu_ldst.h, cpu-all.h, bswap.h: Update documentation on ld/st accessors

      Add documentation of what the cpu_*_* accessors look like.
      Correct some minor errors in the existing documentation of the
      direct _p accessor family. Remove the near-duplicate comment
      on the _p accessors from cpu-all.h and replace it with a reference
      to the comment in bswap.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-16-git-send-email-peter.maydell@linaro.org

  commit 82f11917c99e3c7fa3d6aa98572ecc98c7324c2f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst_template.h: Drop unused cpu_ldfq/stfq/ldfl/stfl accessors

      The cpu_ldfq/stfq/ldfl/stfl accessors for loading and storing
      float32 and float64 are completely unused, so delete them.
      (The union they use for converting from the float32/float64
      type to uint32_t or uint64_t is the wrong way to do it anyway:
      they should be using make_float* and float*_val.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-15-git-send-email-peter.maydell@linaro.org

  commit 800e2ecc896beb6b79e7333c762da163b6a9135a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Drop unused _raw macros, saddr() and laddr()

      The _raw macros and their helpers saddr() and laddr() are now
      totally unused -- delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-14-git-send-email-peter.maydell@linaro.org

  commit 355392329e4a843580e53cb027ed85e0cbebb640
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst_template.h: Use ld*_p directly rather than via ld*_raw macros

      The ld*_raw and st*_raw macros are now only used within the code
      produced by cpu_ldst_template.h, and only in three places.
      Expand these out to just call the ld_p and st_p functions directly.

      Note that in all the callsites the address argument is a uintptr_t,
      so we can drop that part of the double-cast used in the saddr() and
      laddr() macros.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-13-git-send-email-peter.maydell@linaro.org

  commit 9220fe54c679d145232a28df6255e166ebf91bab
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Use inline functions for usermode cpu_ld/st accessors

      Use inline functions rather than macros for cpu_ld/st accessors
      for the *-user configurations, as we already do for softmmu.
      This has a two advantages:
       * we can actually typecheck our arguments
       * we don't need to leak the _raw macros everywhere

      Since the _kernel functions were only used by target-i386/seg_helper.c,
      put the definitions for them in that file too. (It already has the
      similar template include code to define them for the softmmu case,
      so it makes sense to have it deal with defining them for user-only.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-12-git-send-email-peter.maydell@linaro.org

  commit 177ea79f65c90b3bc84d59565b7519e47ea02f63
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Remove unused very short ld*/st* defines

      The very short ld*/st* defines are now not used anywhere; delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-11-git-send-email-peter.maydell@linaro.org

  commit 5a0826f7d2f9bea6e02157985b103d0a4c458aaa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Drop unused ld/st*_kernel defines

      The ld*_kernel and st*_kernel defines are not used anywhere;
      delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-10-git-send-email-peter.maydell@linaro.org

  commit 15353001197c413f3ddebd51152a514dce08c458
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      target-mips: Don't use _raw load/store accessors

      Use cpu_*_data instead of the direct *_raw load/store accessors.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-9-git-send-email-peter.maydell@linaro.org

  commit d8d5119cae38da090b7a76f22cecc8088691ab49
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/main.c (m68k): Use get_user_u16 rather than lduw in cpu_loop

      In the m68k cpu_loop() use get_user_u16 to read the immediate for
      the simcall rahter than lduw, to bring it into line with how other
      archs do it and to remove another user of the ldl family of functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-8-git-send-email-peter.maydell@linaro.org

  commit 5899d6d0b4cae1a0ff7487b635eee4d9db1a2a7c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/vm86.c: Use cpu_ldl_data &c rather than plain ldl &c

      Use the cpu_ld*_data and cpu_st*_data family of functions to access
      guest memory in vm86.c rather than the very short-named ldl/stl functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-7-git-send-email-peter.maydell@linaro.org

  commit b8d6ac9f90d047cbc8e06366ae33b71ea9c5232c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      bsd-user/elfload.c: Don't use ldl() or ldq_raw()

      Use get_user_u64() and get_user_ual() instead of the ldl() and
      ldq_raw() functions.

      [Note that this change is not compile tested as it is actually
      in dead code -- none of the bsd-user configurations are PPC.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-6-git-send-email-peter.maydell@linaro.org

  commit 2ccf97ec0f1b7a62a3220064f305454f3932c55a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/elfload.c: Don't use _raw accessor functions

      The _raw accessor functions are an implementation detail that has
      leaked out to some callsites. Use get_user_u64() instead of ldq_raw().

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-5-git-send-email-peter.maydell@linaro.org

  commit eb513f82f04fab442cdef9db698dafc852275f7f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      target-sparc: Don't use {ld, st}*_raw functions

      Instead of using the _raw family of ld/st accessor functions, use
      cpu_*_data. All this code is CONFIG_USER_ONLY, so the two are the
      same semantically, but the _raw functions are really a detail of
      the implementation which has leaked into a few callsites like this one.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-4-git-send-email-peter.maydell@linaro.org

  commit 24e60305c5839eccf4b915411215b412fb34c52b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      monitor.c: Use ld*_p() instead of ld*_raw()

      The monitor code for doing a memory_dump() was using ld*_raw() to do
      target-CPU accesses out of a local buf[] array. The correct functions
      for this purpose are ld*_p(), which take a host pointer, rather than
      ld*_raw(), which take an integer representing a guest address and
      are somewhat meaningless in softmmu configurations. Nobody noticed
      because for softmmu the _raw functions are the same as ldl_p but
      with some extra casts thrown in. Switch to using the correct functions
      instead.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-3-git-send-email-peter.maydell@linaro.org

  commit 0c021c1fd2c4ec3c68c59232ccee012c067bc682
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      cpu_ldst.h: Remove unused ldul_ macros

      The five ldul_ macros are not used anywhere and are marked up with an XXX
      comment. "ldul" is a non-standard prefix for our family of load instructions:
      we don't mark 32-bit accesses for signedness because they return a 32 bit
      quantity. So just delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1421334118-3287-2-git-send-email-peter.maydell@linaro.org

  commit ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      exec.c: Drop TARGET_HAS_ICE define and checks

      The TARGET_HAS_ICE #define is intended to indicate whether a target-*
      guest CPU implementation supports the breakpoint handling. However,
      all our guest CPUs have that support (the only two which do not
      define TARGET_HAS_ICE are unicore32 and openrisc, and in both those
      cases the bp support is present and the lack of the #define is just
      a bug). So remove the #define entirely: all new guest CPU support
      should include breakpoint handling as part of the basic implementation.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1420484960-32365-1-git-send-email-peter.maydell@linaro.org

  commit 83ecb22ba2c91a4674ae109595a8ed1da8de4d7a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      scripts/qapi-types.py: Add dummy member to empty structs

      Make sure that all generated C structs have at least one field; this
      avoids potential issues with attempting to malloc space for
      zero-length structs in C (g_malloc(sizeof struct) would return NULL).
      It also avoids an incompatibility with C++ (where an empty struct is
      size 1); that isn't important to us now but might be in future.

      Generated empty structures look like this:
          struct Abort
          {
              char qapi_dummy_field_for_empty_struct;
          };

      This silences clang warnings like:
      ./qapi-types.h:3752:1: warning: empty struct has size 0 in C, size 1 in C++ [-Wextern-c-compat]
      struct Abort
      ^

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1419359069-16611-1-git-send-email-peter.maydell@linaro.org

  commit a5bd4470ed34b7cf49bda7ea3dcad3a269c99ada
  Merge: 74acb99 86a6a9b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 14:34:38 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-20-v2' into staging

      * remotes/sstabellini/xen-2015-01-20-v2:
        xen: add a lock for the mapcache
        xen: do not use __-named variables in mapcache
        Xen: Use the ioreq-server API when available
        Add device listener interface

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86a6a9bf551ffa183880480b37c5836d3916687a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 11:20:56 2015 +0100

      xen: add a lock for the mapcache

      Extend the existing dummy mapcache_lock/unlock macros to cover all of
      xen-mapcache.c.  This prepares for unlocked memory access, when parts
      of exec.c will not be protected by the BQL.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 9b6d7b365dc211bbeadb0cf2e7bf1a019001c7f8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 11:20:55 2015 +0100

      xen: do not use __-named variables in mapcache

      Keep the namespace clean.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 3996e85c1822e05c50250f8d2d1e57b6bea1229d
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jan 20 11:06:19 2015 +0000

      Xen: Use the ioreq-server API when available

      The ioreq-server API added to Xen 4.5 offers better security than
      the existing Xen/QEMU interface because the shared pages that are
      used to pass emulation request/results back and forth are removed
      from the guest's memory space before any requests are serviced.
      This prevents the guest from mapping these pages (they are in a
      well known location) and attempting to attack QEMU by synthesizing
      its own request structures. Hence, this patch modifies configure
      to detect whether the API is available, and adds the necessary
      code to use the API if it is.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 707ff80021ccd7a68f4b3d2c44eebf87efbb41c4
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jan 20 11:05:07 2015 +0000

      Add device listener interface

      The Xen ioreq-server API, introduced in Xen 4.5, requires that PCI device
      models explicitly register with Xen for config space accesses. This patch
      adds a listener interface into qdev-core which can be used by the Xen
      interface code to monitor for arrival and departure of PCI devices.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 74acb99737dbedd86654d660c0c20815139a873c
  Merge: 1e42c35 877417d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 19 13:37:05 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20150119-1' into staging

      ui: add shared surface format negotiation.

      # gpg: Signature made Mon 19 Jan 2015 12:47:36 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-console-20150119-1:
        ui/sdl2: Support shared surface for more pixman formats
        ui/sdl: Support shared surface for more pixman formats
        ui/gtk: Support shared surface for most pixman formats
        ui/spice: Support shared surface for most pixman formats
        ui/vnc: Support shared surface for most pixman formats
        ui/pixman: add qemu_pixman_check_format
        ui: Add dpy_gfx_check_format() to check backend shared surface support
        ui: Make qemu_default_pixman_format() return 0 on unsupported formats

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 877417d9ae6846bea4744b198131a5fe5117d7a5
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 09:27:09 2015 +0100

      ui/sdl2: Support shared surface for more pixman formats

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7dd93291cad743e83e972a323a5775ff5a954bd5
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:24:42 2014 +1000

      ui/sdl: Support shared surface for more pixman formats

      At least all the ones I've tested. We make the assumption that
      SDL is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: minor format tweaks ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fcf73af68ecb83dcb1d997c6b6a0c29989ebfea8
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:07:14 2014 +1000

      ui/gtk: Support shared surface for most pixman formats

      At least all the ones I've tested. We make the assumption that
      pixman is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: just hook up qemu_pixman_check_format ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0002a51889101a818c1b8328b2a95f284caa030f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 09:31:58 2015 +0100

      ui/spice: Support shared surface for most pixman formats

      Just hook up qemu_pixman_check_format.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 34da30afa473b9fc12161f53f4b3fd83b8ba5ce8
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:18:19 2014 +1000

      ui/vnc: Support shared surface for most pixman formats

      At least all the ones I've tested. We make the assumption that
      pixman is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: just hook up qemu_pixman_check_format ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 8cd996f493d4fc10844bd13bde4b9c9c5e38cc3a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 08:49:20 2015 +0100

      ui/pixman: add qemu_pixman_check_format

      Convinience check_format function for UIs using pixman.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49743df399ca1029f4e22b52e9238d8e25c26bb2
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 16:39:05 2014 +1000

      ui: Add dpy_gfx_check_format() to check backend shared surface support

      This allows VGA to decide whether to use a shared surface based on
      whether the UI backend supports the format or not. Backends that
      don't provide the new callback fallback to native 32 bpp which
      is equivalent to what was supported before.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: fix console check, allow only 32 bpp as fallback ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit aca7aaf6287b6a9f688c1b115a76fdc056565a7e
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 16:37:26 2014 +1000

      ui: Make qemu_default_pixman_format() return 0 on unsupported formats

      In order to remove the logic for detecting supported shared
      pixmap formats from device models, make qemu_default_pixman_format()
      capable for failing by returning 0 which is not a possible format
      value rather than asserting.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

  commit 1e42c353469cb58ca4f3b450eea4211af7d0b147
  Merge: e68cba3 36b62ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 16 12:06:41 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150116' into staging

      target-arm queue:
       * fix endianness handling in fwcfg wide registers
       * fix broken crypto insn emulation on big endian hosts

      # gpg: Signature made Fri 16 Jan 2015 12:04:08 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150116:
        fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()
        target-arm: crypto: fix BE host support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 36b62ae6a58f9a588fd33be9386e18a2b90103f5
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jan 16 11:54:30 2015 +0000

      fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()

      (1) Let's contemplate what device endianness means, for a memory mapped
      device register (independently of QEMU -- that is, on physical hardware).

      It determines the byte order that the device will put on the data bus when
      the device is producing a *numerical value* for the CPU. This byte order
      may differ from the CPU's own byte order, therefore when software wants to
      consume the *numerical value*, it may have to swap the byte order first.

      For example, suppose we have a device that exposes in a 2-byte register
      the number of sheep we have to count before falling asleep. If the value
      is decimal 37 (0x0025), then a big endian register will produce [0x00,
      0x25], while a little endian register will produce [0x25, 0x00].

      If the device register is big endian, but the CPU is little endian, the
      numerical value will read as 0x2500 (decimal 9472), which software has to
      byte swap before use.

      However... if we ask the device about who stole our herd of sheep, and it
      answers "XY", then the byte representation coming out of the register must
      be [0x58, 0x59], regardless of the device register's endianness for
      numeric values. And, software needs to copy these bytes into a string
      field regardless of the CPU's own endianness.

      (2) QEMU's device register accessor functions work with *numerical values*
      exclusively, not strings:

      The emulated register's read accessor function returns the numerical value
      (eg. 37 decimal, 0x0025) as a *host-encoded* uint64_t. QEMU translates
      this value for the guest to the endianness of the emulated device register
      (which is recorded in MemoryRegionOps.endianness). Then guest code must
      translate the numerical value from device register to guest CPU
      endianness, before including it in any computation (see (1)).

      (3) However, the data register of the fw_cfg device shall transfer strings
      *only* -- that is, opaque blobs. Interpretation of any given blob is
      subject to further agreement -- it can be an integer in an independently
      determined byte order, or a genuine string, or an array of structs of
      integers (in some byte order) and fixed size strings, and so on.

      Because register emulation in QEMU is integer-preserving, not
      string-preserving (see (2)), we have to jump through a few hoops.

      (3a) We defined the memory mapped fw_cfg data register as
      DEVICE_BIG_ENDIAN.

      The particular choice is not really relevant -- we picked BE only for
      consistency with the control register, which *does* transfer integers --
      but our choice affects how we must host-encode values from fw_cfg strings.

      (3b) Since we want the fw_cfg string "XY" to appear as the [0x58, 0x59]
      array on the data register, *and* we picked DEVICE_BIG_ENDIAN, we must
      compose the host (== C language) value 0x5859 in the read accessor
      function.

      (3c) When the guest performs the read access, the immediate uint16_t value
      will be 0x5958 (in LE guests) and 0x5859 (in BE guests). However, the
      uint16_t value does not matter. The only thing that matters is the byte
      pattern [0x58, 0x59], which the guest code must copy into the target
      string *without* any byte-swapping.

      (4) Now I get to explain where I screwed up. :(

      When we decided for big endian *integer* representation in the MMIO data
      register -- see (3a) --, I mindlessly added an indiscriminate
      byte-swizzling step to the (little endian) guest firmware.

      This was a grave error -- it violates (3c) --, but I didn't realize it. I
      only saw that the code I otherwise intended for fw_cfg_data_mem_read():

          value = 0;
          for (i = 0; i < size; ++i) {
              value = (value << 8) | fw_cfg_read(s);
          }

      didn't produce the expected result in the guest.

      In true facepalm style, instead of blaming my guest code (which violated
      (3c)), I blamed my host code (which was correct). Ultimately, I coded
      ldX_he_p() into fw_cfg_data_mem_read(), because that happened to work.

      Obviously (...in retrospect) that was wrong. Only because my host happened
      to be LE, ldX_he_p() composed the (otherwise incorrect) host value 0x5958
      from the fw_cfg string "XY". And that happened to compensate for the bogus
      indiscriminate byte-swizzling in my guest code.

      Clearly the current code leaks the host endianness through to the guest,
      which is wrong. Any device should work the same regardless of host
      endianness.

      The solution is to compose the host-endian representation (2) of the big
      endian interpretation (3a, 3b) of the fw_cfg string, and to drop the wrong
      byte-swizzling in the guest (3c).

      Brown paper bag time for me.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1420024880-15416-1-git-send-email-lersek@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b449ca3c1874418d948878d5417a32fc0dbf9fea
  Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
  Date:   Fri Jan 16 11:54:29 2015 +0000

      target-arm: crypto: fix BE host support

      The crypto emulation code in target-arm/crypto_helper.c never worked
      correctly on big endian hosts, due to the fact that it uses a union
      of array types to convert between the native VFP register size (64
      bits) and the types used in the algorithms (bytes and 32 bit words)

      We cannot just swab between LE and BE when reading and writing the
      registers, as the SHA code performs word additions, so instead, add
      array accessors for the CRYPTO_STATE type whose LE and BE specific
      implementations ensure that the correct array elements are referenced.

      Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Acked-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1420208303-24111-1-git-send-email-ard.biesheuvel@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e68cba36360a2ab5bf0576b66df4d0eb0d822f8d
  Merge: df58887b ea987c2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 16 10:16:14 2015 +0000

      Merge remote-tracking branch 'remotes/amit-migration/tags/mig-2.3-1' into staging

      A set of patches collected over the holidays.  Mix of optimizations and
      fixes.

      # gpg: Signature made Fri 16 Jan 2015 07:42:00 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-migration/tags/mig-2.3-1:
        vmstate: type-check sub-arrays
        migration_cancel: shutdown migration socket
        Handle bi-directional communication for fd migration
        socket shutdown
        Tests: QEMUSizedBuffer/QEMUBuffer
        QEMUSizedBuffer: only free qsb that qemu_bufopen allocated
        xbzrle: rebuild the cache_is_cached function
        xbzrle: optimize XBZRLE to decrease the cache misses

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea987c2c21d4326bb58ee28f6888fdcf8fbda067
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 7 15:12:13 2015 +0100

      vmstate: type-check sub-arrays

      While we cannot check against the type of the full array, we can check
      against the type of the fields.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit a26ba26e214911dc879a23e797d2c269cdb38577
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jan 8 11:11:32 2015 +0000

      migration_cancel: shutdown migration socket

      Force shutdown on migration socket on cancel to cause the cancel
      to complete even if the socket is blocked on a dead network.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 131fe9b843f9a1e55fcbf2457c9cb25c3711b9d8
  Author: Cristian Klein <cristian.klein@cs.umu.se>
  Date:   Thu Jan 8 11:11:31 2015 +0000

      Handle bi-directional communication for fd migration

      libvirt prefers opening the TCP connection itself, for two reasons.
      First, connection failed errors can be detected easier, without having
      to parse qemu's error output.
      Second, libvirt might be asked to secure the transfer by tunnelling the
      communication through an TLS layer.
      Therefore, libvirt opens the TCP connection itself and passes an FD to qemu
      using QMP and a POSIX-specific mechanism.

      Hence, in order to make the reverse-path work in such cases, qemu needs to
      distinguish if the transmitted FD is a socket (reverse-path available)
      or not (reverse-path might not be available) and use the corresponding
      abstraction.

      Signed-off-by: Cristian Klein <cristian.klein@cs.umu.se>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit e1a8c9b67fc97d293211773edcae9e8e2f3367ab
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jan 8 11:11:30 2015 +0000

      socket shutdown

      Add QEMUFile interface to allow a socket to be 'shut down' - i.e. any
      reads/writes will fail (and any blocking read/write will be woken).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 8580b06498a5dffe554e7ac627726b1d7775c591
  Author: Yang Hongyang <yanghy@cn.fujitsu.com>
  Date:   Fri Dec 19 11:38:06 2014 +0800

      Tests: QEMUSizedBuffer/QEMUBuffer

      Modify some of tests/test-vmstate.c due to qemu_bufopen() change.
      If you create a QEMUSizedBuffer yourself, you have to explicitly
      free it.

      Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit f018d8cd2123f495300935d5019931abbee4e5d9
  Author: Yang Hongyang <yanghy@cn.fujitsu.com>
  Date:   Fri Dec 19 11:38:05 2014 +0800

      QEMUSizedBuffer: only free qsb that qemu_bufopen allocated

      Only free qsb that qemu_bufopen allocated, and also allow
      qemu_bufopen accept qsb as input for write operation. It
      will make the API more logical:
      1.If you create the QEMUSizedBuffer yourself, you need to
        free it by using qsb_free() but not depends on other API
        like qemu_fclose.
      2.allow qemu_bufopen() accept QEMUSizedBuffer as input for
        write operation, otherwise, it will be a little strange
        for this API won't accept the second parameter.

      This brings API change, since there are only 3
      users of this API currently, this change only impact the
      first one which will be fixed in patch 2 of this patchset,
      so I think it is safe to do this change.

      1     70  tests/test-vmstate.c <<open_mem_file_read>>
                  return qemu_bufopen("r", qsb);
      2    404  tests/test-vmstate.c <<test_save_noskip>>
                  QEMUFile *fsave = qemu_bufopen("w", NULL);
      3    424  tests/test-vmstate.c <<test_save_skip>>
                  QEMUFile *fsave = qemu_bufopen("w", NULL);

      Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1b826f277814dd9496fe3cc71cbe6ab7b203cadf
  Author: ChenLiang <chenliang88@huawei.com>
  Date:   Mon Nov 24 19:55:48 2014 +0800

      xbzrle: rebuild the cache_is_cached function

      Rebuild the cache_is_cached function by cache_get_by_addr. And
      drops the asserts because the caller is also asserting the same
      thing.

      Signed-off-by: ChenLiang <chenliang88@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 27af7d6ea5015e5ef1f7985eab94a8a218267a2b
  Author: ChenLiang <chenliang88@huawei.com>
  Date:   Mon Nov 24 19:55:47 2014 +0800

      xbzrle: optimize XBZRLE to decrease the cache misses

      Avoid hot pages being replaced by others to remarkably decrease cache
      misses

      Sample results with the test program which quote from xbzrle.txt ran in
      vm:(migrate bandwidth:1GE and xbzrle cache size 8MB)

      the test program:

      include <stdlib.h>
      include <stdio.h>
      int main()
       {
              char *buf = (char *) calloc(4096, 4096);
              while (1) {
                  int i;
                  for (i = 0; i < 4096 * 4; i++) {
                      buf[i * 4096 / 4]++;
                  }
                  printf(".");
              }
       }

      before this patch:
      virsh qemu-monitor-command test_vm '{"execute": "query-migrate"}'
      {"return":{"expected-downtime":1020,"xbzrle-cache":{"bytes":1108284,
      "cache-size":8388608,"cache-miss-rate":0.987013,"pages":18297,"overflow":8,
      "cache-miss":1228737},"status":"active","setup-time":10,"total-time":52398,
      "ram":{"total":12466991104,"remaining":1695744,"mbps":935.559472,
      "transferred":5780760580,"dirty-sync-counter":271,"duplicate":2878530,
      "dirty-pages-rate":29130,"skipped":0,"normal-bytes":5748592640,
      "normal":1403465}},"id":"libvirt-706"}

      18k pages sent compressed in 52 seconds.
      cache-miss-rate is 98.7%, totally miss.

      after optimizing:
      virsh qemu-monitor-command test_vm '{"execute": "query-migrate"}'
      {"return":{"expected-downtime":2054,"xbzrle-cache":{"bytes":5066763,
      "cache-size":8388608,"cache-miss-rate":0.485924,"pages":194823,"overflow":0,
      "cache-miss":210653},"status":"active","setup-time":11,"total-time":18729,
      "ram":{"total":12466991104,"remaining":3895296,"mbps":937.663549,
      "transferred":1615042219,"dirty-sync-counter":98,"duplicate":2869840,
      "dirty-pages-rate":58781,"skipped":0,"normal-bytes":1588404224,
      "normal":387794}},"id":"libvirt-266"}

      194k pages sent compressed in 18 seconds.
      The value of cache-miss-rate decrease to 48.59%.

      Signed-off-by: ChenLiang <chenliang88@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit df58887b20fab8fe8a6dcca4db30cd4e4077d53a
  Merge: b629a38 99efa84
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 15 10:08:46 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-01-15' into staging

      trivial patches for 2015-01-15

      # gpg: Signature made Thu 15 Jan 2015 08:26:26 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-01-15:
        vl.c: fix some alignment issues
        blizzard: do not depend on VGA internals
        Makefile: Remove config.status and common.env during 'make distclean'
        target-openrisc: bugfix for dec_sys to decode instructions correctly
        Do not hang on full PTY
        misc: Fix new typos in comments
        target-arm: Fix typo in comment (seperately -> separately)
        target-tricore: Fix new typos
        migration/qemu-file.c: Don't shift left into sign bit
        translate-all: Mark map_exec() with the 'unused' attribute
        tests/hd-geo-test.c: Remove unused test_image variable
        vt82c686: avoid out-of-bounds read

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 99efa84d5c02e33bcca7be83dd7cabc4b0f22f14
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Jan 11 12:56:51 2015 +0200

      vl.c: fix some alignment issues

      The misalignment was caused by tabs which were used instead of spaces.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 31fc97c3145d428751f8bc4d5666a525d5c3dc2f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jan 9 10:59:49 2015 +0100

      blizzard: do not depend on VGA internals

      There is nothing that is used by this ARM-specific device.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae21935924365efecf5c5ba998cb6cb8c85a499b
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Dec 15 11:19:46 2014 +0100

      Makefile: Remove config.status and common.env during 'make distclean'

      config.status and tests/qemu-iotests/common.env are generated files
      that should be deleted during 'make distclean'.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3d59b6808bc5e0efbf1aee48d7f9ea96d19df05d
  Author: David Morrison <dmorrison@invlim.com>
  Date:   Tue Jan 6 09:06:18 2015 -0800

      target-openrisc: bugfix for dec_sys to decode instructions correctly

      Fixed the decoding of "system" instructions (starting with 0x2)
      in dec_sys() in translate.c.  In particular, the l.trap instruction
      is now correctly decoded, which enables for singlestepping and
      breakpoints to be set in GDB.

      Signed-off-by: David R. Morrison <dmorrison@invlim.com>
      Acked-by: Jia Liu <proljc@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fac6688a18574b6f2caa8c699a936e729ed53ece
  Author: Don Slutz <dslutz@verizon.com>
  Date:   Mon Dec 22 10:04:00 2014 -0500

      Do not hang on full PTY

      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b4952c3677170139541bc6bc14e9c2cfdc056181
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:39 2015 +0100

      misc: Fix new typos in comments

      recieve -> receive
      suprise -> surprise

      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1281f8e3085b9149b8704419534f0e6f23c1fa64
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:38 2015 +0100

      target-arm: Fix typo in comment (seperately -> separately)

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Greg Bellows <greg.bellows@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 37097418be0a722342fc0ef77c2e773359d2cd05
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:37 2015 +0100

      target-tricore: Fix new typos

      adress -> address
      managment -> management

      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 90d6a6730b4dbe7d0ada9900aba8263d61376812
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:26:55 2014 +0000

      migration/qemu-file.c: Don't shift left into sign bit

      Add a cast in qemu_get_be32() to avoid shifting left into the sign
      bit of a signed integer (which is undefined behaviour in C).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2d8ac5eb7a7e72e0877cca2b3705eebeaf5526e7
  Author: SeokYeon Hwang <syeon.hwang@samsung.com>
  Date:   Tue Dec 23 22:26:54 2014 +0000

      translate-all: Mark map_exec() with the 'unused' attribute

      Mark map_exec() with the 'unused' attribute to avoid '-Wunused-function'
      warnings on clang 3.4 or later. This means we don't need to mark it
      'inline', which is what we were previously using to suppress the warning
      (a trick which only works with gcc, not clang).

      Signed-off-by: SeokYeon Hwang <syeon.hwang@samsung.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      [PMM: tweaked comment message a little]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c6d5c1ade0b681b6f93c3d9d214389355cc563c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:26:53 2014 +0000

      tests/hd-geo-test.c: Remove unused test_image variable

      Remove unused variable test_image; this silences a clang warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9feb8adeaa850d15b930c30f22c1ed2f2f695172
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 10:17:36 2014 +0100

      vt82c686: avoid out-of-bounds read

      superio_ioport_readb can read the 256th element of the array.
      Coverity reports an out-of-bounds write in superio_ioport_writeb,
      but it does not show the corresponding out-of-bounds read
      because it cannot prove that it can happen.  Fix the root
      cause of the problem (zhanghailang's patch instead fixes
      the logic in superio_ioport_writeb).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Cc: qemu-stable@nongnu.org

  commit b629a38a13745d62d44de8ebb00f4e38ec6d8f7e
  Merge: 3a7f560 1979b90
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jan 14 18:02:47 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Mostly bugfixes and cleanups from qemu-devel.  Yet another small patch from
      the record/replay series, and a few SCSI and i386 patches as well.

      # gpg: Signature made Wed 14 Jan 2015 09:39:14 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        cpus: consistently use QEMU_CLOCK_VIRTUAL_RT for icount_warp_rt timer
        qemu-timer: rename timer_init to timer_init_tl
        scsi: fix cancellation when I/O was completed but DMA was not.
        rules.mak: Fix module build
        hw/scsi/lsi53c895a: add support for additional diag / debug registers
        qemu-common.h: optimise muldiv64 if int128 is available
        target-i386: do not memcpy in and out of xmm_regs
        target-i386: fix movntsd on big-endian hosts
        vl.c: fix regression when reading memory size from config file
        vl: Don't silently change topology when all -smp options were set
        vl: fix max_cpus check
        vl: Avoid unnecessary 'if' nesting
        9pfs: changed to use event_notifier instead of qemu_pipe
        vl.c: fix regression when reading machine type from config file
        char: restore stdio echo on resume from suspend.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1979b908b6e99cc24c1c0746060422f8778aa9d9
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Jan 12 15:00:43 2015 +0300

      cpus: consistently use QEMU_CLOCK_VIRTUAL_RT for icount_warp_rt timer

      Fix mismatch between timer_new_ms and timer_mod.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f186aa976bab11130af7299b07f7fafd258a63f1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 21:54:14 2014 +0100

      qemu-timer: rename timer_init to timer_init_tl

      timer_init is not called that often.  Free the name for an equivalent
      of timer_new.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 488eef2f1d16c97cf7f9ebf644ecafa1ea1e9acc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 12 11:47:30 2015 +0100

      scsi: fix cancellation when I/O was completed but DMA was not.

      Commit d577646 (scsi: Introduce scsi_req_cancel_complete, 2014-09-25)
      was supposed to have no semantic change, but it missed a case.  When
      r->aiocb has already been NULLed, but DMA was not complete and the
      SCSI layer was waiting for scsi_req_continue, after the patch the
      SCSI layer will not call the .cancel callback of SCSIBusInfo.

      Fixes: d5776465ee9a55815792efa34d79de240f4ffd99
      Cc: qemu-stable@nongnu.org
      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c88f68ec3ce54ebc5da13d07d6512689c4e9be30
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jan 12 12:43:09 2015 +0800

      rules.mak: Fix module build

      Module build is broken since commit c261d774fb ( rules.mak: Fix DSO
      build by pulling in archive symbols). That commit added .mo placeholders
      of DSO to -y variables, in order to pull stub symbols to executable. But
      the placeholders are unintentionally expanded in -y, rather than
      filtered out while linking.

      Fix it by moving the -objs expanding to before inserting .mo
      placeholders.  Note that passing -cflags and -libs to member objects are
      also moved to keep it happening before object expanding.

      Reported-by: Bharata B Rao <bharata.rao@gmail.com>
      Tested-by: Bharata B Rao <bharata.rao@gmail.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f84da3a07668ce881a0c853390eb05313d61157
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Jan 12 10:45:17 2015 +0100

      hw/scsi/lsi53c895a: add support for additional diag / debug registers

      Some ancient Linux kernels read from registers 0x09 and 0x3c-3f during
      boot. According to the spec these registers are for diag and debug
      purposes only. If they are absend qemu aborts on read.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e1660dc57c1bacb78cbe39001e58a577c927dacb
  Author: Frediano Ziglio <freddy77@gmail.com>
  Date:   Fri Jan 9 11:25:20 2015 +0000

      qemu-common.h: optimise muldiv64 if int128 is available

      Let compiler do the job to optimise the function.

      Signed-off-by: Frediano Ziglio <frediano.ziglio@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Frediano Ziglio <freddy77@gmail.com>

  commit bee818872cd9e8c07be529f75da3e48a68bf7a93
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 09:44:38 2014 +0200

      target-i386: do not memcpy in and out of xmm_regs

      After the next patch, we will move the high parts of AVX and AVX512 registers
      in the same array as the SSE registers.  This will make it impossible to
      memcpy an array of 128-bit values in and out of xmm_regs in one swoop.
      Use a for loop instead.

      Similarly, always use XMM_Q in translate.c.  This avoids introducing bugs
      such as the one fixed in the previous patch.

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 07958082fdf39284935d38a5b8aec1fe7d020637
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 7 17:36:27 2015 +0100

      target-i386: fix movntsd on big-endian hosts

      This was accessing an XMM register's low half without going through XMM_Q.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3b9985e9a104dd90427570dd4e06e4d1f152c48b
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Jan 11 12:38:43 2015 +0200

      vl.c: fix regression when reading memory size from config file

      This is happening because an actual logic is performed on the memory
      arguments inside the main's switch, disregarding the config file content.

      Solved by extracting the logic on a separate function and calling it
      after the switch.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a7f560fa612610822727f7647ed6bc10bccd6ec
  Merge: a00369f c1d322e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 13 18:32:42 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-13' into staging

      * remotes/sstabellini/xen-2015-01-13:
        xen-hvm: increase maxmem before calling xc_domain_populate_physmap
        xen-pt: Fix PCI devices re-attach failed

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c1d322e6048796296555dd36fdd102d7fa2f50bf
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Wed Dec 3 08:15:19 2014 -0500

      xen-hvm: increase maxmem before calling xc_domain_populate_physmap

      Increase maxmem before calling xc_domain_populate_physmap_exact to
      avoid the risk of running out of guest memory. This way we can also
      avoid complex memory calculations in libxl at domain construction
      time.

      This patch fixes an abort() when assigning more than 4 NICs to a VM.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Don Slutz <dslutz@verizon.com>

  commit a00369fc565cef32076b767ecff34469642afe06
  Merge: 7d5ad15 07d31d0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 13 13:49:18 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Tue 13 Jan 2015 13:48:06 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (38 commits)
        NVMe: Set correct VS Value for 1.1 Compliant Controllers
        MAINTAINERS: Add migration/block* to block subsystem
        MAINTAINERS: Update email addresses for Chrysostomos Nanakos
        nvme: Fix get/set number of queues feature
        ide: Implement VPD response for ATAPI
        block: Split BLOCK_OP_TYPE_COMMIT to BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}
        block: limited request size in write zeroes unsupported path
        coroutine: try harder not to delete coroutines
        coroutine: drop qemu_coroutine_adjust_pool_size
        coroutine: rewrite pool to avoid mutex
        QSLIST: add lock-free operations
        test-coroutine: avoid overflow on 32-bit systems
        qemu-thread: add per-thread atexit functions
        coroutine-ucontext: use __thread
        qemu-iotests: Add supported os parameter for python tests
        qemu-iotests: Add "_supported_os Linux" to 058
        qemu-iotests: Replace "/bin/true" with "true"
        .gitignore: Ignore generated "common.env"
        libqos: Convert malloc-pc allocator to a generic allocator
        migration/block: fix pending() return value
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 07d31d07f4b28a61b65cec95da69851c675f20b9
  Author: Anubhav Rakshit <anubhav.rakshit@gmail.com>
  Date:   Thu Jan 8 15:10:35 2015 +0530

      NVMe: Set correct VS Value for 1.1 Compliant Controllers

      According to NVMe specifications Bits 15:08 represent Minor Version number.

      Signed-off-by: Anubhav Rakshit <anubhav.rakshit@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47b0f45a9282aaf73231f34ca60369a12c8d8d3c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 11 18:49:47 2014 +0800

      MAINTAINERS: Add migration/block* to block subsystem

      We are moving block-migration.c to the separated migration directory,
      keep this file watched by block maintainers is a good idea.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5734edd8372cce37c8c203b95beb03acbec72f49
  Author: Chrysostomos Nanakos <chris@include.gr>
  Date:   Tue Dec 9 14:58:22 2014 +0200

      MAINTAINERS: Update email addresses for Chrysostomos Nanakos

      Remove first email address and let the one from which I am contributing.

      Signed-off-by: Chrysostomos Nanakos <chris@include.gr>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e7026f1953c16d1cc3e8310cc27db6acf61d9def
  Author: Alex Friedman <alex@e8storage.com>
  Date:   Fri Dec 5 14:40:24 2014 +0200

      nvme: Fix get/set number of queues feature

      According to the specification, the low 16 bits should contain the number of
      I/O submission queues, and the high 16 bits should contain the number of
      I/O completion queues.

      Signed-off-by: Alex Friedman <alex@e8storage.com>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a502563eef7d7c2c9120b237059426e229eefe9
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Dec 10 13:17:07 2014 -0500

      ide: Implement VPD response for ATAPI

      SCSI devices have multiple kinds of queries they need to respond
      to, as defined in the "cmd inquiry" section in MMC-6 and SPC-3.

      Relevent sections:
      MMC-6 revision 2g:
            Non-VPD response data and pointer to SPC-3;
            Section 6.8 "Inquiry Command"
      SPC-3 revision 23:
            Inquiry command and error handling:
            Section 6.4 "INQUIRY command"
            VPD data pages format:
            Section 7.6 "Vital product data parameters"

      We implement these Vital Product Data queries for SCSI, but not for
      ATAPI through IDE. The result is that if you are looking for the WWN
      identifier via tools such as sg3_utils, you will be unable to query
      our CD/DVD rom device to obtain it.

      This patch adds the minimum number of mandatory responses as defined
      by SPC-3, which include the "supported pages" response (page 0x00)
      and the "Device Identification" response (page 0x83). It also correctly
      responds when it receives a request for an illegal page to improve
      error output from related tools.

      The Device ID page contains an arbitrary list of identification
      strings of various formats; the ID strings included in this patch
      were chosen to mimic those provided by the libata driver when
      emulating this SCSI query (model, serial, and wwn when present.)

      Example:

      # libata emulated response
      [root@localhost ~]# sg_inq --id /dev/sda
      VPD INQUIRY: Device Identification page
        Designation descriptor number 1, descriptor length: 24
          designator_type: vendor specific [0x0],  code_set: ASCII
          associated with the addressed logical unit
            vendor specific: QM00001
        Designation descriptor number 2, descriptor length: 72
          designator_type: T10 vendor identification,  code_set: ASCII
          associated with the addressed logical unit
            vendor id: ATA
            vendor specific: QEMU HARDDISK                           QM00001

      # QEMU generated ATAPI response, with WWN
      [root@localhost ~]# sg_inq --id /dev/sr0
      VPD INQUIRY: Device Identification page
        Designation descriptor number 1, descriptor length: 24
          designator_type: vendor specific [0x0],  code_set: ASCII
          associated with the addressed logical unit
            vendor specific: QM00005
        Designation descriptor number 2, descriptor length: 72
          designator_type: T10 vendor identification,  code_set: ASCII
          associated with the addressed logical unit
            vendor id: ATA
            vendor specific: QEMU DVD-ROM                            QM00005
        Designation descriptor number 3, descriptor length: 12
          designator_type: NAA,  code_set: Binary
          associated with the addressed logical unit
            NAA 5, IEEE Company_id: 0xc50
            Vendor Specific Identifier: 0x15ea71bb
            [0x5000c50015ea71bb]

      See also: hw/scsi/scsi-disk.c, scsi_disk_emulate_inquiry()

      Signed-off-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bb00021de0b5908bc2c3ca467ad9a2b0c9c36459
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Sep 11 13:14:00 2014 +0800

      block: Split BLOCK_OP_TYPE_COMMIT to BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}

      Like BLOCK_OP_TYPE_BACKUP_SOURCE and BLOCK_OP_TYPE_BACKUP_TARGET,
      block-commit involves two asymmetric devices.

      This change is not user-visible (yet), because commit only works with
      device names.

      But once we enable backing reference in blockdev-add, or specifying
      node-name in block-commit command, we don't want the user to start two
      commit jobs on the same backing chain, which will corrupt things because
      of the final bdrv_swap.

      Before we have per category blockers, splitting this type is still
      better.

      [Resolved virtio-blk dataplane conflict by replacing
      BLOCK_OP_TYPE_COMMIT with both BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}.
      They are safe since the block job runs in the same AioContext as the
      dataplane IOThread.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 095e4fa4b56cf511cb41005872eeace9a2f24582
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Jan 5 12:29:49 2015 +0100

      block: limited request size in write zeroes unsupported path

      If bs->bl.max_write_zeroes is large and we end up in the unsupported
      path we might allocate a lot of memory for the iovector and/or even
      generate an oversized requests.

      Fix this by limiting the request by the minimum of the reported
      maximum transfer size or 16MB (32768 sectors).

      Reported-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1420457389-16332-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 51a2219bdceed16e81c6e2e2f08aed39c579728f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Dec 2 12:05:50 2014 +0100

      coroutine: try harder not to delete coroutines

      Placing coroutines on the global pool should be preferrable, because it
      can help all threads.  But if the global pool is full, we can still
      try to save some allocations by stashing completed coroutines on the
      local pool.  This is quite cheap too, because it does not require
      atomic operations, and provides a gain of 15% in the best case.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-8-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 66552b894bd68dd6539fb6d656ad2c21bdd6acbe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:49 2014 +0100

      coroutine: drop qemu_coroutine_adjust_pool_size

      This is not needed anymore.  The new TLS-based algorithm is adaptive.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4d68e86bb10159099da0798f74e7512955f15eec
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:48 2014 +0100

      coroutine: rewrite pool to avoid mutex

      This patch removes the mutex by using fancy lock-free manipulation of
      the pool.  Lock-free stacks and queues are not hard, but they can suffer
      from the ABA problem so they are better avoided unless you have some
      deferred reclamation scheme like RCU.  Otherwise you have to stick
      with adding to a list, and emptying it completely.  This is what this
      patch does, by coupling a lock-free global list of available coroutines
      with per-CPU lists that are actually used on coroutine creation.

      Whenever the destruction pool is big enough, the next thread that runs
      out of coroutines will steal the whole destruction pool.  This is positive
      in two ways:

      1) the allocation does not have to do any atomic operation in the fast
      path, it's entirely using thread-local storage.  Once every POOL_BATCH_SIZE
      allocations it will do a single atomic_xchg.  Release does an atomic_cmpxchg
      loop, that hopefully doesn't cause any starvation, and an atomic_inc.

      A later patch will also remove atomic operations from the release path,
      and try to avoid the atomic_xchg altogether---succeeding in doing so if
      all devices either use ioeventfd or are not submitting requests actively.

      2) in theory this should be completely adaptive.  The number of coroutines
      around should be a little more than POOL_BATCH_SIZE * number of allocating
      threads; so this also empties qemu_coroutine_adjust_pool_size.  (The previous
      pool size was POOL_BATCH_SIZE * number of block backends, so it was a bit
      more generous.  But if you actually have many high-iodepth disks, it's better
      to put them in different iothreads, which will also use separate thread
      pools and aio=native file descriptors).

      This speeds up perf/cost (in tests/test-coroutine) by a factor of ~1.33.
      No matter if we end with some kind of coroutine bypass scheme or not,
      it cannot hurt to optimize hot code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c740ad92d0d958fa785e5d7aa1b67ecaf30a6a54
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:47 2014 +0100

      QSLIST: add lock-free operations

      These operations are trivial to implement and do not have ABA problems.
      They are enough to implement simple multiple-producer, single consumer
      lock-free lists or, as in the next patch, the multiple consumers can
      steal a whole batch of elements and process them at their leisure.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6d86ae0824bdd6175dd3874688a871e981093888
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:46 2014 +0100

      test-coroutine: avoid overflow on 32-bit systems

      unsigned long is not large enough to represent 1000000000 * duration there.
      Just use floating point.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ef57137f1b30545a477ab798d34a669b0abf5320
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:45 2014 +0100

      qemu-thread: add per-thread atexit functions

      Destructors are the main additional feature of pthread TLS compared
      to __thread.  If we were using C++ (hint, hint!) we could have used
      thread-local objects with a destructor.  Since we are not, instead,
      we add a simple Notifier-based API.

      Note that the notifier must be per-thread as well.  We can add a
      global list as well later, perhaps.

      The Win32 implementation has some complications because a) detached
      threads used not to have a QemuThreadData; b) the main thread does
      not go through win32_start_routine, so we have to use atexit too.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1d1b206b07977fe0e75b0254e5b50c215c97803
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:44 2014 +0100

      coroutine-ucontext: use __thread

      ELF thread local storage is about 10% faster on tests/test-coroutine's
      perf/cost test.  The timing on my machine is 190ns per iteration with
      pthread TLS, 170 with ELF TLS.

      Based on a patch by Kevin Wolf and Peter Lieven, but redone to follow
      the model of coroutine-win32.c (including the important "noinline"
      attribute!).

      Platforms without thread-local storage (OpenBSD probably?) will need
      a new-enough GCC for this to compile, in order to use the same emutls
      support that Windows already relies on.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bc521696607c5348fcd8a9e57b408d0ac0dbe2f8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:52 2015 +0800

      qemu-iotests: Add supported os parameter for python tests

      If I understand correctly, qemu-iotests never meant to be portable. We
      only support Linux for all the shell cases, but didn't specify it for
      python tests. Now add this and default all the python tests as Linux
      only. If we cares enough later, we can override the parameter in
      individual cases.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9c8ab1ae0d7c4a135c832c784f088ae5e2140585
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:49 2015 +0800

      qemu-iotests: Add "_supported_os Linux" to 058

      Other cases have this, and this test is not portable as well, as we want
      to add "make check-block" to "make check", it shouldn't fail on Mac OS
      X.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a2d9c0c407456faa871870c57cf99942739e28ab
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:48 2015 +0800

      qemu-iotests: Replace "/bin/true" with "true"

      The former is not portable because on Mac OSX it is /usr/bin/true.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1dbe67503b8d35cec797d2b8e742f11e4553cf3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:46 2015 +0800

      .gitignore: Ignore generated "common.env"

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 99605175c93a24be4aa39543cd02551ea205e614
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Tue Jan 13 10:40:53 2015 +0800

      xen-pt: Fix PCI devices re-attach failed

      Use the 'xl pci-attach $DomU $BDF' command to attach more than
      one PCI devices to the guest, then detach the devices with
      'xl pci-detach $DomU $BDF', after that, re-attach these PCI
      devices again, an error message will be reported like following:

          libxl: error: libxl_qmp.c:287:qmp_handle_error_response: receive
          an error message from QMP server: Duplicate ID 'pci-pt-03_10.1'
          for device.

      If using the 'address_space_memory' as the parameter of
      'memory_listener_register', 'xen_pt_region_del' will not be called
      if the memory region's name is not 'xen-pci-pt-*' when the devices
      is detached. This will cause the device's related QemuOpts object
      not be released properly.

      Using the device's address space can avoid such issue, because the
      calling count of 'xen_pt_region_add' when attaching and the calling
      count of 'xen_pt_region_del' when detaching is the same, so all the
      memory region ref and unref by the 'xen_pt_region_add' and
      'xen_pt_region_del' can be released properly.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reported-by: Longtao Pang <longtaox.pang@intel.com>

  commit 292be092ad48ac530dd254ada109851e9a2353f5
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Thu Oct 23 10:12:42 2014 +0200

      libqos: Convert malloc-pc allocator to a generic allocator

      The allocator in malloc-pc has been extracted, so it can be used in every arch.
      This operation showed that both the alloc and free functions can be also
      generic.
      Because of this, the QGuestAllocator has been removed from is function to wrap
      the alloc and free function, and now just contains the allocator parameters.
      As a result, only the allocator initalizer and unitializer are arch dependent.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 04636dc410b163c2243e66c3813dd4900a50a4ed
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
  Date:   Tue Dec 30 13:04:16 2014 +0300

      migration/block: fix pending() return value

      Because of wrong return value of .save_live_pending() in
      migration/block.c, migration finishes before the whole disk is
      transferred. Such situation occurs when the migration process is fast
      enough, for example when source and dest are on the same host.

      If in the bulk phase we return something < max_size, we will skip
      transferring the tail of the device. Currently we have "set pending to
      BLOCK_SIZE if it is zero" for bulk phase, but there no guarantee, that
      it will be < max_size.

      True approach is to return, for example, max_size+1 when we are in the
      bulk phase.

      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
      Message-id: 1419933856-4018-2-git-send-email-vsementsov@parallels.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4dd7b8d30cfa1aebee547958db27efd581a58d9b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 19 17:17:06 2014 +0100

      iotests: Filter out "I/O thread spun..." warning

      Filter out the "main loop: WARNING: I/O thread spun for..." warning from
      qemu output (it hardly matters for code specifically testing I/O).

      Furthermore, use _filter_qemu in all the custom functions which run
      qemu.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7c6a4ab871cae829ea754c717db2d40c2c115224
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:07 2014 +0800

      qemu-iotests: Test blockdev-backup in 055

      This applies cases on drive-backup on blockdev-backup, except cases with
      target format and mode.

      Also add a case to check source == target.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-5-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit bd8baecddc3c45f1b3b8322fbf41a3c4b01ec1b7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:06 2014 +0800

      block: Add blockdev-backup to transaction

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-4-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c29c1dd312f39ec18a3c6177c6da09a75e095d70
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:05 2014 +0800

      qmp: Add command 'blockdev-backup'

      Similar to drive-backup, but this command uses a device id as target
      instead of creating/opening an image file.

      Also add blocker on target bs, since the target is also a named device
      now.

      Add check and report error for bs == target which became possible but is
      an illegal case with introduction of blockdev-backup.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-3-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit b7b9d39a7a5bd3a7fe5968b7780c9868c3210a4d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:04 2014 +0800

      qapi: Comment version info in TransactionAction

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-2-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c4237dfa635900e4d1cdc6038d5efe3507f45f0c
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
  Date:   Thu Nov 27 12:40:46 2014 +0300

      block: fix spoiling all dirty bitmaps by mirror and migration

      Mirror and migration use dirty bitmaps for their purposes, and since
      commit [block: per caller dirty bitmap] they use their own bitmaps, not
      the global one. But they use old functions bdrv_set_dirty and
      bdrv_reset_dirty, which change all dirty bitmaps.

      Named dirty bitmaps series by Fam and Snow are affected: mirroring and
      migration will spoil all (not related to this mirroring or migration)
      named dirty bitmaps.

      This patch fixes this by adding bdrv_set_dirty_bitmap and
      bdrv_reset_dirty_bitmap, which change concrete bitmap. Also, to prevent
      such mistakes in future, old functions bdrv_(set,reset)_dirty are made
      static, for internal block usage.

      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
      CC: John Snow <jsnow@redhat.com>
      CC: Fam Zheng <famz@redhat.com>
      CC: Denis V. Lunev <den@openvz.org>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417081246-3593-1-git-send-email-vsementsov@parallels.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit a06e43556e3faea22de4cce0da7a6f362d3ca9a6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 16 09:40:24 2014 +0800

      qapi: Fix document for BlockStats.node-name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1418694024-26498-1-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 527ab22a2a268421564cfba3409d081aee22c22b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:29 2014 +0100

      iotests: Add test for relative backing file names

      Sometimes, qemu does not have a filename to work with, so it does not
      know which directory to use for a backing file specified by a relative
      filename. Add a test which tests that qemu exits with an appropriate
      error message.

      Additionally, add a test for qemu-img create with a backing filename
      relative to the backed image's base directory while omitting the image
      size.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1085daf9411e355ce3bd6d7034e23a8405599889
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:28 2014 +0100

      block/vmdk: Relative backing file for creation

      When a vmdk image is created with a backing file, it is opened to check
      whether it is indeed a vmdk file by letting qemu probe it. When doing
      so, the backing filename is relative to the image's base directory so it
      should be interpreted accordingly.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 291680186f7f8856d943793414d1b8df6c562fc4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:27 2014 +0100

      block: Relative backing file for image creation

      Relative backing filenames are always relative to the backed image's
      directory; the same applies to image creation. Therefore, if the backing
      file has to be opened for determining its size (in case the size has not
      been explicitly specified) its filename should be interpreted relative
      to the new image's base directory and not relative to qemu's working
      directory.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9f07429e8873124c588847b0d499cb32b9410bdd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:26 2014 +0100

      block: JSON filenames and relative backing files

      When using a relative backing file name, qemu needs to know the
      directory of the top image file. For JSON filenames, such a directory
      cannot be easily determined (e.g. how do you determine the directory of
      a qcow2 BDS directly on top of a quorum BDS?). Therefore, do not allow
      relative filenames for the backing file of BDSs only having a JSON
      filename.

      Furthermore, BDS::exact_filename should be used whenever possible. If
      BDS::filename is not equal to BDS::exact_filename, the former will
      always be a JSON object.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a82855a1a819f3de49781d42728f485fbd64284
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:25 2014 +0100

      block: Get full backing filename from string

      Introduce bdrv_get_full_backing_filename_from_filename(), a function
      which takes the name of the backed file and a potentially relative
      backing filename to produce the full (absolute) backing filename.

      Use this function from bdrv_get_full_backing_filename().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a97ceca578e69f9b050a2400e1979a068b0654eb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:24 2014 +0100

      checkpatch: Brace handling on multi-line condition

      CODING_STYLE states the following about braces around blocks:

      > The opening brace is on the line that contains the control flow
      > statement that introduces the new block; [...]

      This is obviously impossible with multi-line conditions. Therefore,
      CODING_STYLE does not make any clear statement about where to put the
      opening brace after a multi-line condition.

      There is a reason to prefer to place the opening brace on an own line
      after such a condition while still placing it on the same line as the
      "control flow statement" if possible; that reason is that the last line
      of a multi-line condition is indented, in the case of "if", it is often
      indented by four spaces, just as much as the first statement in the
      block will be indented. This is hard to read as there is no clearly
      visible distinction between condition and block. Placing the opening
      brace on a separate line solves this issue.

      Also, there are cases where placing the opening brace on a separate line
      is the only viable option; if the previous line had nearly 80 characters
      and splitting it is not desirable, the opening brace is naturally placed
      on an own line.

      This patch fixes checkpatch.pl to not complain about braces on own lines
      if the condition introducing the block spanned more than one line, or if
      the previous line had 79 or 80 characters.

      Furthermore, the warning about not having braces around a block is fixed
      to mind braces not being on the last line of the condition.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ee82310f8a6cc9ba9e8d1ac892f1a3cfc0debd8c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:10:00 2014 +0100

      block: replace g_new0 with g_new for bottom half allocation.

      This saves about 15% of the clock cycles spent on allocation.  Using the
      slice allocator does not add a visible improvement; allocation is faster
      than malloc, while freeing seems to be slower.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e012b78cf5bc42f20ef1a1f78383035f2293ceea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:09:59 2014 +0100

      block: do not allocate an iovec per read of a growable/zero_after_eof BDS

      Most reads do not go past the end of the file, and they can use the
      input QEMUIOVector instead of creating one.  This removes the
      qemu_iovec_* functions from the profile.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fcf5def1ab0f94ff120b7141c943b517d2ece83d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:09:58 2014 +0100

      block: mark AioContext as recursive

      AioContext can be accessed recursively, in fact that's what we do with
      aio_poll.  Marking the GSource as recursive avoids that GLib blocks it
      and unblocks it around every call to aio_dispatch, which is a pretty
      expensive operation.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8aff7d6bfa1632d722f47a1a6bca679221b6db3
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Dec 15 13:07:18 2014 +0800

      qemu-iotests: Speed up make check-block

      Using /tmp, which is usually mounted as tmpfs, the quick group can be
      quicker.

      On my laptop (Lenovo T430s with Fedora 20), this reduces the time from
      50s to 30s.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 709e57753b57cbef674e88e85056612d3e1727c2
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Dec 15 13:07:17 2014 +0800

      qemu-iotests: Remove 091 from quick group

      For the purpose of allowing running quick group on tmpfs.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7d5ad15d17f26dd4f9ff5f3491828bc34e74f28c
  Merge: 5435f1d a39d97c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 11:13:24 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon 12 Jan 2015 10:27:41 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it
        hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of net_disconnect()
        hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' fails
        net: remove all cleanup methods from NIC NetClientInfos

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a39d97c7becca5fd679d70d17ae5b1d62b9b5da6
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:58:42 2014 +0800

      hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it

      Since net_init() checks whether 'netdev->mac' is NULL, before alloc it;
      net_release() also need set 'netdev->mac' to NULL after free it.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d46858377b822b820946c6b2e3a9153ee0aebd37
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:52:16 2014 +0800

      hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of net_disconnect()

      net_init() and net_free() are pairs, net_connect() and net_disconnect()
      are pairs. net_init() creates 'netdev->nic', so also need free it in
      net_free().

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b4f72e31b924bec2c18fe0b2a8c6462dbed9dcb2
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:48:54 2014 +0800

      hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' fails

      When map 'netdev->rxs' fails, need free the original resource, or will
      cause resource leak.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 57407ea44cc0a3d630b9b89a2be011f1955ce5c1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 17:53:19 2014 +0100

      net: remove all cleanup methods from NIC NetClientInfos

      All NICs have a cleanup function that, in most cases, zeroes the pointer
      to the NICState.  In some cases, it frees data belonging to the NIC.

      However, this function is never called except when exiting from QEMU.
      It is not necessary to NULL pointers and free data here; the right place
      to do that would be in the device's unrealize function, after calling
      qemu_del_nic.  Zeroing the NIC multiple times is also wrong for multiqueue
      devices.

      This cleanup function gets in the way of making the NetClientStates for
      the NIC hold an object_ref reference to the object, so get rid of it.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5435f1d77eb4e8cf5e4103f64f0ecbe9f2902c71
  Merge: 64ea803 9e03a04
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 10:09:41 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150112-v3' into staging

      s390x patches for 2.3.

      Highlight is support for PCI devices on s390x. Otherwise, performance
      improvements (register sync) and small cleanups.

      # gpg: Signature made Mon 12 Jan 2015 09:49:31 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150112-v3:
        kvm: extend kvm_irqchip_add_msi_route to work on s390
        s390: implement pci instructions
        s390: Add PCI bus support
        s390x/kvm: avoid syscalls by syncing registers with kvm_run
        s390x/kvm: sync register support helper function
        s390x/css: Clean up unnecessary CONFIG_USER_ONLY wrappers
        s390x/ccw: fix oddity in machine class init

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9e03a0405d56b4af8952b794d0e5dd9206ee7329
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:40 2015 +0100

      kvm: extend kvm_irqchip_add_msi_route to work on s390

      on s390 MSI-X irqs are presented as thin or adapter interrupts
      for this we have to reorganize the routing entry to contain
      valid information for the adapter interrupt code on s390.
      To minimize impact on existing code we introduce an architecture
      function to fixup the routing entry.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 863f6f52b7134304234ea81554f62f54afb016fa
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:39 2015 +0100

      s390: implement pci instructions

      This patch implements the s390 pci instructions in qemu. It allows
      to access and drive pci devices attached to the s390 pci bus.
      Because of platform constrains devices using IO BARs are not
      supported. Also a device has to support MSI/MSI-X to run on s390.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 8cba80c3a0331926c9c412c4c1e07896de29aab6
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:38 2015 +0100

      s390: Add PCI bus support

      This patch implements a pci bus for s390x together with infrastructure
      to generate and handle hotplug events, to configure/unconfigure via
      sclp instruction, to do iommu translations and provide s390 support for
      MSI/MSI-X notification processing.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 59ac15326ed8c936459c8163cf264e9fd35a18ba
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:31 2014 +0100

      s390x/kvm: avoid syscalls by syncing registers with kvm_run

      We can avoid loads of syscalls when dropping to user space by storing the values
      of more registers directly within kvm_run.

      Support is added for:
      - ARCH0: CPU timer, clock comparator, TOD programmable register,
               guest breaking-event register, program parameter
      - PFAULT: pfault parameters (token, select, compare)

      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fdb78ec00655e59c8d47eec91918a4da0d966685
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:30 2014 +0100

      s390x/kvm: sync register support helper function

      Let's unify the code to sync registers by moving the checks into a helper
      function can_sync_regs().

      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6781fc412ef1349740813cbaabe0e86dad39a9be
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:29 2014 +0100

      s390x/css: Clean up unnecessary CONFIG_USER_ONLY wrappers

      The css functions are only used from ioinst.c and other files that are
      only built for CONFIG_SOFTMMU. So we do not need the dummy wrappers for
      the CONFIG_USER_ONLY target in the cpu.h header.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Jason J. Herne <jjherne@us.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fb85b34da77cba6e255830e7a49447d3c7ef74f0
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Dec 3 15:38:28 2014 +0100

      s390x/ccw: fix oddity in machine class init

      ccw_machine_class_init() uses ',' instead of ';' while initializing
      the class' fields. This is almost certainly a copy/paste error and,
      while legal C, rather on the unusual side. Just use ';' everywhere.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 64ea8038ffbf703dcd438a108d2d5499c8ff95d9
  Merge: aaf0301 b3e27c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 22:29:09 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150109.0' into staging

      VFIO fixes:
      - Fix 32bit overflow in handling large PCI BARs (Alex Williamson)
      - Fix interrupt shutdown ordering (Alex Williamson)

      # gpg: Signature made Fri 09 Jan 2015 16:23:42 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150109.0:
        vfio-pci: Fix interrupt disabling
        vfio-pci: Fix BAR size overflow

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aaf03019175949eda5087329448b8a0033b89479
  Merge: 97052d6 a166614
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 21:02:23 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc: resizeable ROM blocks

      This makes ROM blocks resizeable.  This infrastructure is required for other
      functionality we have queued.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu 08 Jan 2015 11:19:24 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        acpi-build: make ROMs RAM blocks resizeable
        memory: API to allocate resizeable RAM MR
        arch_init: support resizing on incoming migration
        exec: qemu_ram_alloc_resizeable, qemu_ram_resize
        exec: split length -> used_length/max_length
        exec: cpu_physical_memory_set/clear_dirty_range
        memory: add memory_region_set_size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 97052d64e4fb934bcf25f4a6b42dc06f6ecbf9eb
  Merge: e77d927 75c74cc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 19:50:21 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-01-07

      New year's release. This time's highlights:

        - E500: More RAM support
        - pseries: New SLOF release
        - Migration fixes
        - Simplify USB spawning logic, removes support for explicit usb=off
        - TCG: Simple untansactional TM emulation

      # gpg: Signature made Wed 07 Jan 2015 15:19:37 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (37 commits)
        hw/ppc/mac_newworld: simplify usb controller creation logic
        hw/ppc/spapr: simplify usb controller creation logic
        hw/ppc/mac_newworld: QOMified mac99 machines
        hw/usb: simplified usb_enabled
        hw/machine: added machine_usb wrapper
        hw/ppc: modified the condition for usb controllers to be created for some ppc machines
        target-ppc: Cast ssize_t to size_t before printing with %zx
        target-ppc: Mark SR() and gen_sync_exception() as !CONFIG_USER_ONLY
        PPC: e500: Fix GPIO controller interrupt number
        target-ppc: Introduce Privileged TM Noops
        target-ppc: Introduce tcheck
        target-ppc: Introduce TM Noops
        target-ppc: Introduce tbegin
        target-ppc: Introduce TEXASRU Bit Fields
        target-ppc: Power8 Supports Transactional Memory
        target-ppc: Introduce tm_enabled Bit to CPU State
        target-ppc: Introduce Feature Flag for Transactional Memory
        target-ppc: Introduce Instruction Type for Transactional Memory
        pseries: Update SLOF firmware image to 20141202
        PPC: Fix crash on spapr_tce_table_finalize()
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e77d927f1a1876ef341b4df287939b0c935703d5
  Merge: f1c5831 ea259ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 19:06:41 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150105' into staging

      seccomp branch queue

      # gpg: Signature made Mon 05 Jan 2015 17:17:01 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150105:
        seccomp: add mbind() to the syscall whitelist
        seccomp: typo in configure error message

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ec2cbbdd80463efd4bc81a9d1362a2acb3097a21
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 00:59:47 2014 -0200

      vl: Don't silently change topology when all -smp options were set

      QEMU tries to change the "threads" option even if it was explicitly set
      in the command-line, and it shouldn't do that.

      The right thing to do when all options (cpus, sockets, cores, threds)
      are explicitly set is to sanity check them and abort in case they don't
      make sense (i.e. when sockets*cores*threads < cpus).

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c00cd99527d0d1b47a387239a7e3a8cf8ff82764
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Fri Dec 19 00:59:46 2014 -0200

      vl: fix max_cpus check

      We should confirm max_cpus, which is >= smp_cpus, is
      <= the machine's true max_cpus, not just smp_cpus.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 719cac1ce20c8806303793b2501aedb9edf1bca3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 00:59:45 2014 -0200

      vl: Avoid unnecessary 'if' nesting

      Just a coding style change, to make other changes easier to review.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4d91558d60c229f34819329728cf46ff71e13935
  Author: SeokYeon Hwang <syeon.hwang@samsung.com>
  Date:   Fri Oct 31 17:03:53 2014 +0900

      9pfs: changed to use event_notifier instead of qemu_pipe

      Changed to use event_notifier instead of qemu_pipe.
      It is necessary for porting 9pfs to Windows and MacOS.

      Signed-off-by: SeokYeon Hwang <syeon.hwang@samsung.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 364c3e6b8dd7912e01d19122d791b8c8f6df4f6c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Jan 7 14:11:38 2015 +0200

      vl.c: fix regression when reading machine type from config file

      After 'Machine as QOM' series the machine type input triggers
      the creation of the machine class.
      If the machine type is set in the configuration file, the machine
      class is not updated accordingly and remains the default.

      Fixed that by querying the machine options after the configuration
      file is loaded.

      Cc: qemu-stable@nongnu.org
      Reported-by: William Dauchy <william@gandi.net>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e76d442043ff50716457d5558c237b6e60345f53
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Wed Jan 7 10:38:35 2015 +0200

      char: restore stdio echo on resume from suspend.

      The monitor's auto-completion feature stopped working when stdio is used
      as an input and qemu was resumed after it was suspended (using ctrl-z).

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f1c5831ca3e3eafb89331233221768b64db113e8
  Merge: 11fe680 a3a292c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 18:55:29 2015 +0000

      Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-for-2.3' into staging

      Fixes an init-time check for parameter validity

      # gpg: Signature made Mon 05 Jan 2015 08:34:05 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-virtio-rng/tags/rng-for-2.3:
        virtio-rng: fix check for period_ms validity

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11fe680858653e32782b1c24f939e77427f285b4
  Merge: a4ba200 08f432a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 17:59:16 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/for-2.3' into staging

      Migration fix for virtio-serial devices on bi-endian targets by David
      Gibson.

      # gpg: Signature made Mon 05 Jan 2015 07:26:07 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/for-2.3:
        virtio-serial: Don't keep a persistent copy of config space
        virtio_serial: Don't use vser->config.max_nr_ports internally

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4ba200894e851f4df9be67eb2d091333a17f499
  Merge: 7d010ae 5aa8136
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 16:29:36 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      More migration fixes and more record/replay preparations.  Also moves
      the sdhci-pci device id to make space for the rocker device.

      # gpg: Signature made Sat 03 Jan 2015 08:22:36 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        pci: move REDHAT_SDHCI device ID to make room for Rocker
        block/iscsi: fix uninitialized variable
        pckbd: set bits 2-3-6-7 of the output port by default
        serial: refine serial_thr_ipending_needed
        gen-icount: check cflags instead of use_icount global
        translate: check cflags instead of use_icount global
        cpu-exec: add a new CF_USE_ICOUNT cflag
        target-ppc: pass DisasContext to SPR generator functions
        atomic: fix position of volatile qualifier

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b3e27c3aee8f5a96debfe0346e9c0e3a641a8516
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Fri Jan 9 08:50:53 2015 -0700

      vfio-pci: Fix interrupt disabling

      When disabling MSI/X interrupts the disable functions will leave the
      device in INTx mode (when available).  This matches how hardware
      operates, INTx is enabled unless MSI/X is enabled (DisINTx is handled
      separately).  Therefore when we really want to disable all interrupts,
      such as when removing the device, and we start with the device in
      MSI/X mode, we need to pass through INTx on our way to being
      completely quiesced.

      In well behaved situations, the guest driver will have shutdown the
      device and it will start vfio_exitfn() in INTx mode, producing the
      desired result.  If hot-unplug causes the guest to crash, we may get
      the device in MSI/X state, which will leave QEMU with a bogus handler
      installed.

      Fix this by re-ordering our disable routine so that it should always
      finish in VFIO_INT_NONE state, which is what all callers expect.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 29c6e6df492d81b1843e5dd999171bb84c6effea
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Fri Jan 9 08:50:53 2015 -0700

      vfio-pci: Fix BAR size overflow

      We use an unsigned int when working with the PCI BAR size, which can
      obviously overflow if the BAR is 4GB or larger.  This needs to change
      to a fixed length uint64_t.  A similar issue is possible, though even
      more unlikely, when mapping the region above an MSI-X table.  The
      start of the MSI-X vector table must be below 4GB, but the end, and
      therefore the start of the next mapping region, could still land at
      4GB.

      Suggested-by: Nishank Trivedi <nishank.trivedi@netapp.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>

  commit 7d010ae9e0079ea17d56cd961953d8832052c5fd
  Merge: 59a0419 4eab7a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 15:38:20 2015 +0000

      Merge remote-tracking branch 'remotes/mwalle/tags/lm32-fixes/20141229' into staging

      lm32: milkymist fixes and MAINTAINER update

      # gpg: Signature made Tue 30 Dec 2014 16:54:15 GMT using DSA key ID 3F98A378
      # gpg: Can't check signature: public key not found

      * remotes/mwalle/tags/lm32-fixes/20141229:
        MAINTAINERS: add myself to lm32 and milkymist
        milkymist: softmmu: fix event handling

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 59a0419856c9ed24e9ecd033db092b2e8f81a728
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:17 2015 +0200

      hw/ppc/mac_newworld: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-7-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d941fba0b5fa75604503aac9b3bcc2aa38b03cd0
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:16 2015 +0200

      hw/ppc/spapr: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-6-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1c2fb9b29c325a6944ce4ddddef9fe7e9af26bd
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:15 2015 +0200

      hw/ppc/mac_newworld: QOMified mac99 machines

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-5-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de77a243b3e703adae0a5c981914ff87cb99bdf6
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:14 2015 +0200

      hw/usb: simplified usb_enabled

      The argument is not longer used and the implementation
      uses now QOM instead of QemuOpts.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-4-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e97b623c254a2c7b1f67b21f7aede93d995f4bd
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:13 2015 +0200

      hw/machine: added machine_usb wrapper

      Following QOM convention, object properties should
      not be accessed directly.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-3-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f8b6f8edac926bb979bd2b1d21d896c219b522c2
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:12 2015 +0200

      hw/ppc: modified the condition for usb controllers to be created for some ppc machines

      Some ppc machines create a default usb controller based on a 'machine condition'.
      Until now the logic was: create the usb controller if:
       -  the usb option was supplied in cli and value is true or
       -  the usb option was absent and both set_defaults and the machine
          condition were true.

      Modified the logic to:
      Create the usb controller if:
       - the machine condition is true and defaults are enabled or
       - the usb option is supplied and true.

      The main for this is to simplify the usb_enabled method.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-2-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1666142db623365b2e7619f01c1cbb72d62b514
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 07:51:50 2014 +0200

      acpi-build: make ROMs RAM blocks resizeable

      Use resizeable ram API so we can painlessly extend ROMs in the
      future.  Note: migration is not affected, as we are
      not actually changing the used length for RAM, which
      is the part that's migrated.

      Use this in acpi: reserve x16 more RAM space.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 60786ef33928332ccef21f99503f56d781fade0c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 00:24:36 2014 +0200

      memory: API to allocate resizeable RAM MR

      Add API to allocate resizeable RAM MR.

      This looks just like regular RAM generally, but
      has a special property that only a portion of it
      (used_length) is actually used, and migrated.

      This used_length size can change across reboots.

      Follow up patches will change used_length for such blocks at migration,
      making it easier to extend devices using such RAM (notably ACPI,
      but in the future thinkably other ROMs) without breaking migration
      compatibility or wasting ROM (guest) memory.

      Device is notified on resize, so it can adjust if necessary.

      Note: nothing prevents making all RAM resizeable in this way.
      However, reviewers felt that only enabling this selectively will
      make some class of errors easier to detect.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b0cc3f839751bd83bdfcc480097c981c7aa1f3ec
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 17:55:43 2014 +0200

      arch_init: support resizing on incoming migration

      If block used_length does not match, try to resize it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62be4e3a5041e84304aa23637da623a205c53ecc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 14:27:41 2014 +0200

      exec: qemu_ram_alloc_resizeable, qemu_ram_resize

      Add API to allocate "resizeable" RAM.
      This looks just like regular RAM generally, but
      has a special property that only a portion of it
      (used_length) is actually used, and migrated.

      This used_length size can change across reboots.

      Follow up patches will change used_length for such blocks at migration,
      making it easier to extend devices using such RAM (notably ACPI,
      but in the future thinkably other ROMs) without breaking migration
      compatibility or wasting ROM (guest) memory.

      Device is notified on resize, so it can adjust if necessary.

      qemu_ram_alloc_resizeable allocates this memory, qemu_ram_resize resizes
      it.

      Note: nothing prevents making all RAM resizeable in this way.
      However, reviewers felt that only enabling this selectively will
      make some class of errors easier to detect.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9b8424d5735278ca382f11adc7c63072b632ab83
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Dec 15 22:55:32 2014 +0200

      exec: split length -> used_length/max_length

      This patch allows us to distinguish between two
      length values for each block:
          max_length - length of memory block that was allocated
          used_length - length of block used by QEMU/guest

      Currently, we set used_length - max_length, unconditionally.
      Follow-up patches allow used_length <= max_length.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c8d6f66ae7d0ce5f3622c19e29a2333d28dc1e9a
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 17:54:07 2014 +0200

      exec: cpu_physical_memory_set/clear_dirty_range

      Make cpu_physical_memory_set/clear_dirty_range
      behave symmetrically.

      To clear range for a given client type only, add
      cpu_physical_memory_clear_dirty_range_type.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e7af4c67300b3f9382e96f7a6741a5992116b2d2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Dec 16 11:21:23 2014 +0200

      memory: add memory_region_set_size

      Add API to change MR size.
      Will be used internally for RAM resize.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 75c74ccbe1d4175edb79c6f810c2207dcf5edb22
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:17 2015 +0200

      hw/ppc/mac_newworld: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4ee9ced979e68522ee38ea759e7630ac70f15fa8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:16 2015 +0200

      hw/ppc/spapr: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b8cbc738de38f2a669de9920fc0b0ee14c1d2dd8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:15 2015 +0200

      hw/ppc/mac_newworld: QOMified mac99 machines

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 09f28e5b51e0fb822021efd8396057c818927775
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:14 2015 +0200

      hw/usb: simplified usb_enabled

      The argument is not longer used and the implementation
      uses now QOM instead of QemuOpts.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 759bf45d81a892c359fa1a3848c36dcd74b6a42b
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:13 2015 +0200

      hw/machine: added machine_usb wrapper

      Following QOM convention, object properties should
      not be accessed directly.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c760dbb9dc4dfceeb5d4ae07876b10da58d4c630
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:12 2015 +0200

      hw/ppc: modified the condition for usb controllers to be created for some ppc machines

      Some ppc machines create a default usb controller based on a 'machine condition'.
      Until now the logic was: create the usb controller if:
       -  the usb option was supplied in cli and value is true or
       -  the usb option was absent and both set_defaults and the machine
          condition were true.

      Modified the logic to:
      Create the usb controller if:
       - the machine condition is true and defaults are enabled or
       - the usb option is supplied and true.

      The main for this is to simplify the usb_enabled method.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2f285bdd54bb2ff25a213b3b77e9bf46f4306320
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:22:16 2014 +0000

      target-ppc: Cast ssize_t to size_t before printing with %zx

      The mingw32 compiler complains about trying to print variables of type
      ssize_t with the %z format string specifier. Since we're printing it
      as unsigned hex anyway, cast to size_t to silence the warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 466976d9eed8d618aed93cb1fac04845e86253cf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:22:15 2014 +0000

      target-ppc: Mark SR() and gen_sync_exception() as !CONFIG_USER_ONLY

      The functions SR() and gen_sync_exception() are only used in softmmu
      configs; wrap them in #ifndef CONFIG_USER_ONLY to suppress clang warnings
      on the linux-user builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 82e345f57e6482cef960677613125c5aaf2b1654
  Author: Amit Tomar <Amit.Tomar@freescale.com>
  Date:   Fri Dec 19 14:20:37 2014 +0000

      PPC: e500: Fix GPIO controller interrupt number

      The GPIO controller lives at IRQ 47, not 43 on real hardware. This is a problem
      because IRQ 43 is occupied by the I2C controller which we want to implement
      next, so we'd have a conflict on that IRQ number.

      Move the GPIO controller to IRQ 47 where it belongs.

      Signed-off-by: Amit Singh Tomar <amit.tomar@freescale.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f83c2378bb412b205e9d14dca2f7758d3d23cc88
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:37 2014 -0600

      target-ppc: Introduce Privileged TM Noops

      Add the supervisory Transactional Memory instructions treclaim. and
      trechkpt.  The implementation is a degenerate one that simply
      checks privileged state, TM availability and then sets CR[0] to
      0b0000, just like the unprivileged noops.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aeedd58234e7f211bcd6d0ad04cdc60c2a967aca
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:36 2014 -0600

      target-ppc: Introduce tcheck

      Add a degenerate implementation of the Transaction Check (tcheck)
      instruction.  Since transaction always immediately fail, this
      implementation simply sets CR[BF] to 0b1000, i.e. TDOOMED = 1
      and MSR[TS] == 0.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 56a846157edaba3389eb141e104774451d82ce51
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:35 2014 -0600

      target-ppc: Introduce TM Noops

      Add degenerate implementations of the non-privileged Transactional
      Memory instructions tend., tabort*. and tsr.  This implementation
      simply checks the MSR[TM] bit and then sets CR0 to 0b0000.  This
      is a reasonable degenerate implementation since transactions are
      never allowed to begin and hence MSR[TS] is always 0b00.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0ff93d11bc0890b2569f748266c04f4417ec3233
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:34 2014 -0600

      target-ppc: Introduce tbegin

      Provide a degenerate implementation of the tbegin instruction.  This
      implementation always fails the transaction, recording the failure
      per Book II Section 5.3.2 of the Power ISA V2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aac862379ceaa724aba2ba9f4b825479c1401b1a
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:33 2014 -0600

      target-ppc: Introduce TEXASRU Bit Fields

      Define mnemonics for the various bit fields in the Transaction
      EXception And Summary Register (TEXASR).
      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e28c5e363aaf3de8b99acb662b7488ed6b49197
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:32 2014 -0600

      target-ppc: Power8 Supports Transactional Memory

      The Power8 processor implements the Transactional Memory Facility
      as defined in Power ISA 2.07.  Update the initialization code to
      indicate this.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 69d1a9377453d78ba2279fa56ae9623b3cd98673
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:31 2014 -0600

      target-ppc: Introduce tm_enabled Bit to CPU State

      Add a bit (tm_enabled) to CPU state that mirrors the MSR[TM] bit.
      This is analogous to the other "available" bits in the MSR (FP,
      VSX, etc.).

      NOTE: Since MSR[TM] occupies big-endian bit 31, the code is wrapped
      with a PPC64 bit check.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e43668a7d20e5d2dfe92b2f3426280b2a351333c
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:30 2014 -0600

      target-ppc: Introduce Feature Flag for Transactional Memory

      Add a flag (POWERPC_FLAG_TM) for the Transactional Memory
      Facility introduced in Power ISA 2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f90468b6465f64d4f5cf24ad81142c51f37320cf
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:29 2014 -0600

      target-ppc: Introduce Instruction Type for Transactional Memory

      Add a category (PPC2_TM) for the Transactional Memory instructions
      introduced in Power ISA 2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 549cfe5d5d315babec92d4e7043bb872f61c838a
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Tue Dec 2 15:32:46 2014 +1100

      pseries: Update SLOF firmware image to 20141202

      The changelog is:
        > version: update to 20141202
        > ipv4: Fix send packet across a subnet
        > pci: scan only type 0 and type 1
        > usb-xhci: support xhci extended capabilities
        > Fix term-io-key to also work when stdin has not been set yet
        > net-snk: llfw startup is using the wrong offset to handler
        > net-snk: Make call_client_interface() a bit more ABI compliant
        > net-snk: Remove custom printf version
        > net-snk: Sanitize our .lds file
        > net-snk: Avoid type clash for stdin & stdout
        > net-snk: use socket descriptor in the network stack
        > net-snk: Remove printk() in favor of printf()
        > net-snk: Remove redundant prototypes
        > net-snk: Remove unused timer functions
        > net-snk: Remove some unused PCI functions
        > net-snk: Remove module system
        > net-snk: Remove insmod/rmmod
        > net-snk: Remove snk_kernel_interface and related definitions
        > net-snk: Remove pci/vio_config gunk
        > js2x: Fix build
        > net-snk: Remoe some now unused "kernel" functions
        > rtas: Improve error handling in instantiate-rtas
        > version: update to 20140827
        > Add private HCALL to inform updated RTAS base and entry
        > xhci: fix port assignment

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5f9490de566c5b092a6cfedc3c7a37a9c9dee917
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Dec 8 13:48:02 2014 +1100

      PPC: Fix crash on spapr_tce_table_finalize()

      spapr_tce_table_finalize() can SEGV if the object was not previously
      realized.  In particular this can be triggered by running
               qemu-system-ppc -device spapr-tce-table,?

      The basic problem is that we have mismatched initialization versus
      finalization: spapr_tce_table_finalize() is attempting to undo things that
      are done in spapr_tce_table_realize(), not an instance_init function.

      Therefore, replace spapr_tce_table_finalize() with
      spapr_tce_table_unrealize().

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 77bad151fbd2b2eed1e959ecc2c3f2ee2f080f6c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 15:01:01 2014 +0100

      ppc: do not use get_clock_realtime()

      Use the external qemu-timer API instead.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2bf9febc95e5bcef8edb10ebc967325917b9c958
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Thu Dec 11 18:45:05 2014 +0300

      device-tree: fix memory leak

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e6b8fd246c19701b05f5b65a56b0cc91bbd05ac6
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:30 2014 +1100

      spapr: Fix stale HTAB during live migration (TCG)

      If a TCG guest reboots during a running migration HTAB entries are not
      marked dirty, and the destination boots with an invalid HTAB.

      When a reboot occurs, explicitly mark the current HTAB dirty after
      clearing it.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 338c25b6929b5436a42aaa106c7e9136cf1ff4dc
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:29 2014 +1100

      spapr: Fix integer overflow during migration (TCG)

      The n_valid and n_invalid fields are unsigned short integers but it is
      possible to have more than 65535 entries in a contiguous hunk, overflowing
      the field. This results in an incorrect HTAB being sent to the destination
      during migration.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 01a579729b2e614bd02b25c8504976eeecb64eff
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:28 2014 +1100

      spapr: Fix stale HTAB during live migration (KVM)

      If a guest reboots during a running migration, changes to the
      hash page table are not necessarily updated on the destination.
      Opening a new file descriptor to the HTAB forces the migration
      handler to resend the entire table.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e094c4c12f33a1c965f5af02f33968a337348739
  Author: Cédric Le Goater <clg@fr.ibm.com>
  Date:   Mon Nov 3 16:14:50 2014 +0100

      target-ppc: explicitly save page table headers in big endian

      Currently, when the page tables are saved, the kvm_get_htab_header structs
      and the ptes are assumed being big endian and dumped as a indistinct blob
      in the statefile. This is no longer true when the host is little endian
      and this breaks restoration.

      This patch unfolds the kvmppc_save_htab routine to write explicitly the
      kvm_get_htab_header structs in big endian. The ptes are left untouched.

      Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 58dd0a478784d4b732a695eb23bf88f4bbf33f5f
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:04 2014 -0600

      target-ppc: Eliminate set_fprf Argument From helper_compute_fprf

      The set_fprf argument to the helper_compute_fprf helper function
      is no longer necessary -- the helper is only invoked when FPSCR[FPRF]
      is going to be set.

      Eliminate the unnecessary argument from the function signature and
      its corresponding implementation.  Change the return value of the
      helper to "void".  Update the name of the local variable "ret" to
      "fprf", which now makes more sense.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7d45556effa4bf1557ba765b6b94390fb7d06615
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:03 2014 -0600

      target-ppc: Eliminate set_fprf Argument From gen_compute_fprf

      The set_fprf argument to the gen_compute_fprf() utility is no longer
      needed -- gen_compute_fprf() is now called only when FPRF is actually
      computed and set.  Eliminate the obsolete argument.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 00e6fd3e03b8df5553c6ea02bd95630549b0e2d1
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:02 2014 -0600

      target-ppc: Fully Migrate to gen_set_cr1_from_fpscr

      Eliminate the set_rc argument from the gen_compute_fprf utility and
      the corresponding (and incorrect) implementation.  Replace it with
      calls to the gen_set_cr1_from_fpscr() utility.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 14ba79c73a1c2db78becef171ec2f73606c1d7e1
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:01 2014 -0600

      target-ppc: mffs. Should Set CR1 from FPSCR Bits

      Update the Move From FPSCR (mffs.) instruction to correctly
      set CR[1] from FPSCR[FX,FEX,VX,OX].

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4814f2d116c057d6fdfd57f3b979c77d5668e878
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:00 2014 -0600

      target-ppc: Fix Floating Point Move Instructions That Set CR1

      The Floating Point Move instructions (fmr., fabs., fnabs., fneg.,
      and fcpsgn.) incorrectly copy FPSCR[FPCC] instead of [FX,FEX,VX,OX].
      Furthermore, the current code does this via a call to gen_compute_fprf,
      which is awkward since these instructions do not actually set FPRF.

      Change the code to use the gen_set_cr1_from_fpscr utility.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      [agraf: whitespace fixes]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b748863a7f7d2996255dd2cb5a20e49785cc7387
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:45:59 2014 -0600

      target-ppc: VXSQRT Should Not Be Set for NaNs

      The Power ISA square root instructions (fsqrt[s], frsqrte[s]) must
      set the FPSCR[VXSQRT] flag when operating on a negative value.
      However, NaNs have no sign and therefore this flag should not
      be set when operating on one.

      Change the order of the checks in the helper code.  Move the
      SNaN-to-QNaN macro to the top of the file so that it can be
      re-used.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2791128e2fa8b96d0b81622404655529b0b4fd4d
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Mon Nov 17 14:58:31 2014 -0600

      target-ppc: Load/Store Vector Element Storage Alignment

      The Load Vector Element Indexed and Store Vector Element Indexed
      instructions compute an effective address in the usual manner.
      However, they truncate that address to the natural boundary.
      For example, the lvewx instruction will ignore the least significant
      two bits of the address and thus load the aligned word of storage.

      Fix the generators for these instruction to properly perform this
      truncation.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cb3778a0455a2e5a48d7ef0ec8dc656313820389
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Nov 12 22:44:52 2014 +0100

      PPC: e500 pci host: Add support for ATMUs

      The e500 PCI controller has configurable windows that allow a guest OS
      to selectively map parts of the PCI bus space to CPU address space and
      to selectively map parts of the CPU address space for DMA requests into
      PCI visible address ranges.

      So far, we've simply assumed that this mapping is 1:1 and ignored it.

      However, the PCICSRBAR (CCSR mapped in PCI bus space) always has to live
      inside the first 32bits of address space. This means if we always treat
      all mappings as 1:1, this map will collide with our RAM map from the CPU's
      point of view.

      So this patch adds proper ATMU support which allows us to keep the PCICSRBAR
      below 32bits local to the PCI bus and have another, different window to PCI
      BARs at the upper end of address space. We leverage this on e500plat though,
      mpc8544ds stays virtually 1:1 like it was before, but now also goes via ATMU.

      With this patch, I can run guests with lots of RAM and not coincidently access
      MSI-X mappings while I really want to access RAM.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 44045ce9740945056a58ecb53d2af9ae00083632
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Nov 12 22:35:33 2014 +0100

      PPC: mpc8554ds: Tell user about exceeding RAM limits

      The mpc8544ds board only supports up to 3GB of RAM due to its limited
      address space.

      When the user requests more, abort and tell him that he should use less.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e6b4e5f4795b2591fd91bea671e3e22e08fd0e75
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Nov 7 17:07:03 2014 +0100

      PPC: e500: Move CCSR and MMIO space to upper end of address space

      On e500 we're basically guaranteed to have 36bits of physical address space
      available for our enjoyment. Older chips (like the mpc8544) only had 32bits,
      but everything from e500v2 onwards bumped it up.

      It's reasonably safe to assume that if you're using the PV machine, your guest
      kernel is configured to support 36bit physical address space. So in order to
      support more guest RAM, we can move CCSR and other MMIO windows right below the
      end of our 36bit address space, just like later SoC versions of e500 do.

      With this patch, I'm able to successfully spawn an e500 VM with -m 48G.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2eaaac1f01014bc7a3597847646a814539494fca
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Nov 7 16:50:44 2014 +0100

      PPC: e500: Move CCSR definition to params

      We want to have different MMIO region offsets for the mpc8544ds machine
      and our e500 PV machine, so move the definitions of those into the machine
      specific params struct.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ea259acae5b2d88ee6e92caf1cf44eb501eaef47
  Author: Paul Moore <pmoore@redhat.com>
  Date:   Wed Dec 17 15:50:09 2014 -0500

      seccomp: add mbind() to the syscall whitelist

      The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to
      set the policy for a memory range.  Add the syscall to the seccomp
      sandbox whitelist.

      Signed-off-by: Paul Moore <pmoore@redhat.com>
      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

  commit aa49668cc3cc680187e9e9b1d2eb8d64d72bff3e
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Fri Dec 19 17:13:38 2014 +0100

      seccomp: typo in configure error message

      Error message was misleading people to install wrong version of
      libseccomp.

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit a3a292c420d2fec3c07a7ca56fbb064cd57a298a
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Thu Dec 11 13:17:42 2014 +0530

      virtio-rng: fix check for period_ms validity

      This was reported for this warning:

      hw/virtio/virtio-rng.c:150:31: warning: logical not is only applied to
      the left hand side of comparison [-Wlogical-not-parentheses]

      Reported-by: dcb
      Suggested-by: dcb
      Bug: https://bugs.launchpad.net/qemu/+bug/1393486
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 08f432aa3eb62d6d781eaa085e161e8628a9a538
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Dec 19 14:57:27 2014 +1100

      virtio-serial: Don't keep a persistent copy of config space

      The 'config' field in the VirtIOSerial structure keeps a copy of the virtio
      console's config space as visible to the guest, that is to say, in guest
      endianness.  This is fiddly to maintain, because on some targets, such as
      powerpc, the "guest endianness" can change when a new guest OS boots.

      In fact, there's no need to maintain such a guest view of config space -
      instead we can reconstruct it from host-format data when it is accessed
      with get_config.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit f2f6e00b2e27b65edaa6ce5cb01770c973cbf8fb
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Dec 19 14:57:26 2014 +1100

      virtio_serial: Don't use vser->config.max_nr_ports internally

      A number of places in the virtio_serial driver retrieve the number of ports
      from vser->config.max_nr_ports, which is guest-endian.  But for internal
      users, we already have a host-endian copy of the number of ports in
      vser->serial.max_virtserial_ports.  Using that instead of the config field
      removes the need for easy-to-forget byteswapping.

      In particular this fixes a bug on incoming migration, where we don't adjust
      the endianness vser->config correctly, because it hasn't yet been loaded
      from the migration stream when virtio_serial_load_device() is called.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 5aa8136020f47fbd38c458b9834c783cb7063db8
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Mon Dec 29 21:14:02 2014 -0800

      pci: move REDHAT_SDHCI device ID to make room for Rocker

      The rocker device uses same PCI device ID as sdhci.  Since rocker device driver
      has already been accepted into Linux 3.18, and REDHAT_SDHCI device ID isn't
      used by any drivers, it's safe to move REDHAT_SDHCI device ID, avoiding
      conflict with rocker.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit debfb917a4f9c0784772c86f110f2bcd22e5a14f
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Dec 23 16:30:41 2014 +0100

      block/iscsi: fix uninitialized variable

      'ret' was never initialized in the success path.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d13c0404092eb46e548754a47a808da1bb8d4fd0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 08:55:19 2014 +0100

      pckbd: set bits 2-3-6-7 of the output port by default

      OSes typically write 0xdd/0xdf to turn the A20 line off and on.  This
      has bits 2-3-6-7 on, so that the output port subsection is migrated.
      Change the reset value and migration default to include those four
      bits, thus avoiding that the subsection is migrated.

      This strictly speaking changes guest ABI, but the long time during which
      we have not migrated the value means that the guests really do not care
      much; so the change is for all machine types.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bfa7362889d05d6951493d1c298289b39cf9bf86
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 08:51:57 2014 +0100

      serial: refine serial_thr_ipending_needed

      If the THR interrupt is disabled, there is no need to migrate thr_ipending
      because LSR.THRE will be sampled again when the interrupt is enabled.
      (This is the behavior that is not documented in the datasheet, but
      relied on by Windows!)

      Note that in this case IIR will never be 0x2 so, if thr_ipending were
      to be one, QEMU would produce the subsection.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd42d5b23691ad73edfd6dbcfc935a960a9c5a65
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:40:05 2014 +0300

      gen-icount: check cflags instead of use_icount global

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bd79255d2571a3c68820117caf94ea9afe1d527e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:59 2014 +0300

      translate: check cflags instead of use_icount global

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4eab7a0a2394275a611a19aef6619402ad524b63
  Author: Michael Walle <michael@walle.cc>
  Date:   Sun Nov 2 18:11:11 2014 +0100

      MAINTAINERS: add myself to lm32 and milkymist

      Add myself to lm32 and milkymist files.

      Signed-off-by: Michael Walle <michael@walle.cc>

  commit 857cccac0d9450d9be6af1ca3e5b7730b408b33c
  Author: Michael Walle <michael@walle.cc>
  Date:   Sat Oct 4 20:00:07 2014 +0200

      milkymist: softmmu: fix event handling

      Keys which send more than one scancode (esp. windows key) weren't handled
      correctly since commit 1ff5eedd. Two events were put into the input event
      queue but only one was processed. This fixes this by fetching all pending
      events in the callback handler.

      Signed-off-by: Michael Walle <michael@walle.cc>
      Cc: Gerd Hoffmann <kraxel@redhat.com>

  commit ab0302ee764fd702465aef6d88612cdff4302809
  Merge: 03de06d aa35106
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 15:05:22 2014 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141223' into staging

      target-arm queue:
       * enable 32-bit EL3 (TrustZone) for vexpress and virt boards
       * add fw_cfg device to virt board for UEFI firmware config
       * support passing commandline kernel/initrd to firmware

      # gpg: Signature made Tue 23 Dec 2014 13:50:33 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20141223: (31 commits)
        hw/arm/virt: enable passing of EFI-stubbed kernel to guest UEFI firmware
        hw/arm: pass pristine kernel image to guest firmware over fw_cfg
        hw/loader: split out load_image_gzipped_buffer()
        arm: add fw_cfg to "virt" board
        fw_cfg_mem: expose the "data_width" property with fw_cfg_init_mem_wide()
        fw_cfg_mem: introduce the "data_width" property
        exec: allows 8-byte accesses in subpage_ops
        fw_cfg_mem: flip ctl_mem_ops and data_mem_ops to DEVICE_BIG_ENDIAN
        fw_cfg_mem: max access size and region size are the same for data register
        fw_cfg: move boards to fw_cfg_init_io() / fw_cfg_init_mem()
        fw_cfg: hard separation between the MMIO and I/O port mappings
        target-arm: add cpu feature EL3 to CPUs with Security Extensions
        target-arm: Disable EL3 on unsupported machines
        target-arm: Breakout integratorcp and versatilepb cpu init
        target-arm: Set CPU has_el3 prop during virt init
        target-arm: Enable CPU has_el3 prop during VE init
        target-arm: Add arm_boot_info secure_boot control
        target-arm: Add ARMCPU secure property
        target-arm: Add feature unset function
        target-arm: Add virt machine secure property
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 03de06dde54df1f64bb099efe22edfa773b16e8e
  Merge: 7e58e2a dcbfc5c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 14:01:13 2014 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20141222.0' into staging

      VFIO updates:
      - Conversion to tracepoints (Eric Auger)
      - Fix memory listener address space (Frank Blaschka)
      - Move to hw/vfio/ and split common vs pci (Eric Auger & Kim Phillips)
      - Trivial error_report() fixes (Alex Williamson)

      In addition to enabling S390 with the address space fix and updating
      to use tracepoints rather than compile time debug, this set of patches
      moves hw/misc/vfio.c to hw/vfio/ and paves the way for vfio-platform
      support by splitting common functionality from PCI specific code.

      # gpg: Signature made Mon 22 Dec 2014 20:19:43 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20141222.0:
        vfio: Cleanup error_report()s
        hw/vfio: create common module
        hw/vfio/pci: use name field in format strings
        hw/vfio/pci: rename group_list into vfio_group_list
        hw/vfio/pci: split vfio_get_device
        hw/vfio/pci: Introduce VFIORegion
        hw/vfio/pci: handle reset at VFIODevice
        hw/vfio/pci: add type, name and group fields in VFIODevice
        hw/vfio/pci: introduce minimalist VFIODevice with fd
        hw/vfio/pci: generalize mask/unmask to any IRQ index
        hw/vfio/pci: Rename VFIODevice into VFIOPCIDevice
        vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio
        vfio: fix adding memory listener to the right address space
        vfio: migration to trace points

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0266359e57987d6be53fbcb885f2dd39c1dae940
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:53 2014 +0300

      cpu-exec: add a new CF_USE_ICOUNT cflag

      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 69b058c8818bdd4da48b3b9dd1a5d64490c7df17
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:48 2014 +0300

      target-ppc: pass DisasContext to SPR generator functions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2cbcfb281afa041a41f6e4c4da0f5c9314084604
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Nov 4 14:35:28 2014 +0100

      atomic: fix position of volatile qualifier

      What needs to be volatile is not the pointer, but the pointed-to
      value!

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit aa351061dbb0e3054db11c00a69395785c4186c8
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:45 2014 +0100

      hw/arm/virt: enable passing of EFI-stubbed kernel to guest UEFI firmware

      The virt board already ensures mutual exclusion between -bios and -pflash
      unit#0; we only need to set "bootinfo.firmware_loaded", introduced in the
      previous patch, if either of those options was used to load the guest
      firmware.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-12-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 07abe45c4814d42f3aca879d7932c5bc90d98bdf
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:44 2014 +0100

      hw/arm: pass pristine kernel image to guest firmware over fw_cfg

      Introduce the new boolean field "arm_boot_info.firmware_loaded". When this
      field is set, it means that the portion of guest DRAM that the VCPU
      normally starts to execute, or the pflash chip that the VCPU normally
      starts to execute, has been populated by board-specific code with
      full-fledged guest firmware code, before the board calls
      arm_load_kernel().

      Simultaneously, "arm_boot_info.firmware_loaded" guarantees that the board
      code has set up the global firmware config instance, for arm_load_kernel()
      to find with fw_cfg_find().

      Guest kernel (-kernel) and guest firmware (-bios, -pflash) has always been
      possible to specify independently on the command line. The following cases
      should be considered:

      nr  -bios    -pflash  -kernel  description
                   unit#0
      --  -------  -------  -------  -------------------------------------------
      1   present  present  absent   Board code rejects this case, -bios and
          present  present  present  -pflash unit#0 are exclusive. Left intact
                                     by this patch.

      2   absent   absent   present  Traditional kernel loading, with qemu's
                                     minimal board firmware. Left intact by this
                                     patch.

      3   absent   present  absent   Preexistent case for booting guest firmware
          present  absent   absent   loaded with -bios or -pflash. Left intact
                                     by this patch.

      4   absent   absent   absent   Preexistent case for not loading any
                                     firmware or kernel up-front. Left intact by
                                     this patch.

      5   present  absent   present  New case introduced by this patch: kernel
          absent   present  present  image is passed to externally loaded
                                     firmware in unmodified form, using fw_cfg.

      An easy way to see that this patch doesn't interfere with existing cases
      is to realize that "info->firmware_loaded" is constant zero at this point.
      Which makes the "outer" condition unchanged, and the "inner" condition
      (with the fw_cfg-related code) dead.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-11-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7d48a0f7217474899c5f5920b21f4cfdf4efa8d1
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:43 2014 +0100

      hw/loader: split out load_image_gzipped_buffer()

      In the next patch we'd like to reuse the image decompression facility
      without installing the output as a ROM at a specific guest-phys address.

      In addition, expose LOAD_IMAGE_MAX_GUNZIP_BYTES, because that's a
      straightforward "max_sz" argument for the new load_image_gzipped_buffer().

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-10-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 578f3c7b083514b4fec0bf8fa0617934cdbdf826
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:42 2014 +0100

      arm: add fw_cfg to "virt" board

      fw_cfg already supports exposure over MMIO (used in ppc/mac_newworld.c,
      ppc/mac_oldworld.c, sparc/sun4m.c); we can easily add it to the "virt"
      board.

      Because MMIO access is slow on ARM KVM, we enable the guest, with
      fw_cfg_init_mem_wide(), to transfer up to 8 bytes with a single access.
      This has been measured to speed up transfers up to 7.5-fold, relative to
      single byte data access, on both ARM KVM and x86_64 TCG.

      The MMIO register block of fw_cfg is advertized in the device tree. As
      base address we pick 0x09020000, which conforms to the comment preceding
      "a15memmap": it falls in the miscellaneous device I/O range 128MB..256MB,
      and it is aligned at 64KB. The DTB properties follow the documentation in
      the Linux source file "Documentation/devicetree/bindings/arm/fw-cfg.txt".

      fw_cfg automatically exports a number of files to the guest; for example,
      "bootorder" (see fw_cfg_machine_reset()).

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-9-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6c87e3d5967a1d731b5f591a8f0ee6c319c14ca8
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:41 2014 +0100

      fw_cfg_mem: expose the "data_width" property with fw_cfg_init_mem_wide()

      We rebase fw_cfg_init_mem() to the new function for compatibility with
      current callers.

      The behavior of the (big endian) multi-byte data reads is best shown
      with a qtest session.  Here, we are reading the first six bytes of
      the UUID

          $ arm-softmmu/qemu-system-arm -M virt -machine accel=qtest \
               -qtest stdio -uuid 4600cb32-38ec-4b2f-8acb-81c6ea54f2d8
      >>> writew 0x9020008 0x0200
      <<< OK
      >>> readl 0x9020000
      <<< OK 0x000000004600cb32

      Remember this is big endian.  On big endian machines, it is stored
      directly as 0x46 0x00 0xcb 0x32.

      On a little endian machine, we have to first swap it, so that it becomes
      0x32cb0046.  When written to memory, it becomes 0x46 0x00 0xcb 0x32
      again.

      Reading byte-by-byte works too, of course:

      >>> readb 0x9020000
      <<< OK 0x0000000000000038
      >>> readb 0x9020000
      <<< OK 0x00000000000000ec

      Here only a single byte is read at a time, so they are read in order
      similar to the 1-byte data port that is already in PPC and SPARC
      machines.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-8-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cfaadf0e89e7c2a47462d5f96390c9a9b4de037c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:40 2014 +0100

      fw_cfg_mem: introduce the "data_width" property

      The "data_width" property is capable of changing the maximum valid access
      size to the MMIO data register, and resizes the memory region similarly,
      at device realization time.

      The default value of "data_memwidth" is set so that we don't yet diverge
      from "fw_cfg_data_mem_ops".

      Most of the fw_cfg_mem users will stick with the default, and for them we
      should continue using the statically allocated "fw_cfg_data_mem_ops". This
      is beneficial for debugging because gdb can resolve pointers referencing
      static objects to the names of those objects.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff6cff7554be06e95f8d712f66cd16bd6681c746
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 13:11:39 2014 +0100

      exec: allows 8-byte accesses in subpage_ops

      Otherwise fw_cfg accesses are split into 4-byte ones before they reach the
      fw_cfg ops / handlers.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d789c84547abaaf82828b20998aee618b9327261
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:38 2014 +0100

      fw_cfg_mem: flip ctl_mem_ops and data_mem_ops to DEVICE_BIG_ENDIAN

      The standalone selector port (fw_cfg_ctl_mem_ops) is only used by big
      endian guests to date (*), hence this change doesn't regress them. Paolo
      and Alex have suggested / requested an explicit DEVICE_BIG_ENDIAN setting
      here, for clarity.

      (*) git grep -l fw_cfg_init_mem

          hw/nvram/fw_cfg.c
          hw/ppc/mac_newworld.c
          hw/ppc/mac_oldworld.c
          hw/sparc/sun4m.c
          include/hw/nvram/fw_cfg.h

      The standalone data port (fw_cfg_data_mem_ops) has max_access_size 1 (for
      now), hence changing its endianness doesn't change behavior for existing
      guest code.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86099db3823fec1800225f89544014a98b227ed9
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:37 2014 +0100

      fw_cfg_mem: max access size and region size are the same for data register

      Make it clear that the maximum access size to the MMIO data register
      determines the full size of the memory region.

      Currently the max access size is 1.

      This patch doesn't change behavior.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 66708822cd3007ae1ec5104d274a861148725e7a
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:36 2014 +0100

      fw_cfg: move boards to fw_cfg_init_io() / fw_cfg_init_mem()

      This allows us to drop the fw_cfg_init() shim and to enforce the possible
      mappings at compile time.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5712db6ae5101db645f71edc393368cd59bfd314
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:35 2014 +0100

      fw_cfg: hard separation between the MMIO and I/O port mappings

      We are going to introduce a wide data register for fw_cfg, but only for
      the MMIO mapped device. The wide data register will also require the
      tightening of endiannesses.

      However we don't want to touch the I/O port mapped fw_cfg device at all.

      Currently QEMU provides a single fw_cfg device type that can handle both
      I/O port and MMIO mapping. This flexibility is not actually exploited by
      any board in the tree, but it renders restricting the above changes to
      MMIO very hard.

      Therefore, let's derive two classes from TYPE_FW_CFG: TYPE_FW_CFG_IO and
      TYPE_FW_CFG_MEM.

      TYPE_FW_CFG_IO incorporates the base I/O port and the related combined
      MemoryRegion. (NB: all boards in the tree that use the I/O port mapped
      flavor opt for the combined mapping; that is, when the data port overlays
      the high address byte of the selector port. Therefore we can drop the
      capability to map those I/O ports separately.)

      TYPE_FW_CFG_MEM incorporates the base addresses for the MMIO selector and
      data registers, and their respective MemoryRegions.

      The "realize" and "props" class members are specific to each new derived
      class, and become unused for the base class. The base class retains the
      "reset" member and the "vmsd" member, because the reset functionality and
      the set of migrated data are not specific to the mapping.

      The new functions fw_cfg_init_io() and fw_cfg_init_mem() expose the
      possible mappings in separation. For now fw_cfg_init() is retained as a
      compatibility shim that enforces the above assumptions.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c0ccb02db46c72b4b0fa8a475a6890c1e28064f0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Mon Dec 15 17:09:52 2014 -0600

      target-arm: add cpu feature EL3 to CPUs with Security Extensions

      Set ARM_FEATURE_EL3 feature for CPUs that implement Security Extensions.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-16-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 61e2f3521c9ee2dc3ebab2e84329d5ebd10d8518
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:51 2014 -0600

      target-arm: Disable EL3 on unsupported machines

      Disables the CPU ARM_FEATURE_EL3 featuere on machine models that can be
      configured to use Cortex-A9, Cortex-A15, and ARM1176 but don't officially
      support EL3.  This preserves backwards compatibility.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-15-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 223a72f1179dc0b56bae3b01bc3e3208ef100fcc
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:50 2014 -0600

      target-arm: Breakout integratorcp and versatilepb cpu init

      This commit changes the integratorcp and versatilepb CPU initialization from
      using the generic ARM cpu_arm_init function to doing it inline.  This is
      necessary in order to allow CPU configuration changes to occur between CPU
      instance initialization and realization.  Specifically, this change is in
      preparation for disabling CPU EL3 support.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-14-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e5a5604f8fdabfc788fbf75354b7f92eb349dcff
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:49 2014 -0600

      target-arm: Set CPU has_el3 prop during virt init

      Adds setting of the CPU has_el3 property based on the virt machine
      secure state property during initialization.  This enables/disables EL3
      state during start-up.  Changes include adding an additional secure state
      boolean during virt CPU initialization.  Also disables the ARM secure boot
      by default.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418684992-8996-13-git-send-email-greg.bellows@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12d027f132246826c4358f3734d738a3385bf75f
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:48 2014 -0600

      target-arm: Enable CPU has_el3 prop during VE init

      Adds setting of the CPU has_el3 property based on the vexpress machine
      secure state property during initialization.  This enables/disables EL3
      state during start-up.  Changes include adding an additional secure state
      boolean during vexpress CPU initialization.  Also enables the ARM secure boot
      by default.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418684992-8996-12-git-send-email-greg.bellows@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8e829b7bf6e1c84af8b4b13ee7fce2959c63e0e
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:47 2014 -0600

      target-arm: Add arm_boot_info secure_boot control

      Adds the secure_boot boolean field to the arm_boot_info descriptor.  This
      fields is used to indicate whether Linux should boot into secure or non-secure
      state if the ARM EL3 feature is enabled.  The default is to leave the CPU in an
      unaltered reset state.  On EL3 enabled systems, the reset state is secure and
      can be overridden by setting the added field to false.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-11-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51942aee3c51ca23b0dd78f95534a57e8dc1e582
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:46 2014 -0600

      target-arm: Add ARMCPU secure property

      Added a "has_el3" state property to the ARMCPU descriptor.  This property
      indicates whether the ARMCPU has security extensions enabled (EL3) or not.
      By default it is disabled at this time.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-10-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08828484a5c1ec55a6cbb4b4d377bfcf41199b5c
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:45 2014 -0600

      target-arm: Add feature unset function

      Add an unset_feature() function to compliment the set_feature() function.  This
      will be used to disable functions after they have been enabled during
      initialization.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 083a58906cb32731dd98a93fcf451ec7718c0924
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:44 2014 -0600

      target-arm: Add virt machine secure property

      Add "secure" virt machine specific property to allow override of the
      default secure state configuration.  By default, when using the QEMU
      -kernel command line argument, virt machines boot into NS/SVC.  When using
      the QEMU -bios command line argument, virt machines boot into S/SVC.

      The secure state can be changed from the default specifying the secure
      state as a machine property.  For example, the below command line would disable
      security extensions on a -kernel Linux boot:

          aarch64-softmmu/qemu-system-aarch64
              -machine type=virt,secure=off
              -kernel ...

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c29196904b2bad015edc553a5693c5c9e6f8177a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:43 2014 -0600

      target-arm: Add virt class and machine types

      Switch virt qemu machine support to use the newer object type, class, and
      instance model.  Added virt TypeInfo with static registration along with virt
      specific class and machine structs.  Also added virt class initialization
      method.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-7-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e364bab69bd70825e7583e0bbc812fb67b63b366
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:42 2014 -0600

      target-arm: Change vexpress daughterboard init arg

      Change the Vexpress daughterboard initialization method to take a vexpress
      machine state pointer instead of the daughterboard struct pointer.  The machine
      state now contains the daughterboard pointer.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-6-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 490219243208a0fa8abb2290509f31654c888954
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:41 2014 -0600

      target-arm: Add vexpress machine secure property

      Add "secure" Vexpress machine specific property to allow override of the
      default secure state configuration.  By default, when using the QEMU
      -kernel command line argument, Vexpress machines boot into NS/SVC.  When using
      the QEMU -bios command line argument, Vexpress machines boot into S/SVC.

      The secure state can be changed from the default specifying the secure
      state as a machine property.  For example, the below command line would disable
      security extensions on a -kernel Linux boot:

          aarch64-softmmu/qemu-system-aarch64
              -machine type=vexpress-a15,secure=off
              -kernel ...

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit af7c9f34b1bacd329a479e79bd608580d0511596
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:40 2014 -0600

      target-arm: Switch to common vexpress machine init

      Switched the Vexpress machine initialization to use the common function with
      the machine pointer to board info.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9ee00ba8311a9cc59f8d1034c98b6f9f3694495b
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:39 2014 -0600

      target-arm: Add vexpress a9 & a15 machine objects

      Add Vexpress machine objects for the the Cortex A9 & A15 variants.  The older
      style QEMUMachine types were replaced with dedicated TypeInfo objects. The new
      objects include dedicated class init functions that currently ustilze dedicated
      machine init methods.  The previous qemu_register_machine calls were replaced
      with the newer type_register_status calls.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7eb1dc7f0b65a324323541440baf2ea544adcefb
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:38 2014 -0600

      target-arm: Add vexpress class and machine types

      Adds base Vexpress class and machine objects and infrastructure.  This is in
      preparation for switching to the full QEMU object model.  The base vexpress
      infrastructure is intended to handle common vexpress details.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 52eb3dfd7d6585f0049a6d41ddb81ef8d4496146
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:06 2014 +0000

      vl.c: add HMP help to machine

      The help is based on the actual machine properties
      exposing only the relevant options.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-4-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e16898a61a25cb76dd48f6e74f3b7a500d0c91a
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      vl.c: simplified machine_set_property

      Refactored the code to re-use object_property_parse.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-3-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 49d2e648e8087d154d8bf8b91f27c8e05e79d5a6
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      machine: remove qemu_machine_opts global list

      QEMU has support for options per machine, keeping
      a global list of options is no longer necessary.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-2-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 60fb1a87b47b14e4ea67043aa56f353e77fbd70a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      target-arm: Merge EL3 CP15 register lists

      Merge of the v8_el2_cp_reginfo and el3_cp_reginfo ARMCPRegInfo lists.
      Previously, some EL3 registers were restricted to the ARMv8 list under the
      impression that they were not needed on ARMv7.  However, this is not the case
      as the ARMv7/32-bit variants rely on the ARMv8/64-bit variants to handle
      migration and reset.  For this reason they must always exist.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418406450-14961-1-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b28fb27b5edf77f6fd0ac550a156fb20f2218db3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      audio: Don't free hw resources until after hw backend is stopped

      When stopping an audio voice, call the audio backend's fini
      method before calling audio_pcm_hw_free_resources_ rather than
      afterwards. This allows backends which use helper threads (like
      pulseaudio) to terminate those threads before the conv_buf or
      mix_buf are freed and avoids race conditions where the helper
      may access a NULL pointer or freed memory.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418406239-9838-1-git-send-email-peter.maydell@linaro.org

  commit dcbfc5cefb22e9219f8253dba87de33104ca73fe
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Mon Dec 22 10:37:27 2014 -0700

      vfio: Cleanup error_report()s

      With the conversion to tracepoints, a couple previous DPRINTKs are
      now quite a bit more visible and are really just informational.
      Remove these and add a bit more description to another.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit e2c7d025ada047a3f0225f89ff36626d1bd46e47
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:51 2014 -0700

      hw/vfio: create common module

      A new common module is created. It implements all functions
      that have no device specificity (PCI, Platform).

      This patch only consists in move (no functional changes)

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit df92ee444884ba66b5cc95e3ff3d5579f89ed4aa
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:49 2014 -0700

      hw/vfio/pci: use name field in format strings

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 62356b729281e7d6672193a98a072b1c7de04dd8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:46 2014 -0700

      hw/vfio/pci: rename group_list into vfio_group_list

      better fit in the rest of the namespace

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit d13dd2d7a957eacbb9e669c43dd9e19db969755b
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:38 2014 -0700

      hw/vfio/pci: split vfio_get_device

      vfio_get_device now takes a VFIODevice as argument. The function is split
      into 2 parts: vfio_get_device which is generic and vfio_populate_device
      which is bus specific.

      3 new fields are introduced in VFIODevice to store dev_info.

      vfio_put_base_device is created.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit a664477db8dac84cc046e9d79701eefda1d58703
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:37 2014 -0700

      hw/vfio/pci: Introduce VFIORegion

      This structure is going to be shared by VFIOPCIDevice and
      VFIOPlatformDevice. VFIOBAR includes it.

      vfio_eoi becomes an ops of VFIODevice specialized by parent device.
      This makes possible to transform vfio_bar_write/read into generic
      vfio_region_write/read that will be used by VFIOPlatformDevice too.

      vfio_mmap_bar becomes vfio_map_region

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit b47d8efa9f430c332bf96ce6eede169eb48422ad
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:35 2014 -0700

      hw/vfio/pci: handle reset at VFIODevice

      Since we can potentially have both PCI and platform devices in
      the same VFIO group, this latter now owns a list of VFIODevices.
      A unified reset handler, vfio_reset_handler, is registered, looping
      through this VFIODevice list. 2 specialized operations are introduced
      (vfio_compute_needs_reset and vfio_hot_reset_multi): they allow to
      implement type specific behavior. also reset_works and needs_reset
      VFIOPCIDevice fields are moved into VFIODevice.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 462037c9e85b27149e71d7f5c7f41375ca6e47d5
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:31 2014 -0700

      hw/vfio/pci: add type, name and group fields in VFIODevice

      Add 3 new fields in the VFIODevice struct. Type is set to
      VFIO_DEVICE_TYPE_PCI. The type enum value will later be used
      to discriminate between VFIO PCI and platform devices. The name is
      set to domain:bus:slot:function. Currently used to test whether
      the device already is attached to the group. Later on, the name
      will be used to simplify all traces. The group is simply moved
      from VFIOPCIDevice to VFIODevice.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      [Fix g_strdup_printf() usage]
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 7e58e2ac7778cca3234c33387e49577bb7732714
  Merge: 7db96d6 ddcd553
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 14:52:52 2014 +0000

      Merge remote-tracking branch 'remotes/gonglei/tags/bootdevice-next-20141222' into staging

      bootdevice: Refactor and improvement

      # gpg: Signature made Mon 22 Dec 2014 06:44:08 GMT using RSA key ID DDE30FBB
      # gpg: Can't check signature: public key not found

      * remotes/gonglei/tags/bootdevice-next-20141222:
        bootdevice: add Error **errp argument for QEMUBootSetHandler
        bootdevice: add validate check for qemu_boot_set()
        bootdevice: add Error **errp argument for qemu_boot_set()
        bootdevice: add Error **errp argument for validate_bootdevices()
        bootdevice: move code about bootorder from vl.c to bootdevice.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7db96d6cf877d4bb8132462ec7dd19055ff968eb
  Merge: c95f390 9655b93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 13:15:52 2014 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20141221' into staging

      TriCore RR, RR1 insn added and several bug fixes

      # gpg: Signature made Sun 21 Dec 2014 18:39:11 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20141221:
        target-tricore: Add instructions of RR1 opcode format, that have 0xb3 as first opcode
        target-tricore: Fix MFCR/MTCR insn and B format offset.
        target-tricore: Add missing 1.6 insn of BOL opcode format
        target-tricore: Add instructions of RR opcode format, that have 0x4b as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0x1 as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0xf as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0xb as the first opcode
        target-tricore: Change SSOV/SUOV makro name to SSOV32/SUOV32
        target-tricore: Fix mask handling JNZ.T being 7 bit long
        target-tricore: pretty-print register dump and show more status registers
        target-tricore: add missing 64-bit MOV in RLC format
        target-tricore: typo in BOL format
        target-tricore: fix offset masking in BOL format

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ddcd55316fb2851e144e719171621ad2816487dc
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 19:04:02 2014 +0000

      bootdevice: add Error **errp argument for QEMUBootSetHandler

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.
      For x86 architecture, we pass &local_err to set_boot_dev()
      when vm startup in pc_coms_init().

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 3b08098b409c0fb28f85436ba1adeb1d401ec8f7
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 18:25:46 2014 +0000

      bootdevice: add validate check for qemu_boot_set()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit f1839938b090b28537d9be2c1b255b834f3cfbb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 18:20:58 2014 +0000

      bootdevice: add Error **errp argument for qemu_boot_set()

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 703008e81a6ace40f227aae16d630014e5016af1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 17:11:39 2014 +0000

      bootdevice: add Error **errp argument for validate_bootdevices()

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 9816833d3b8ec9adfb63b6a53f1b56f5304f4c40
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 16:49:46 2014 +0000

      bootdevice: move code about bootorder from vl.c to bootdevice.c

      First, we can downsize vl.c, make it simpler by
      little and little. Second, I can maintain those code
      and make some improvement.

      Cc: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit c95f3901b4ead79f3fe2c641fda7d2c70fc84c72
  Merge: 328b3b6 d3f3a0f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Dec 21 23:17:00 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20141219-1' into staging

      sdl2: fixes, cleanups and opengl preparation.

      # gpg: Signature made Fri 19 Dec 2014 09:06:07 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20141219-1:
        sdl2: Work around SDL2 SDL_ShowWindow() bug
        sdl2: Use correct sdl2_console for window events
        sdl2: move sdl2_2d_refresh to sdl2-2d.c
        sdl2: factor out sdl2_poll_events
        sdl2: add+use sdl2_2d_redraw function.
        sdl2: move sdl_switch to sdl2-2d.c
        sdl2: overhaul window size handling
        sdl2: move sdl_update to new sdl2-2d.c
        sdl2: turn on keyboard grabs
        sdl2: move keyboard input code to new sdl2-input.c
        sdl2: rename sdl2_state to sdl2_console, move to header file
        sdl: move version logic from source code to makefile

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9655b9328a566116c198c52792775a0641d56915
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Dec 12 16:55:34 2014 +0000

      target-tricore: Add instructions of RR1 opcode format, that have 0xb3 as first opcode

      Add instructions of RR1 opcode format, that have 0xb3 as first opcode.
      Add helper functions mulh, mulmh and mulrh, that compute multiplication,
      with multiprecision (mulmh) or rounding (mulrh) of 4 halfwords, being either low or high parts
      of two 32 bit regs.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 436d63ff3e3f87cda3e8df35827a40093cc17430
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Dec 3 17:40:21 2014 +0000

      target-tricore: Fix MFCR/MTCR insn and B format offset.

      Fix gen_mtcr using wrong register.
      Fix gen_mtcr/mfcr using sign extended offsets.
      Fix B format insn using not sign extendend offsets.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit b5fd8fa34594da327e2965a8c3b5dddf21f862ff
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Dec 5 14:37:17 2014 +0000

      target-tricore: Add missing 1.6 insn of BOL opcode format

      Some of the 1.6 ISA instructions were still missing. So let's add them.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e2bed107c6d1dbde564029ac2bca450cdb3f596e
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 2 17:22:27 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0x4b as the first opcode

      Add instructions of RR opcode format, that have 0x4b as the first opcode.
      Add helper functions:
          * parity: Calculates the parity bits for every byte of a 32 int.
          * bmerge/bsplit: Merges two regs into one bitwise/Splits one reg into two bitwise.
          * unpack: unpack a IEEE 754 single precision floating point number as exponent and mantissa.
          * dvinit_b_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                             where the quotient result is guaranteed to fit into 8 bit.
          * dvinit_h_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                             where the quotient result is guaranteed to fit into 16 bit.
      OPCM_32_RR_FLOAT -> OPCM_32_RR_DIVIDE.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f2f1585f60df656dc1755727cc66a0c3c8dd627d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 2 17:15:09 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0x1 as the first opcode

      Add instructions of RR opcode format, that have 0x1 as the first opcode.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0b79a78169d813d11ad32f103e7a2c64c32bd705
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Nov 28 17:07:26 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0xf as the first opcode

      Add instructions of RR opcode format, that have 0xf as the first opcode.
      Add helper functions:
          * clo/z/s: Counts leading ones/zeros/signs.
          * clo/z/s_h: Count leading ones/zeros/signs in two haflwords.
          * sh/_h: Shifts one/two word/hwords.
          * sha/_h: Shifts one/two word/hwords arithmeticly.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit d5de7839d78b08c7bd14b03dac0413699b90da67
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 27 14:30:33 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0xb as the first opcode

      Add instructions of RR opcode format, that have 0xb as the first opcode.
      Add helper functions, for hword and byte arithmetics:
          * add_h_ssov/suov: Add two halfword and saturate on overflow.
          * sub_h_ssov/suov: Sub two halfword and saturate on overflow.
          * absdif_h_ssov: Compute absolute difference for halfwords and saturate on overflow.
          * abs_h_ssov/suov: Compute absolute value for two halfwords and saturate on overflow.
          * abs_b/h: Compute absolute value for four/two bytes/halfwords
          * absdif_b/h: Compute absolute difference for four/two bytes/halfwords
          * add_b/h: Add four/two bytes/halfwords.
          * sub_b/h: Sub four/two bytes/halfwords.
          * eq_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on
                    equality and set all bits of to either one ore zero.
          * eqany_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on equality.
          * lt_b/bu/h/hu: Compare four/two bytes/halfwords with four/two bytes/halfwords
                          on less than signed and unsigned.
          * max_b/bu/h/hu: Calculate max for four/two bytes/halfwords signed and unsigned.
          * min_b/bu/h/hu: Calculate min for four/two bytes/halfwords signed and unsigned.
      Add helper function abs_ssov, that computes the absolute value for a 32 bit integer and saturates on overflow.
      Add microcode generator functions:
          * gen_sub_CC: Caluclates sub and sets the carry bit.
          * gen_subc_CC: Caluclates sub and carry and sets the carry bit
          * gen_abs: Compute absolute value for a 32 bit integer.
          * gen_cond_w: Compares two 32 bit values on cond and sets result either zero or all bits one.

      OPC2_32_RR_MIN switched with OPC2_32_RR_MIN_U.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e4e39176305adff59b05a02a072ae1369d0a2274
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 27 13:45:09 2014 +0000

      target-tricore: Change SSOV/SUOV makro name to SSOV32/SUOV32

      Those makros are exclusively used for 32 bit arithmetics and won't work for
      16 bit with two halfwords. So lets get rid of the len parameter and make them
      always use 32 bit. Now no token pasting is needed anymore and they can be
      regular functions.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 7f13420ec000ad7644b65ea1a32b5674ad0cd204
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Dec 15 21:36:31 2014 +0000

      target-tricore: Fix mask handling JNZ.T being 7 bit long

      The mask is actually 7 bit long, instead of 6, so the expression checking
      for JNZ.T is always false. Let's make the mask 1 bit wider.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 45820fccaf731a2fec5d0cb5416f944104e89373
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 19 12:34:34 2014 +0100

      target-tricore: pretty-print register dump and show more status registers

      Now using psw_read() to retrieve the status bits correctly.

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4b5b44357651b7563790e246be64bc55f4d90d47
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:29 2014 +0100

      target-tricore: add missing 64-bit MOV in RLC format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit af715d980271a1c8ea9596bf9147b5421a49e01a
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:28 2014 +0100

      target-tricore: typo in BOL format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 781b717c5049f42d45d31fd47617f3129c07541c
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:27 2014 +0100

      target-tricore: fix offset masking in BOL format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 328b3b6c44c17d94df115ed1851f54a0bd59a471
  Merge: c4e7c17 20302e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Dec 20 22:04:13 2014 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri 19 Dec 2014 13:18:18 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        e1000: defer packets until BM enabled
        net: Use g_new() & friends where that makes obvious sense
        net: Fuse g_malloc(); memset() into g_new0()
        net: don't use set/get_pointer() in set/get_netdev()
        tap: fix vcpu long time io blocking on tap

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4e7c17a8ecb41cdbb81374a128161c614ba1f1e
  Merge: adee642 c246cee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Dec 20 21:28:53 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-roms-20141217-1' into staging

      update ipxe from 69313ed to 35c5379

      # gpg: Signature made Wed 17 Dec 2014 14:45:04 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-roms-20141217-1:
        update ipxe from 69313ed to 35c5379

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adee64249ee37e822d578e65a765750e7f2081f6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 19 12:53:14 2014 +0100

      exec: change default exception_index value for migration to -1

      In QEMU 2.2 the exception_index value was added to the migration stream
      through a subsection.  The default was set to 0, which is wrong and
      should have been -1.

      However, 2.2 does not have commit e511b4d (cpu-exec: reset exception_index
      correctly, 2014-11-26), hence in 2.2 the exception_index is never used
      and is set to -1 on the next call to cpu_exec.  So we can change the
      migration stream to make the default -1.  The effects are:

      - 2.2.1 -> 2.2.0: cpu->exception_index set incorrectly to 0 if it
      were -1 on the source; then reset to -1 in cpu_exec.  This is TCG
      only; KVM does not use exception_index.

      - 2.2.0 -> 2.2.1: cpu->exception_index set incorrectly to -1 if it
      were 0 on the source; but it would be reset to -1 in cpu_exec anyway.
      This is TCG only; KVM does not use exception_index.

      - 2.2.1 -> 2.1: two bugs fixed: 1) can migrate backwards if
      cpu->exception_index is set to -1; 2) should not migrate backwards
      (but 2.2.0 allows it) if cpu->exception_index is set to 0

      - 2.2.0 -> 2.3.0: 2.2.0 will send the subsection unnecessarily if
      exception_index is -1, but that is not a problem.  2.3.0 will set
      cpu->exception_index to -1 if it is 0 on the source, but this would
      be anyway a problem for 2.2.0 -> 2.2.x migration (due to lack of
      commit e511b4d in 2.2.x) so we can ignore it

      - 2.2.1 -> 2.3.0: everything works.

      In addition, play it safe and never send the subsection unless TCG
      is in use.  KVM does not use exception_index (PPC KVM stores values
      in it for use in the subsequent call to ppc_cpu_do_interrupt, but
      does not need it as soon as kvm_handle_debug returns).  Xen and
      qtest do not run any code for the CPU at all.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1418989994-17244-3-git-send-email-pbonzini@redhat.com
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9d8f6673591f30028e281e8ff6d5790adc2de83
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 19 12:53:13 2014 +0100

      cpu: initialize cpu->exception_index on reset

      This unbreaks linux-user (broken by e511b4d, cpu-exec: reset exception_index
      correctly, 2014-11-26).

      Reported-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-id: 1418989994-17244-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5546a621a8801351601537b311539486b9b3ee79
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:31 2014 -0700

      hw/vfio/pci: introduce minimalist VFIODevice with fd

      Introduce a new base VFIODevice strcut that will be used by both PCI
      and Platform VFIO device. Move VFIOPCIDevice fd field there. Obviously
      other fields from VFIOPCIDevice will be moved there but this patch
      file is introduced to ease the review.

      Also vfio_mask_single_irqindex, vfio_unmask_single_irqindex,
      vfio_disable_irqindex now take a VFIODevice handle as argument.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 079eb19cbb3079536788dfd58832824804815e48
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:24 2014 -0700

      hw/vfio/pci: generalize mask/unmask to any IRQ index

      To prepare for platform device introduction, rename vfio_mask_intx
      and vfio_unmask_intx into vfio_mask_single_irqindex and respectively
      unmask_single_irqindex. Also use a nex index parameter.

      With that name and prototype the function will be usable for other
      indexes than VFIO_PCI_INTX_IRQ_INDEX.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 9ee27d7381c2d540ee976c7cbae941c66bb66e70
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:15 2014 -0700

      hw/vfio/pci: Rename VFIODevice into VFIOPCIDevice

      This prepares for the introduction of VFIOPlatformDevice

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit cf7087db10e2dc112e02782f1d1eb56ec42c728b
  Author: Kim Phillips <kim.phillips@linaro.org>
  Date:   Fri Dec 19 15:24:06 2014 -0700

      vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio

      This is done in preparation for the addition of VFIO platform
      device support.

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit c67676711c7202f48bc43d2f80125eaea355755e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Fri Dec 19 14:40:06 2014 -0700

      vfio: fix adding memory listener to the right address space

      Depending on the device, container->space->as contains the valid AddressSpace.
      Using address_space_memory breaks devices sitting behind an iommu (and using
      a separate address space).

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 385f57cf9ad7566aa4fc125370f14902ea62aae5
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 14:40:06 2014 -0700

      vfio: migration to trace points

      This patch removes all DPRINTF and replace them by trace points.
      A few DPRINTF used in error cases were transformed into error_report.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 20302e71a5b654d7b4d0d61c7384e9dd8d112971
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Dec 1 20:06:52 2014 +0200

      e1000: defer packets until BM enabled

      Some guests seem to set BM for e1000 after
      enabling RX.
      If packets arrive in the window, device is wedged.
      Probably works by luck on real hardware, work around
      this by making can_receive depend on BM.

      Tested-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 58889fe50a7c5b8776cf3096a8fe611fb66c4e5c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:28:17 2014 +0100

      net: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 71e28e3cc24ff3b0268903758aae357592eb8b74
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:28:16 2014 +0100

      net: Fuse g_malloc(); memset() into g_new0()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 23120b13c6e316df44aeb63420121a1cf6dc49dc
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Oct 13 13:16:37 2014 +0800

      net: don't use set/get_pointer() in set/get_netdev()

      Commit 1ceef9f27359cbe92ef124bf74de6f792e71f6fb (net: multiqueue
      support) tries to use set_pointer() and get_pointer() to set and get
      NICPeers which is not a pointer defined in DEFINE_PROP_NETDEV. This
      trick works but result a unclean and fragile implementation (e.g
      print_netdev and parse_netdev).

      This patch solves this issue by not using set/get_pinter() and set and
      get netdev directly in set_netdev() and get_netdev(). After this the
      parse_netdev() and print_netdev() were no longer used and dropped from
      the source.

      [Renamed 'err' label to 'out' as suggested by Markus Armbruster.
      --Stefan]

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 756ae78b275a0625b4559a8fc448df4c6eb331a8
  Author: Wangkai (Kevin,C) <wangkai86@huawei.com>
  Date:   Fri Jul 18 09:33:42 2014 +0000

      tap: fix vcpu long time io blocking on tap

      [Adjusted doc comment for grammar.
      --Stefan]

      Signed-off-by: Wangkai <wangkai86@huawei.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b574f602680d41c4cf4a9c106e3e2244bed01cdd
  Merge: 86b182a 46817e8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 19:22:41 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20141216-1' into staging

      cirrus hwcursor fixes.
      set secondary-vga category.

      # gpg: Signature made Tue 16 Dec 2014 14:44:09 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20141216-1:
        vga: set catagory bit for secondary vga device
        move hw cursor pos from cirrus to vga
        cirrus: Force use of shadow pixmap when HW cursor is enabled
        vga: Add mechanism to force the use of a shadow surface

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86b182ac0e0b44726d85598cbefb468ed22517fc
  Merge: 84afc4d 97e89ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 17:31:26 2014 +0000

      Merge remote-tracking branch 'remotes/xtensa/tags/20141217-xtensa' into staging

      Xtensa updates for 2.3:

      - fix cross-page opcode handling;
      - move window overflow exception generation decision to translation phase;
      - don't generate dead code after privilege, window overflow or coprocessor
        exception;
      - add monitor command 'info opcount' for dumping TCG opcode counters.

      # gpg: Signature made Wed 17 Dec 2014 02:57:01 GMT using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20141217-xtensa:
        target-xtensa: don't generate dead code
        target-xtensa: record available window in TB flags
        target-xtensa: test cross-page opcode
        target-xtensa: fix translation for opcodes crossing page boundary
        tcg: add separate monitor command to dump opcode counters

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 84afc4dd56648ac302c7b5a917e95ca7b1239695
  Merge: 339aaf5 d4fa535
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 16:25:21 2014 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20141216' into staging

      * remotes/lalrae/tags/mips-20141216: (30 commits)
        target-mips: remove excp_names[] from linux-user as it is unused
        disas/mips: disable unused mips16_to_32_reg_map[]
        disas/mips: remove unused mips_msa_control_names_numeric[32]
        target-mips: convert single case switch into if statement
        target-mips: Fix DisasContext's ulri member initialization
        target-mips: Use local float status pointer across MSA macros
        target-mips: Add missing calls to synchronise SoftFloat status
        linux-user: Use the 5KEf processor for 64-bit emulation
        target-mips: Also apply the CP0.Status mask to MTTC0
        target-mips: gdbstub: Clean up FPU register handling
        target-mips: Correct 32-bit address space wrapping
        target-mips: Tighten ISA level checks
        target-mips: Fix CP0.Config3.ISAOnExc write accesses
        target-mips: Output CP0.Config2-5 in the register dump
        target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP
        target-mips: Correct the writes to Status and Cause registers via gdbstub
        target-mips: Correct the handling of writes to CP0.Status for MIPSr6
        target-mips: Correct MIPS16/microMIPS branch size calculation
        target-mips: Restore the order of helpers
        target-mips: Remove unused `FLOAT_OP' macro
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c246cee4eedb17ae3932d699e009a8b63240235f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 17 13:56:50 2014 +0100

      update ipxe from 69313ed to 35c5379

      Anton D. Kachalov (1):
            [intel] Add 8086:1557 card (Intel 82599 10G ethernet mezz)

      Christian Hesse (1):
            [build] Merge util/geniso and util/genliso

      Curtis Larsen (3):
            [efi] Use EFI_CONSOLE_CONTROL_PROTOCOL to set text mode if available
            [efi] Report errors from attempting to disconnect existing drivers
            [efi] Try various possible SNP receive filters

      Dale Hamel (1):
            [smbios] Expose board serial number as ${board-serial}

      Florian Schmaus (1):
            [build] Set GITVERSION only if there is a git repository

      Hannes Reinecke (3):
            [ethernet] Provide eth_random_addr() to generate random Ethernet addresses
            [igbvf] Assign random MAC address if none is set
            [igbvf] Allow changing of MAC address

      Jan Kiszka (1):
            [intel] Add I217-LM PCI ID

      Marin Hannache (4):
            [nfs] Fix an invalid free() when loading a symlink
            [nfs] Fix an invalid free() when loading a regular (non-symlink) file
            [nfs] Rewrite NFS URI handling
            [readline] Add CTRL-W shortcut to remove a word

      Michael Brown (144):
            [profile] Allow interrupts to be excluded from profiling results
            [intel] Exclude time spent in hypervisor from profiling
            [build] Fix version.o dependency upon git index
            [tcp] Defer sending ACKs until all received packets have been processed
            [lkrnprefix] Function as a bzImage kernel
            [build] Avoid errors when build directory is mounted via NFS
            [undi] Apply quota only to number of complete received packets
            [lkrnprefix] Make real-mode setup code relocatable
            [intel] Increase receive ring fill level
            [syslog] Strip invalid characters from hostname
            [test] Add self-tests for strdup()
            [libc] Prevent strndup() from reading beyond the end of the string
            [efi] Allow for optional protocols
            [efi] Make EFI_DEVICE_PATH_TO_TEXT_PROTOCOL optional
            [efi] Make EFI_HII_DATABASE_PROTOCOL optional
            [efi] Do not try to fetch loaded image device path protocol
            [ipv6] Fix definition of IN6_IS_ADDR_LINKLOCAL()
            [dhcpv6] Do not set sin6_scope_id on the unspecified client socket address
            [ipv6] Do not set sin6_scope_id on source address
            [ipv6] Include network device when transcribing multicast addresses
            [ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()
            [librm] Allow for the PIC interrupt vector offset to be changed
            [ifmgmt] Do not sleep CPU while configuring network devices
            [scsi] Improve sense code parsing
            [iscsi] Read IPv4 settings only from the relevant network device
            [iscsi] Include IP address origin in iBFT
            [debug] Allow debug message colours to be customised via DBGCOL=...
            [build] Expose build timestamp, build name, and product names
            [efi] Allow device paths to be easily included in debug messages
            [efi] Provide a meaningful EFI SNP device name
            [efi] Restructure EFI driver model
            [build] Fix erroneous object name in version object
            [build] Add yet another potential location for isolinux.bin
            [efi] Allow network devices to be created on top of arbitrary SNP devices
            [autoboot] Allow autoboot device to be identified by link-layer address
            [efi] Identify autoboot device by MAC address when chainloading
            [efi] Attempt to start only drivers claiming support for a device
            [efi] Rewrite SNP NIC driver
            [efi] Include SNP NIC driver within the all-drivers target
            [crypto] Add support for iPAddress subject alternative names
            [crypto] Fix debug message
            [netdevice] Reset network device index when last device is unregistered
            [efi] Update EDK2 headers
            [efi] Install our own disk I/O protocol and claim exclusive use of it
            [efi] Allow for interception of boot services calls by loaded image
            [efi] Print well-known GUIDs by name in debug messages
            [efi] Include EFI_CONSOLE_CONTROL_PROTOCOL header
            [ioapi] Fail ioremap() when attempting to map a zero bus address
            [intel] Check for ioremap() failures
            [realtek] Check for ioremap() failures
            [vmxnet3] Check for ioremap() failures
            [skel] Check for ioremap() failures
            [myson] Check for ioremap() failures
            [natsemi] Check for ioremap() failures
            [i386] Add functions to read and write model-specific registers
            [x86_64] Add functions to read and write model-specific registers
            [efi] Show more diagnostic information when building with DEBUG=efi_wrap
            [ioapi] Centralise notion of PAGE_SIZE
            [lotest] Discard packets arriving on the incorrect network device
            [xen] Import selected public headers
            [xen] Add basic support for PV-HVM domains
            [xen] Add support for Xen netfront virtual NICs
            [efi] Default to releasing network devices for use via SNP
            [efi] Unload started images only on failure
            [efi] Fill in loaded image's DeviceHandle if firmware fails to do so
            [efi] Fix incorrect debug message level when device has no device path
            [efi] Report exact failure when unable to open the device path
            [netdevice] Avoid registering duplicate network devices
            [efi] Ignore failures when attempting to install SNP HII protocol
            [efi] Expand the range of well-known EFI GUIDs in debug messages
            [efi] Provide efi_handle_name() for debugging
            [efi] Add ability to dump all openers of a given protocol on a handle
            [efi] Use efi_handle_name() instead of efi_handle_devpath_text()
            [efi] Use efi_handle_name() instead of efi_devpath_text() where applicable
            [efi] Allow compiler to perform type checks on EFI_HANDLE
            [efi] Avoid unnecessarily passing pointers to EFI_HANDLEs
            [efi] Dump existing openers when we are unable to open a protocol
            [efi] Dump handle information around connect/disconnect attempts
            [efi] Improve debugging of the debugging facilities
            [efi] Add excessive sanity checks into efi_debug functions
            [efi] Also try original ComponentName protocol for retrieving driver names
            [efi] Print raw device path when we have no DevicePathToTextProtocol
            [efi] Add ability to dump SNP device mode information
            [efi] Reset multicast filter list when setting SNP receive filters
            [efi] Provide centralised definitions of commonly-used GUIDs
            [efi] Open device path protocol only at point of use
            [efi] Move abstract device path and handle functions to efi_utils.c
            [efi] Generalise snpnet_pci_info() to efi_locate_device()
            [bios] Support displaying and hiding cursor
            [efi] Support displaying and hiding cursor
            [readline] Ensure cursor is visible when prompting for input
            [xen] Accept alternative Xen platform PCI device ID 5853:0002
            [xen] Use version 1 grant tables by default
            [xen] Cope with unexpected initial backend states
            [smc9000] Avoid using CONFIG as a preprocessor macro
            [build] Allow for named configurations at build time
            [intel] Display PBS value when applying ICH errata workaround
            [intel] Display before and after values for both PBS and PBA
            [intel] Apply PBS/PBA errata workaround only to ICH8 PCI device IDs
            [efi] Add definitions of GUIDs observed during Windows boot
            [efi] Dump details of any calls to our dummy block and disk I/O protocols
            [romprefix] Do not preserve unused register %di
            [build] Remove obsolete references to .zrom build targets
            [build] Allow ISA ROMs to be built
            [build] Avoid deleting config header files if build is interrupted
            [prefix] Halt system without burning CPU if we cannot access the payload
            [prefix] Report both %esi and %ecx when opening payload fails
            [util] Use PCI length field to obtain length of individual images
            [mromprefix] Use PCI length field to obtain length of individual images
            [mromprefix] Allow for .mrom images larger than 128kB
            [efi] Show details of intercepted LoadImage() calls
            [efi] Make our virtual file system case insensitive
            [efi] Wrap any images loaded by our wrapped image
            [efi] Use the SNP protocol instance to match the SNP chainloading device
            [efi] Avoid returning uninitialised data from PCI configuration space reads
            [efi] Make EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL optional
            [efi] Allow for non-PCI snpnet devices
            [build] Clean up all binary directories on "make [very]clean"
            [efi] Add efifatbin utility
            [efi] Provide dummy device path in efi_image_probe()
            [dhcp] Check for matching chaddr in received DHCP packets
            [dhcp] Remove obsolete dhcp_chaddr() function
            [build] Use -malign-double to build 32-bit UEFI binaries
            [efi] Centralise definitions of more protocol GUIDs
            [efi] Add definitions of GUIDs observed when chainloading from Intel driver
            [efi] Free transmit ring entry before calling netdev_tx_complete()
            [efi] Generalise snpnet_dev_info() to efi_device_info()
            [efi] Update to current EDK2 headers
            [efi] Add NII / UNDI driver
            [efi] Check for presence of UNDI in NII protocol
            [efi] Include NII driver within "snp" and "snponly" build targets
            [ping] Report timed-out pings via the callback function
            [ping] Allow termination after a specified number of packets
            [ping] Allow "ping" command output to be inhibited
            [intel] Use autoloaded MAC address instead of EEPROM MAC address
            [crypto] Fix parsing of OCSP responder ID key hash
            [vmxnet3] Add profiling code to exclude time spent in the hypervisor
            [netdevice] Fix erroneous use of free(iobuf) instead of free_iob(iobuf)
            [libc] Add ASSERTED macro to test if any assertion has triggered
            [list] Add sanity checks after list-adding functions
            [malloc] Tidy up debug output
            [malloc] Sanity check parameters to alloc_memblock() and free_memblock()
            [malloc] Check integrity of free list
            [malloc] Report caller address as soon as memory corruption is detected

      Peter Lemenkov (1):
            [build] Check if git index actually exists

      Robin Smidsrød (2):
            [build] Add named configuration for VirtualBox
            [build] Avoid using embedded script in VirtualBox named configuration

      Sven Ulland (1):
            [lacp] Set "aggregatable" flag in response LACPDU

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d3f3a0f453ea590be529079ae214c200bb5ecc1a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 12 10:52:52 2014 +0100

      sdl2: Work around SDL2 SDL_ShowWindow() bug

      Apparently it is possible for X to send an event to a hidden SDL2
      window, leading to SDL2 believing it is now shown. SDL2 will pass the
      SDL_WINDOWEVENT_SHOWN message to the application without actually
      showing the window; the problem is that the next SDL_ShowWindow() will
      be a no-op because SDL2 assumes the window is already shown.

      The correct way to react to SDL_WINDOWEVENT_SHOWN would be to clear
      scon->hidden (analogous for SDL_WINDOWEVENT_HIDDEN). However, due to the
      window not actually being shown, this will somehow not be correct after
      all.

      Therefore, just hide the window on SDL_WINDOWEVENT_SHOWN if it is
      supposed to be hidden (and analogous for SDL_WINDOWEVENT_HIDDEN).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1dfc5c8808e8b523c8ef70859921ab5ecd09cd67
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 12 10:52:51 2014 +0100

      sdl2: Use correct sdl2_console for window events

      SDL_PollEvent() polls events for all windows; therefore,
      sdl2_poll_events() will poll the events for all windows and not only for
      the one identified by the given sdl2_console.

      This should be considered in handle_windowevent(): The window affected
      by the event is not necessarily the one identified by the sdl2_console
      object given to sdl2_poll_events(), but the one identified by
      ev->window.windowID.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 62959ffe45bdd7bb069e529686a8c152518812fc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 12 08:03:34 2014 +0100

      sdl2: move sdl2_2d_refresh to sdl2-2d.c

      Now that common event handling code is split off, we can move
      over sdl_refresh to sdl2-2d.c, and rename it to sdl2_2d_refresh.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 63ed4907cb4cfacf1f875f938037af9c75afa453
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 12 08:01:27 2014 +0100

      sdl2: factor out sdl2_poll_events

      Create a new function to poll and handle sdl2 events,
      which is then just called from the refresh timer.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0d01b7ce617b5f511c852ad770fd7fdce6bf353d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:31:08 2014 +0100

      sdl2: add+use sdl2_2d_redraw function.

      Add a new sdl2_2d_redraw function for a complete screen refresh,
      so we can stop using graphic_hw_invalidate for that.  There is
      no need to bother console / gfx emulation code if we are just
      going to re-blit the screen after window resizes.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 2c3056f182e16038c8b0663f68b3b5105899fb75
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:22:49 2014 +0100

      sdl2: move sdl_switch to sdl2-2d.c

      Move sdl_switch to sdl2-2d.c file, rename to sdl2_2d_switch.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 46522a82236ea0cf9011b89896d2d8f8ddaf2443
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:12:02 2014 +0100

      sdl2: overhaul window size handling

      Split do_sdl_resize function (which does alot more than just resizing)
      into three: sdl2_window_{create,destroy,resize}.

      Fix SDL_Renderer handling: must be guest display size not host window
      size, and SDL2 will magically handle all scaling for us.

      Make fullscreen actually enter fullscreen mode and simplify the code.
      There is no need to store the original window size, the window manager
      will do that for us.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f1ddebd8651c023409d3505f83416f65ce088961
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 11:09:26 2014 +0100

      sdl2: move sdl_update to new sdl2-2d.c

      Create new sdl2-2d file for 2d display rendering.
      Move over sdl_update code, and rename to sdl2_2d_update.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 44f017d03e72484d47a2aefcbf452af0a9915fbc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 12:02:50 2014 +0100

      sdl2: turn on keyboard grabs

      Makes quite some keys actually go to the guest instead of
      being captured by the host window manager.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 8fc1a3f58f180089284c7d5c8e67b584930d19fe
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:58:19 2014 +0100

      sdl2: move keyboard input code to new sdl2-input.c

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 5d0fe65078bcd6949372a49b125dded981856197
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:21:24 2014 +0100

      sdl2: rename sdl2_state to sdl2_console, move to header file

      Create sdl2.h header file, in preparation for sdl2 code splitup.
      Populate it with sdl2_console struct (renamed from sdl2_state).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 97e89ee914411384dcda771d38bf89f13726d71e
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sat Nov 8 19:00:55 2014 +0300

      target-xtensa: don't generate dead code

      Don't generate TCG operations when privilege, register window or
      coprocessor checks fail.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2db59a76c421cdd1039d10e32a9798952d3ff5ba
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Thu Oct 30 18:07:47 2014 +0300

      target-xtensa: record available window in TB flags

      Record last valid 4-register window pane number in TB flags so that a
      window overflow exception throw point is known at the translation time.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 85d36377e4ff8b98119420099d445369bfd6b7bb
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Dec 14 08:23:52 2014 +0300

      target-xtensa: test cross-page opcode

      Alter cross-page TB test to also test cross-page opcode.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 01673a3401614b4199c9946ad47b97bedfc7a7c2
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Dec 14 07:50:55 2014 +0300

      target-xtensa: fix translation for opcodes crossing page boundary

      If TB ends with an opcode that crosses page boundary and the following
      page is not executable then EPC1 for the code fetch exception wrongly
      points at the beginning of the TB. Always treat instruction that crosses
      page boundary as a separate TB.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 246ae24d7df47f05d7b102f9c84e00b536eadc43
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Nov 2 11:04:18 2014 +0300

      tcg: add separate monitor command to dump opcode counters

      Currently 'info jit' outputs half of the information to monitor and the
      rest to qemu log. Dumping opcode counts to monitor as a part of 'info
      jit' command doesn't sound useful. Add new monitor command 'info
      opcount' that only dumps opcode counters.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 339aaf5b7f26d1e638641c59a44883b7654bd8ea
  Author: Antony Pavlov <antonynpavlov@gmail.com>
  Date:   Sat Dec 13 19:48:18 2014 +0300

      qemu-log: add log category for MMU info

      Running barebox on qemu-system-mips* with '-d unimp' overloads
      stderr by very very many mips_cpu_handle_mmu_fault() messages:

        mips_cpu_handle_mmu_fault address=b80003fd ret 0 physical 00000000180003fd prot 3
        mips_cpu_handle_mmu_fault address=a0800884 ret 0 physical 0000000000800884 prot 3
        mips_cpu_handle_mmu_fault pc a080cd80 ad b80003fd rw 0 mmu_idx 0

      So it's very difficult to find LOG_UNIMP message.

      The mips_cpu_handle_mmu_fault() messages appear on enabling ANY
      logging! It's not very handy.

      Adding separate log category for *_cpu_handle_mmu_fault()
      logging fixes the problem.

      Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1418489298-1184-1-git-send-email-antonynpavlov@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d86fb03469e016af4e54f04efccbc20a8afa3e19
  Merge: 4db753b a416427
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 16:52:42 2014 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20141216-1' into staging

      misc spice updates.

      # gpg: Signature made Tue 16 Dec 2014 14:03:07 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20141216-1:
        spice: fix memory leak
        spice: remove spice-experimental.h include
        spice: do not require TCP ports
        spice: rework mirror allocation, add no-resize fast path
        spice: reduce refresh rate in native mode
        spice: use bottom half instead of refresh timer for cursor updates

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4db753b1ac4aedc6cd67fb13d50e5015ce8052a5
  Merge: dfa9c2a 44a1f94
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 14:53:23 2014 +0000

      Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.3-2' into staging

      Migration pull for 2.3.  Mostly moving the code to the migration/
      directory, and updating MAINTAINERS.

      I've also folded my other MAINTAINERS update patches into this, as
      they're small by themselves.

      # gpg: Signature made Tue 16 Dec 2014 12:21:24 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-migration/tags/for-2.3-2:
        MAINTAINERS: Update for migrated migration code
        Split the QEMU buffered file code out
        Split struct QEMUFile out
        Remove migration- pre/post fixes off files in migration/ dir
        Start migrating migration code into a migration directory
        qmp-command.hx: add missing docs for migration capabilites
        cpu: verify that block->host is set
        cpu: assert host pointer offset within block
        exec: add wrapper for host pointer access
        MAINTAINERS: add include files to virtio-serial entry
        MAINTAINERS: add entry for virtio-rng
        MAINTAINERS: migration: add vmstate static checker files
        MAINTAINERS: Add myself to migration maintainers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46817e86fc1d97af0a7d9e4060730f7b00183083
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Dec 5 11:33:37 2014 +0800

      vga: set catagory bit for secondary vga device

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 22382bb96c8bd88370c1ff0cb28c3ee6bee79ed3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 16 10:22:23 2014 +0200

      move hw cursor pos from cirrus to vga

  commit b9fd11b86779b1fe7fe2881c6e312a028e20e67c
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 10:28:39 2014 +1000

      cirrus: Force use of shadow pixmap when HW cursor is enabled

      The HW cursor cannot be painted on a shared surface. This fixes HW
      cursor display in Windows NT 4.0 and Windows 98.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5508099397c480f1c3b4f14b0e64593ebe284b26
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 10:17:44 2014 +1000

      vga: Add mechanism to force the use of a shadow surface

      This prevents surface sharing which will be necessary to
      fix cirrus HW cursor support.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a41642708a5d1cbe8ad966227bbee1ed5eb421ad
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Dec 5 16:30:10 2014 +0800

      spice: fix memory leak

      If errors happen for middle items of channel_list,
      qmp_query_spice_channels() returns NULL, and the variable
      cur_item going out of scope leaks the storage it points to.

      The flag is a compatibility thing for older spice-server
      versions. Meanwhile our minimum spice version requirement is
      new enough that we should never ever see this error, and if we
      do something went very seriously wrong. Let's using assert()
      instead of returning NULL to avoid a memory leak.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e0883e2de0ef36f254acc274e80ddeac13a2a8f6
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Mon Nov 17 16:52:49 2014 +0100

      spice: remove spice-experimental.h include

      Nothing seems to be using functions from spice-experimental.h (better
      that way). Let's remove its inclusion.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf7856adefebe86e0cd50302d93b3045e3111690
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Nov 11 13:39:19 2014 +0100

      spice: do not require TCP ports

      It is possible to use Spice server without TCP port.  On local VM,
      qemu (and libvirt) can add new clients thanks to QMP add_client command.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 555e72f2d02125766601db52c6380357b3820fcb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Sat Nov 8 08:56:34 2014 +0100

      spice: rework mirror allocation, add no-resize fast path

      Add fast path to qemu_spice_display_switch in case old and new
      displaysurface have identical size (happens with display panning
      and page flipping).  We just swap the backing store then and don't
      go through the whole process of deleting and creating the primary
      surface.

      To simplify the code a bit move mirror surface allocation to
      qemu_spice_display_switch().

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3dcadce5076d4b42fa395c39662d65e050b77784
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 4 14:16:12 2014 +0100

      spice: reduce refresh rate in native mode

      Now that cursor updates are out of the way qxl needs the refresh timer
      only when when running in vga mode, for dirty bitmap checking.  In
      native qxl mode the guest will notify us, so we don't need to poll and
      can use the idle interval (one refresh wakeup every few seconds).

      Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b2824e5e48a787be3edbfc897244b4621e5bd61
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 4 13:59:59 2014 +0100

      spice: use bottom half instead of refresh timer for cursor updates

      Calling directly doesn't work due to the qxl-render code running in
      spice server thread context.  Meanwhile bottom half scheduling is
      thread-safe though, so we can use that to kick a cursor update in
      main i/o thread context.

      Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d29c431edce6c0cd18fc5c4ecf31417c2569ae4a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:13:08 2014 +0100

      sdl: move version logic from source code to makefile

      Compile sdl.c / sdl2.c depending on CONFIG_SDLABI instead of
      compiling both and have version #ifdefs in the source code.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit d4fa5354a246a1c6cb538a5d8ebcc21206d502fb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 16:30:59 2014 +0000

      target-mips: remove excp_names[] from linux-user as it is unused

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ef39152636d27b0d3340fcf030c3edb85a436cb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Dec 12 16:12:11 2014 +0000

      disas/mips: disable unused mips16_to_32_reg_map[]

      This array is used by print_mips16_insn_arg() which is guarded by #if 0.
      Therefore doing the same with the array as it generates clang warnings.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8e5f7570448185297917d82d61ffbe27eff47a01
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 15:48:02 2014 +0000

      disas/mips: remove unused mips_msa_control_names_numeric[32]

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 00fb4a118142650e7fa3d5007b197bc11fec6ea9
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 15:39:42 2014 +0000

      target-mips: convert single case switch into if statement

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 66991d1103562591eba6b801049720976317fe61
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 22:31:33 2014 +0000

      target-mips: Fix DisasContext's ulri member initialization

      Set DisasContext's ulri member to 0 or 1 as with other bool members.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1a4d570017bf35d99340781ecb59dd3772464031
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 17:51:12 2014 +0000

      target-mips: Use local float status pointer across MSA macros

      Reduce line wrapping throughout MSA helper macros by using a local float
      status pointer rather than referring to the float status through the
      environment each time.  No functional change.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit bb962386b82c1b0e9e12fdb6b9bb62106bf1f822
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 17:02:38 2014 +0000

      target-mips: Add missing calls to synchronise SoftFloat status

      Add missing calls to synchronise the SoftFloat status with the CP1.FSCR:

      + for the rounding and flush-to-zero modes upon processor reset,

      + for the flush-to-zero mode on FSCR updates through the GDB stub.

      Refactor code accordingly and remove the redundant RESTORE_ROUNDING_MODE
      macro.

      Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 74797f40dc3e17633fea614f08c828020f755b28
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Thu Nov 20 16:00:54 2014 +0000

      linux-user: Use the 5KEf processor for 64-bit emulation

      Replace the 20Kc original MIPS64 ISA processor used for 64-bit user
      emulation with the 5KEf processor that implements the MIPS64r2 ISA,
      complementing the choice of the 24Kf processor for 32-bit emulation.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1d725ae952a14b30c84b7bc81b218b8ba77dd311
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Thu Nov 20 11:15:34 2014 +0000

      target-mips: Also apply the CP0.Status mask to MTTC0

      Make CP0.Status writes made with the MTTC0 instruction respect this
      register's mask just like all the other places.  Also preserve the
      current values of masked out bits.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cbb26c9a122c3f71fb53989817d406a2f6d08662
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Dec 5 18:46:04 2014 +0000

      target-mips: gdbstub: Clean up FPU register handling

      Rewrite the FPU register access parts of `mips_cpu_gdb_read_register'
      and `mips_cpu_gdb_write_register' for consistency between each other.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c48245f0c62405f27266fcf08722d8c290520418
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 19 17:29:00 2014 +0000

      target-mips: Correct 32-bit address space wrapping

      Make sure the address space is unconditionally wrapped on 32-bit
      processors, that is ones that do not implement at least the MIPS III
      ISA.

      Also make MIPS16 SAVE and RESTORE instructions use address calculation
      rather than plain arithmetic operations for stack pointer manipulation
      so that their semantics for stack accesses follows the architecture
      specification.  That in particular applies to user software run on
      64-bit processors with the CP0.Status.UX bit clear where the address
      space is wrapped to 32 bits.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d9224450208e0de62323b64ace91f98bc31d6e2c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Dec 5 18:47:58 2014 +0000

      target-mips: Tighten ISA level checks

      Tighten ISA level checks down to MIPS II that many of our instructions
      are missing.  Also make sure any 64-bit instruction enables are only
      applied to 64-bit processors, that is ones that implement at least the
      MIPS III ISA.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 90f12d735d66ac1196d9a2bced039a432eefc03d
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 18 03:59:07 2014 +0000

      target-mips: Fix CP0.Config3.ISAOnExc write accesses

      Fix CP0.Config3.ISAOnExc write accesses on microMIPS processors.  This
      bit is mandatory for any processor that implements the microMIPS
      instruction set.  This bit is r/w for processors that implement both the
      standard MIPS and the microMIPS instruction set.  This bit is r/o and
      hardwired to 1 if only the microMIPS instruction set is implemented.

      There is no other bit ever writable in CP0.Config3 so defining a
      corresponding `CP0_Config3_rw_bitmask' member in `CPUMIPSState' is I
      think an overkill.  Therefore make the ability to write the bit rely on
      the presence of ASE_MICROMIPS set in the instruction flags.

      The read-only case of the microMIPS instruction set being implemented
      only can be added when we add support for such a configuration.  We do
      not currently have such support, we have no instruction flag that would
      control the presence of the standard MIPS instruction set nor any
      associated code in instruction decoding.

      This change is needed to boot a microMIPS Linux kernel successfully,
      otherwise it hangs early on as interrupts are enabled and then the
      exception handler invoked loops as its first instruction is interpreted
      in the wrong execution mode and triggers another exception right away.
      And then over and over again.

      We already check the current setting of the CP0.Config3.ISAOnExc in
      `set_hflags_for_handler' to set the ISA bit correctly on the exception
      handler entry so it is the ability to set it that is missing only.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 27e1fb13f21e132011673f0a39e17bcc97583633
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 18 03:20:28 2014 +0000

      target-mips: Output CP0.Config2-5 in the register dump

      Include CP0.Config2 through CP0.Config5 registers in the register dump
      produced with the `info registers' monitor command.  Align vertically
      with the registers already output.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 7215d7e7aea85699bf516c3e8d84f6a22584da35
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 12 15:21:53 2014 +0000

      target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP

      Fix microMIPS MOVE16 and MOVEP instructions on 64-bit processors by
      using register addition operations.

      This copies the approach taken with MIPS16 MOVE instructions (I8_MOV32R
      and I8_MOVR32 opcodes) and follows the observation that OPC_ADDU expands
      to tcg_gen_mov_tl whenever `rt' is 0 and `rs' is not, therefore copying
      `rs' to `rd' verbatim.  This is not the case with OPC_ADDIU where a
      sign-extension from bit #31 is made, unless in the uninteresting case of
      `rs' being 0, losing the upper 32 bits of the value copied for any
      proper 64-bit values.

      This also serves as an optimization as one op is produced in generated
      code rather than two (again, unless `rs' is 0, where it doesn't change
      anything).

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 81a423e6c6d3ccaa79de4e58024369c660c1eeb4
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 10 13:46:35 2014 +0000

      target-mips: Correct the writes to Status and Cause registers via gdbstub

      Make writes to CP0.Status and CP0.Cause have the same effect as
      executing corresponding MTC0 instructions would in Kernel Mode.  Also
      ignore writes in the user emulation mode.

      Currently for requests from the GDB stub we write all the bits across
      both registers, ignoring any read-only locations, and do not synchronise
      the environment to evaluate side effects.  We also write these registers
      in the user emulation mode even though a real kernel presents them as
      read only.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f88f79ec9df06d26d84e1d2e0c02d2634b4d8583
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 10 13:45:41 2014 +0000

      target-mips: Correct the handling of writes to CP0.Status for MIPSr6

      Correct these issues with the handling of CP0.Status for MIPSr6:

      * only ignore the bit pattern of 0b11 on writes to CP0.Status.KSU, that
        is for processors that do implement Supervisor Mode, let the bit
        pattern be written to CP0.Status.UM:R0 freely (of course the value
        written to read-only CP0.Status.R0 will be discarded anyway); this is
        in accordance to the relevant architecture specification[1],

      * check the newly written pattern rather than the current contents of
        CP0.Status for the KSU bits being 0b11,

      * use meaningful macro names to refer to CP0.Status bits rather than
        magic numbers.

      References:

      [1] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
          Privileged Resource Architecture", MIPS Technologies, Inc., Document
          Number: MD00091, Revision 6.00, March 31, 2014, Table 9.45 "Status
          Register Field Descriptions", pp. 210-211.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c3577479815f5bcf9d38993967bca2115af245d8
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Nov 7 20:05:35 2014 +0000

      target-mips: Correct MIPS16/microMIPS branch size calculation

      Correct MIPS16/microMIPS branch size calculation in PC adjustment
      needed:

      - to set the value of CP0.ErrorEPC at the entry to the reset exception,

      - for the purpose of branch reexecution in the context of device I/O.

      Follow the approach taken in `exception_resume_pc' for ordinary, Debug
      and NMI exceptions.

      MIPS16 and microMIPS branches can be 2 or 4 bytes in size and that has
      to be reflected in calculation.  Original MIPS ISA branches, which is
      where this code originates from, are always 4 bytes long, just as all
      original MIPS ISA instructions.

      Signed-off-by: Nathan Froyd <froydnj@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8fc605b8aa257feb3e69d44794a765bd492b573b
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:38:01 2014 +0000

      target-mips: Restore the order of helpers

      Restore the order of helpers that used to be: unary operations (generic,
      then MIPS-specific), binary operations (generic, then MIPS-specific),
      compare operations.  At one point FMA operations were inserted at a
      random place in the file, disregarding the preexisting order, and later
      on even more operations sprinkled across the file.  Revert the mess by
      moving FMA operations to a new ternary class inserted after the binary
      class and move the misplaced unary and binary operations to where they
      belong.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 51fdea945ae7adae8d7e4a1624e35bb7f714b58f
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:36:28 2014 +0000

      target-mips: Remove unused `FLOAT_OP' macro

      Remove the `FLOAT_OP' macro, unused since commit
      b6d96beda3a6cbf20a2d04a609eff78adebd8859 [Use temporary registers for
      the MIPS FPU emulation.].

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2b09f94cdbf5c54e2278d7f3aed2eceff3494790
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:35:59 2014 +0000

      target-mips: Make `helper_float_cvtw_s' consistent with the remaining helpers

      Move the call to `update_fcr31' in `helper_float_cvtw_s' after the
      exception flag check, for consistency with the remaining helpers that do
      it last too.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d2bfa6e6222baa0218bd0658499d38bac56ac34c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:35:31 2014 +0000

      target-mips: Fix formatting in `decode_opc'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6225a4a0e39cb24e7b9e1d4d2c1a3e6eaee18e85
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:34:58 2014 +0000

      target-mips: Fix formatting in `mips_defs'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d75de74967f631a7d0b538d4b88f96f9c426bfe2
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:34:00 2014 +0000

      target-mips: Fix formatting in `decode_extended_mips16_opc'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4386f08767240080334539ac0b07a8bfe30bffe9
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:42:19 2014 +0000

      target-mips: Enable vectored interrupt support for the 74Kf CPU

      Enable vectored interrupt support for the 74Kf CPU, reflecting hardware.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 11f5ea105c06bec72e9bc9a700fa65d60afb5ec3
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:39:48 2014 +0000

      target-mips: Add M14K and M14Kc MIPS32r2 microMIPS processors

      Add the M14K and M14Kc processors from MIPS Technologies that are the
      original implementation of the microMIPS ISA.  They are dual instruction
      set processors, implementing both the microMIPS and the standard MIPSr32
      ISA.

      These processors correspond to the M4K and 4KEc CPUs respectively,
      except with support for the microMIPS instruction set added, support for
      the MCU ASE added and two extra interrupt lines, making a total of 8
      hardware interrupts plus 2 software interrupts.  The remaining parts of
      the microarchitecture, in particular the pipeline, stayed unchanged.

      The presence of the microMIPS ASE is is reflected in the configuration
      added.  We currently have no support for the MCU ASE, including in
      particular the ACLR, ASET and IRET instructions in either encoding, and
      we have no support for the extra interrupt lines, including bits in
      CP0.Status and CP0.Cause registers, so these features are not marked,
      making our support diverge from real hardware.

      Signed-off-by: Sandra Loosemore <sandra@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8280b12c0e4b515d707509dde4ddde05d9bda4ef
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:37:17 2014 +0000

      target-mips: Make CP0.Config4 and CP0.Config5 registers signed

      Make the data type used for the CP0.Config4 and CP0.Config5 registers
      and their mask signed, for consistency with the remaining 32-bit CP0
      registers, like CP0.Config0, etc.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 36b86e0dc2be93fc538fe7e11e0fda1a198f0135
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 19:31:26 2014 +0000

      target-mips: Add 5KEc and 5KEf MIPS64r2 processors

      Add the 5KEc and 5KEf processors from MIPS Technologies that are the
      original implementation of the MIPS64r2 ISA.

      Silicon for these processors has never been taped out and no soft cores
      were released even.  They do exist though, a CP0.PRId value has been
      assigned and experimental RTLs produced at the time the MIPS64r2 ISA has
      been finalized.  The settings introduced here faithfully reproduce that
      hardware.

      As far the implementation goes these processors are the same as the 5Kc
      and the 5Kf CPUs respectively, except implementing the MIPS64r2 rather
      than the original MIPS64 instruction set.  There must have been some
      updates to the CP0 architecture as mandated by the ISA, such as the
      addition of the EBase register, although I am not sure about the exact
      details, no documentation has ever been produced for these processors.
      The remaining parts of the microarchitecture, in particular the
      pipeline, stayed unchanged.  Or to put it another way, the difference
      between a 5K and a 5KE CPU corresponds to one between a 4K and a 4KE
      CPU, except for the 64-bit rather than 32-bit ISA.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c7d4d98ae7057467f48c02a11ad9120021976089
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 18:51:38 2014 +0000

      target-mips: Make CP1.FIR read-only here too

      CP1.FIR is read-only in hardware so gdbstub must respect it.  We already
      respect it for CTC1 instructions, so do it here too.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 800675f11742b6080e40d17b8d5f35d3a5fc5724
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 18:47:45 2014 +0000

      target-mips: Correct the handling of register #72 on writes

      Fix an off-by-one error in `mips_cpu_gdb_write_register' for register
      matching how `mips_cpu_gdb_read_register' handles it.  This register
      slot is a fake anyway, there's nothing in hardware that corresponds to
      it.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 44a1f94684eeaa6e312ea2d77ede266a81d31210
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:42 2014 +0000

      MAINTAINERS: Update for migrated migration code

      My previous patches migrated the migration code into migration/
      but didn't update MAINTAINERS.

      Note that does mean that the owner for block-migration.c
      changes, but I'll ask block people what they want to do.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 977184db39678624c1fc11d0d834a33127745904
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:41 2014 +0000

      Split the QEMU buffered file code out

      The splitting of qemu-file and addition of the buffered file landed
      at the same time; so now split the buffered file code out.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 4f9d09001261420a2990454e91320aca2d9d8781
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:40 2014 +0000

      Split struct QEMUFile out

      Now we've got multiple QEMUFile source files, some of them need
      access to things that were defined in qemu-file.c, so create
      a -internal header for them.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 329c9b10b659209c663e59ce164727ef9fd2ecdb
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:39 2014 +0000

      Remove migration- pre/post fixes off files in migration/ dir

      The general feeling is that having migration/migration-blah
      is overkill.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 60fe637bf0e4d7989e21e50f52526444765c63b4
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:38 2014 +0000

      Start migrating migration code into a migration directory

      The migration code now occupies a fair chunk of the top level .c
      files, it seems time to give it it's own directory.

      I've not touched:
         arch_init.c - that's mostly RAM migration but has a few random other
                       bits
         savevm.c    - because it's built target specific

      This is purely a code move; no code has changed.
         - it fails checkpatch because of old violations, it feels safer
           to keep this as purely a move and fix those at some mythical future
           date.

      The xbzrle and vmstate tests are now only run for softmmu builds
      since they require files in the migrate/ directory which is only built
      for softmmu.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit d6d69731f5295e4c3bb0196f57e8848af28b705e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue Dec 9 14:38:37 2014 +0800

      qmp-command.hx: add missing docs for migration capabilites

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit b78accf6147a87a3d9c1cd4287d7a1ff805f358e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:47 2014 +0200

      cpu: verify that block->host is set

      If it isn't, access at an offset will cause memory corruption.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit fd5f3b636788f79843d42188ed843c0416643326
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:44 2014 +0200

      cpu: assert host pointer offset within block

      Make accesses safer in case we missed some
      check somewhere.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1240be24357ee292f8d05aa2abfdba75dd0ca25d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:41 2014 +0200

      exec: add wrapper for host pointer access

      host pointer accesses force pointer math, let's
      add a wrapper to make them safer.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 68a5e38a7e428c05610fdbced7e7320a7aea3dc2
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:27 2014 +0530

      MAINTAINERS: add include files to virtio-serial entry

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1f51a5cb9741c9bf98b1e3d0e3ee60b71cfdf63e
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:26 2014 +0530

      MAINTAINERS: add entry for virtio-rng

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit c55156402e5b1f64b17c3261ef39a5e6666d9209
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:25 2014 +0530

      MAINTAINERS: migration: add vmstate static checker files

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 7f4675c3f737f3eded685deb83b47c9257e69999
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:24 2014 +0530

      MAINTAINERS: Add myself to migration maintainers

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit dfa9c2a0f4d0a0c8b2c1449ecdbb1297427e1560
  Merge: 5460075 224d10f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 15 16:43:42 2014 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - Migration and linuxboot fixes for 2.2 regressions
      - valgrind/KVM support
      - small i386 patches
      - PCI SD host controller support
      - malloc/free cleanups from Markus (x86/scsi)
      - IvyBridge model
      - XSAVES support for KVM
      - initial patches from record/replay

      # gpg: Signature made Mon 15 Dec 2014 16:35:08 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (47 commits)
        sdhci: Support SDHCI devices on PCI
        sdhci: Define SDHCI PCI ids
        sdhci: Add "sysbus" to sdhci QOM types and methods
        sdhci: Remove class "virtual" methods
        sdhci: Set a default frequency clock
        serial: only resample THR interrupt on rising edge of IER.THRI
        serial: update LSR on enabling/disabling FIFOs
        serial: clean up THRE/TEMT handling
        serial: reset thri_pending on IER writes with THRI=0
        linuxboot: fix loading old kernels
        kvm/apic: fix 2.2->2.1 migration
        target-i386: add Ivy Bridge CPU model
        target-i386: add f16c and rdrand to Haswell and Broadwell
        target-i386: add VME to all CPUs
        pc: add 2.3 machine types
        i386: do not cross the pages boundaries in replay mode
        cpus: make icount warp behave well with respect to stop/cont
        timer: introduce new QEMU_CLOCK_VIRTUAL_RT clock
        cpu-exec: invalidate nocache translation if they are interrupted
        icount: introduce cpu_get_icount_raw
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 224d10ff5aea9e74a1792fc21188bc9752c43ee9
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:33 2014 -0500

      sdhci: Support SDHCI devices on PCI

      Support for PCI devices following the "SD Host Controller Simplified
      Specification Version 2.00" spec.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ece5e5bfa1377546d5f94e1bb04298e48ce60c1c
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:32 2014 -0500

      sdhci: Define SDHCI PCI ids

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7302dcd60bbde1b11c298feb8134a34791f21b21
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:31 2014 -0500

      sdhci: Add "sysbus" to sdhci QOM types and methods

      Update the sdhci sysbus QOM types and methods so that sysbus is in
      their name.  This is in preparation for adding PCI versions of these
      types and methods.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d368ba4376b2c1c24175c74b3733b8fe64dbe8a6
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:30 2014 -0500

      sdhci: Remove class "virtual" methods

      The SDHCIClass defines a series of class "methods".  However, no code
      in the QEMU tree overrides these methods or even uses them outside of
      sdhci.c.

      Remove the virtual methods and replace them with direct calls to the
      underlying functions.  This simplifies the process of extending the
      sdhci code to support PCI devices (which have a different parent
      class).

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c7ff8daacf4a669f9ab5a975f33a51ef901b7556
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:34 2014 -0500

      sdhci: Set a default frequency clock

      The Linux SDHCI PCI driver will only register the device if there is a
      clock frequency set.  So, set a default frequency of 52Mhz.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1645b8eee558ffe2389a081bf61d08a864c36d2c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 12 11:54:42 2014 +0100

      serial: only resample THR interrupt on rising edge of IER.THRI

      There is disagreement on whether LSR.THRE should be resampled when
      IER.THRI goes from 1 to 1.  Bochs only does it if IER.THRI goes from 0
      to 1; PCE does it even if IER.THRI is unchanged.  But the Windows driver
      seems to always go from 1 to 0 and back to 1, so do things in agreement
      with Bochs, because the handling of thr_ipending was reported in 2010
      (https://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01914.html)
      as breaking DR-DOS Plus.

      Reported-by: Roy Tam <roytam@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 023c3a9707d0d9259a1e858cdf7804dd10973fca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 19:08:14 2014 +0100

      serial: update LSR on enabling/disabling FIFOs

      When the transmit FIFO is emptied or enabled, the transmitter
      hold register is empty.  When it is disabled, it is also emptied and
      in addition the previous contents of the transmitter hold register
      are discarded.  In either case, the THRE bit in LSR must be set and
      THRI raised.

      When the receive FIFO is emptied or enabled, the data ready and break
      bits must be cleared in LSR.  Likewise when the receive FIFO is disabled.

      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0d931d706266d6ada3bf22d3afca1afdc8d12fa9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 17:01:39 2014 +0100

      serial: clean up THRE/TEMT handling

      - assert TEMT is cleared before sending a character; we'll get one from
      TSR if tsr_retry > 0, from the FIFO or THR otherwise

      - assert THRE cleared and FIFO not empty (if enabled) before fetching a
      character to send.  This effectively reverts dffacd46, but the check
      makes no sense and commit f702e62 (serial: change retry logic to avoid
      concurrency, 2014-07-11) must have made it unnecessary.  The commit
      message for f702e62 talks about multiple calls to qemu_chr_fe_add_watch
      triggering s->tsr_retry >= MAX_XMIT_RETRY, but other failures were
      possible.  For example, if you have multiple calls, the subsequent ones
      will see s->tsr_retry == 0 and will find THRE and/or TEMT on entry.

      - for clarity, raise THRI immediately after the code sets THRE

      - check THRE to see if another character has to be sent.  This makes
      the assertions more obvious and also means TEMT has to be set as soon as
      the loop ends.  It makes the loop send both TSR and THR if flow-control
      happens in non-FIFO mode.  Previously, THR would be lost.

      - clear TEMT together with THRE even in the non-FIFO case

      The last two items are bugfixes, but they were just found by inspection
      and do not squash known bugs.

      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4e02b0fcf5c97579d0d3261c80c65abcf92870fe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 12 10:17:08 2014 +0100

      serial: reset thri_pending on IER writes with THRI=0

      This is responsible for failure of migration from 2.2 to 2.1, because
      thr_ipending is always one in practice.

      serial.c is setting thr_ipending unconditionally.  However, thr_ipending
      is not used at all if THRI=0, and it will be overwritten again the next
      time THRE or THRI changes.  For that reason, we can set thr_ipending to
      zero every time THRI is reset.

      There is disagreement on whether LSR.THRE should be resampled when IER.THRI
      goes from 1 to 1.  This patch does not touch the code, leaving that for
      QEMU 2.3+.

      This has no semantic change and is enough to fix migration in the common
      case where the interrupt is not pending or is reported in IIR.  It does not
      change the migration format, so 2.2.0 -> 2.1 will remain broken but we
      can fix 2.2.1 -> 2.1 without breaking 2.2.1 <-> 2.2.0.

      The case that remains broken (the one in which the subsection is strictly
      necessary) is when THRE=1, the THRI interrupt has *not* been acknowledged
      yet, and a higher-priority interrupt comes.  In this case, you need the
      subsection to tell the source that the lower-priority THRI interrupt is
      pending.  The subsection's breakage of migration, in this case, prevents
      continuing the VM on the destination with an invalid state.

      Cc: qemu-stable@nongnu.org
      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 269e2358492b674c50160553d037702e916b9f1b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 02:17:03 2014 +0100

      linuxboot: fix loading old kernels

      Old kernels that used high memory only allowed the initrd to be in the
      first 896MB of memory.  If you load the initrd above, they complain
      that "initrd extends beyond end of memory".

      In order to fix this, while not breaking machines with small amounts
      of memory fixed by cdebec5 (linuxboot: compute initrd loading address,
      2014-10-06), we need to distinguish two cases.  If pc.c placed the
      initrd at end of memory, use the new algorithm based on the e801
      memory map.  If instead pc.c placed the initrd at the maximum address
      specified by the bzImage, leave it there.

      The only interesting part is that the low-memory info block is now
      loaded very early, in real mode, and thus the 32-bit address has
      to be converted into a real mode segment.  The initrd address is
      also patched in the info block before entering real mode, it is
      simpler that way.

      This fixes booting the RHEL4.8 32-bit installation image with 1GB
      of RAM.

      Cc: qemu-stable@nongnu.org
      Cc: mst@redhat.com
      Cc: jsnow@redhat.com
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 575a6f4082c45778b93032ef1e7fbea4467b3a2a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 16:56:46 2014 +0100

      kvm/apic: fix 2.2->2.1 migration

      The wait_for_sipi field is set back to 1 after an INIT, so it was not
      effective to reset it in kvm_apic_realize.  Introduce a reset callback
      and reset wait_for_sipi there.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2f9ac42acf4602453d5839221df6cc7cabc3355e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:55:23 2014 +0100

      target-i386: add Ivy Bridge CPU model

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 78a611f1936b3eac8ed78a2be2146a742a85212c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:52:46 2014 +0100

      target-i386: add f16c and rdrand to Haswell and Broadwell

      Both were added in Ivy Bridge (for which we do not have a CPU model
      yet!).

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b3a4f0b1a072a467d003755ca0e55c5be38387cb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 14:12:41 2014 -0200

      target-i386: add VME to all CPUs

      vm86 mode extensions date back to the 486.  All models should have
      them.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 64bbd372f21dac51cbbb6ba4a52fb0ecb21ca159
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:51:42 2014 +0100

      pc: add 2.3 machine types

      The next patch will differentiate them.

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5b9efc39aee90bbd343793e942bf8f582a0c9e4f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:39:42 2014 +0300

      i386: do not cross the pages boundaries in replay mode

      This patch denies crossing the boundary of the pages in the replay mode,
      because it can cause an exception. Do it only when boundary is
      crossed by the first instruction in the block.
      If current instruction already crossed the bound - it's ok,
      because an exception hasn't stopped this code.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bf2a7ddb0a066c27ed1432b918baa046b6b7dfc5
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:55 2014 +0300

      cpus: make icount warp behave well with respect to stop/cont

      This patch makes icount warp use the new QEMU_CLOCK_VIRTUAL_RT clock.
      This way, icount's QEMU_CLOCK_VIRTUAL will never count time during which
      the virtual machine is stopped.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4e7fa73ec2516334b58e82f9a5649b1468b1eb7a
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:50 2014 +0300

      timer: introduce new QEMU_CLOCK_VIRTUAL_RT clock

      This patch introduces new QEMU_CLOCK_VIRTUAL_RT clock, which
      should be used for icount warping.  In the next patch, it
      will be used to avoid a huge icount warp when a virtual
      machine is stopped for a long time.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d8a499f17ee5f05407874f29f69f0e3e3198a853
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:16 2014 +0300

      cpu-exec: invalidate nocache translation if they are interrupted

      In this case, QEMU might longjmp out of cpu-exec.c and miss the final
      cleanup in cpu_exec_nocache.  Do this manually through a new compile
      flag.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2a62914bd8209d97e918f30f0de74bec2bf622c4
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Dec 8 10:53:45 2014 +0300

      icount: introduce cpu_get_icount_raw

      Separate accessing the instruction counter from the compensation for
      speed and halting that are introduced by qemu_icount_bias.  This
      introduces new infrastructure used by the record/replay patches.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 626cf8f4c6157ed133f0daa89b90d4169060bc97
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Dec 8 10:53:17 2014 +0300

      icount: set can_do_io outside TB execution

      This patch sets can_do_io function to allow reading icount
      within cpu-exec, but outside TB execution.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e511b4d783c47a32420da802104cfb0eb974b22f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:39:20 2014 +0300

      cpu-exec: reset exception_index correctly

      Exception index is reset at every entry at every entry into cpu_exec()
      function. This may cause missing the exceptions while replaying them.
      This patch moves exception_index reset to the locations where they are
      processed.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4ac20b4df0d1eaa5d546ccb84751e3e97d257fd
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:38:52 2014 +0300

      cpu-exec: fix cpu_exec_nocache

      In icount mode cpu_exec_nocache function is used to execute part of the
      existing TB. At the end of cpu_exec_nocache newly created TB is deleted.
      Sometimes io_read function needs to recompile current TB and restart TB
      lookup and execution. After that tb_find_fast function finds old (bigger)
      TB again. This TB cannot be executed (because icount is not big enough)
      and cpu_exec_nocache is called again. Such a loop continues over and over.
      This patch deletes old TB and avoids finding it in the TB cache.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8e1f53334700950eb6691076d51c7d60f1c28f7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 11:16:57 2014 +0100

      scsi-disk: provide maximum transfer length

      The QEMU block layer has a limit of INT_MAX bytes per transfer.

      Expose it in the block limits VPD page for both regular transfers
      and WRITE SAME.

      Reported-by: Ming Lei <ming.lei@canonical.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3c55fe2a13353b3ddf1db51c34ada23d161ee428
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:45 2014 +0100

      scsi: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0bd0adbe5b438cabbf02230dba1be4c209158f57
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:44 2014 +0100

      scsi: Fuse g_malloc(); memset() into g_malloc0()

      Coccinelle semantic patch:

          @@
          expression LHS, SZ;
          @@
          -       LHS = g_malloc(SZ);
          -       memset(LHS, 0, SZ);
          +       LHS = g_malloc0(SZ);

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1c3381af327b5f94a10942a3c25777a57fcdd85e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:43 2014 +0100

      scsi: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e42a92ae640dc22ecb4eb7705ddfe89aeadb92cc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:46 2014 +0100

      x86: Drop some superfluous casts from void *

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ab3ad07f89c7f9e03c17c98e1d1a02dbf61c605c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:45 2014 +0100

      x86: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4be34d1e2140b6d1be611c4bfa542c54c232520b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:44 2014 +0100

      x86: Fuse g_malloc(); memset() into g_malloc0()

      Coccinelle semantic patch:

          @@
          expression LHS, SZ;
          @@
          -       LHS = g_malloc(SZ);
          -       memset(LHS, 0, SZ);
          +       LHS = g_malloc0(SZ);

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 18fc80553420a3188336baeeb542e9f2d1ada13b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:43 2014 +0100

      x86: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 18cd2c17b5370369a886155c001da0a7f54bbcca
  Author: Wanpeng Li <wanpeng.li@linux.intel.com>
  Date:   Wed Dec 3 10:36:23 2014 +0800

      target-i386: get/set/migrate XSAVES state

      Add xsaves related definition, it also adds corresponding part
      to kvm_get/put, and vmstate.

      Signed-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 906b53a2de31a4612e94000f7cfe3a8e4b002f25
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 14:33:59 2014 +0100

      target-mips: kvm: do not use get_clock()

      Use the external qemu-timer API instead.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0bb0b2d2fe7f645ddaf1f0ff40ac669c9feb4aa1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Nov 24 15:54:43 2014 +0100

      target-i386: add feature flags for CPUID[EAX=0xd,ECX=1]

      These represent xsave-related capabilities of the processor, and KVM may
      or may not support them.

      Add feature bits so that they are considered by "-cpu ...,enforce", and use
      the new feature work instead of calling kvm_arch_get_supported_cpuid.

      Bit 3 (XSAVES) is not migratables because it requires saving MSR_IA32_XSS.
      Neither KVM nor any commonly available hardware supports it anyway.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e9af2fef242ce92f86d3d5c1a94c3199ff1e24c9
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Nov 20 22:10:58 2014 +0100

      coverity/s390x: avoid false positive in kvm_irqchip_add_adapter_route

      Paolo Bonzini reported that Coverity reports an uninitialized pad value.
      Let's use a designated initializer for kvm_irq_routing_entry to avoid
      this false positive. This is similar to kvm_irqchip_add_msi_route and
      other users of kvm_irq_routing_entry.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e6eef7c221634c942e9f586df84aae623aa06cd5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 10:05:28 2014 +0100

      valgrind/s390x: avoid false positives on KVM_SET_FPU ioctl

      struct kvm_fpu contains an alignment padding on s390x. Let's use a
      designated initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 076796f8fd27f4d014fe2efb6372f1cdc1df9a41
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:33:43 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_VCPU_EVENTS ioctl

      struct kvm_vcpu_events contains reserved fields. Let's use a
      designated initializer to avoid false positives in valgrind.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d19ae73e987ecc13a89c0830b501341103d06982
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:33:23 2014 +0100

      valgrind/i386: avoid false positives on KVM_GET_MSRS ioctl

      struct kvm_msrs contains a pad field. Let's use a designated
      initializer on the info part to avoid false positives from
      valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c7fe4b12984a36b87438080e48aff5e8f6d48ac9
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:27:34 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_MSRS ioctl

      struct kvm_msrs contains padding bytes. Let's use a designated
      initializer on the info part to avoid false positives from
      valgrind/memcheck. Do the same for generic MSRS, the TSC and
      feature control.

      We also need to zero out the reserved fields in the entries.
      We do this in kvm_msr_entry_set as suggested by Paolo. This
      avoids a big memset that a designated initializer on the
      full structure would do.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdfc8480c50a53d91aa9a513d23a84de0d5fbc86
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:23:41 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_XCRS ioctl

      struct kvm_xcrs contains padding bytes. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b0a0551283076c6f3e57cf2bdd525334009b2677
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:58:34 2014 +0200

      valgrind/i386: avoid false positives on KVM_SET_PIT ioctl

      struct kvm_pit_state2 contains pad fields. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5e0b7d8869a567d8f535f63510adf8f53ca438d3
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:55:49 2014 +0200

      valgrind/i386: avoid false positives on KVM_SET_CLOCK ioctl

      kvm_clock_data contains pad fields. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d229b985b504261369f2035936cc147c2606fa92
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:50:27 2014 +0200

      valgrind: avoid false positives in KVM_GET_DIRTY_LOG ioctl

      struct kvm_dirty_log contains padding fields that trigger false
      positives in valgrind. Let's use a designated initializer to avoid
      false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9fc0e2d8ac10c1bb08720b44a4cf9190f1ab4f9e
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Oct 31 13:38:19 2014 +0000

      vfio: use kvm_resamplefds_enabled()

      Use the kvm_resamplefds_enabled function

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f41389ae3c54bd5e2040e3f95a2872981c3ed965
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Oct 31 13:38:18 2014 +0000

      KVM_CAP_IRQFD and KVM_CAP_IRQFD_RESAMPLE checks

      Compute kvm_irqfds_allowed by checking the KVM_CAP_IRQFD extension.
      Remove direct settings in architecture specific files.

      Add a new kvm_resamplefds_allowed variable, initialized by
      checking the KVM_CAP_IRQFD_RESAMPLE extension. Add a corresponding
      kvm_resamplefds_enabled() function.

      A special notice for s390 where KVM_CAP_IRQFD was not immediatly
      advirtised when irqfd capability was introduced in the kernel.
      KVM_CAP_IRQ_ROUTING was advertised instead.

      This was fixed in "KVM: s390: announce irqfd capability",
      ebc3226202d5956a5963185222982d435378b899 whereas irqfd support
      was brought in 84223598778ba08041f4297fda485df83414d57e,
      "KVM: s390: irq routing for adapter interrupts".  Both commits
      first appear in 3.15 so there should not be any kernel
      version impacted by this QEMU modification.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9551ea6991cfb7c777f7943ad69b30d0a4fadac3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 21 00:48:09 2014 +0200

      target-i386: simplify AES emulation

      This patch simplifies the AES code, by directly accessing the newly added
      S-Box, InvS-Box and InvMixColumns tables instead of recreating them by
      using the AES_Te and AES_Td tables.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5eba5a6632ff4b0aaa8cb6c806fa95758518a28d
  Author: Drew DeVault <sircmpwn@gmail.com>
  Date:   Wed Oct 29 23:52:03 2014 -0600

      Add bootloader name to multiboot implementation

      The name is set to "qemu".

      Signed-off-by: Drew DeVault <sir@cmpwn.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Drew DeVault <sircmpwn@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 54600752a1dd67844c2cf3c467db562c39499838
  Merge: e0d3795 c4d4525
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 15 11:11:52 2014 +0000

      Merge remote-tracking branch 'remotes/rth/tags/x86-next-20141214' into staging

      Collected x86 patches

      # gpg: Signature made Sun 14 Dec 2014 22:54:28 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/x86-next-20141214:
        target-i386: fix icount processing for repz instructions
        target-i386: fbld instruction doesn't set minus sign
        target-i386: Wrong conversion infinity from float80 to int32/int64

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4d4525c38cd93cc5d1a743976eb25ac571d435f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Fri Dec 5 12:11:13 2014 +0300

      target-i386: fix icount processing for repz instructions

      TCG generates optimized code for i386 repz instructions in single step mode.
      It means that when ecx becomes 0, execution of the string instruction breaks
      immediately without an additional iteration for ecx==0 (which will only check
      ecx and set the flags). Omitting this iteration leads to different
      instructions counting in singlestep mode and in normal execution.
      This patch disables optimization of this last iteration for icount mode
      which should be deterministic.

      v2: inverted the condition and formatted the comment

      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 18b41f95d20ac6dbf918c73e704d4ca1fbc1a62f
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Wed Nov 12 08:53:45 2014 +0100

      target-i386: fbld instruction doesn't set minus sign

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ea32aaf1a72af102b855317b47a22e75ac2965a9
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Tue Nov 11 15:29:39 2014 +0300

      target-i386: Wrong conversion infinity from float80 to int32/int64

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit e0d3795654b7eb5b91b478bc7e6b717b192a8bce
  Merge: 99c9c3c 82595da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Dec 12 17:10:44 2014 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri 12 Dec 2014 17:09:56 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        linux-aio: simplify removal of completed iocbs from the list
        linux-aio: drop return code from laio_io_unplug and ioq_submit
        linux-aio: rename LaioQueue idx field to "n"
        linux-aio: track whether the queue is blocked
        linux-aio: queue requests that cannot be submitted
        block: drop unused bdrv_clear_incoming_migration_all() prototype
        block: Don't add trailing space in "Formating..." message
        qemu-iotests: Remove traling whitespaces in *.out
        block: vhdx - set .bdrv_has_zero_init to bdrv_has_zero_init_1
        iotests: Fix test 039
        iotests: Filter for "Killed" in qemu-io output
        qemu-io: Add sigraise command
        block: vhdx - change .vhdx_create default block state to ZERO
        block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec
        block: vhdx - remove redundant comments
        block/rbd: fix memory leak
        iotests: Add test for vmdk JSON file names
        vmdk: Fix error for JSON descriptor file names
        block migration: fix return value

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 82595da8dedde128d8004ec47441aeb720c08704
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:30 2014 +0100

      linux-aio: simplify removal of completed iocbs from the list

      There is no need to do another O(n) pass on the list; the iocb to
      split the list at is already available through the array we passed to
      io_submit.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de35464461cd8aa764ce03e8026202fe9861e29d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:29 2014 +0100

      linux-aio: drop return code from laio_io_unplug and ioq_submit

      These are unused.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8455ce053aa07eecdbc8da8db612cb58efc0734c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:28 2014 +0100

      linux-aio: rename LaioQueue idx field to "n"

      It does not identify an index in an array anymore.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 43f2376e096382df44d9322ae0cbdca89612d464
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:27 2014 +0100

      linux-aio: track whether the queue is blocked

      Avoid that unplug submits requests when io_submit reported that it
      couldn't accept more; at the same time, try more io_submit calls if it
      could handle the whole set of requests that were passed, so that the
      "blocked" flag is reset as soon as possible.

      After the previous patch, laio_submit already tried to avoid submitting
      requests to a blocked queue, by comparing s->io_q.idx with "==" instead
      of the more natural ">=".  Switch to the simpler expression now that we
      have the "blocked" flag.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 28b240877bbcdc8add61be227f429b536edd4653
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:26 2014 +0100

      linux-aio: queue requests that cannot be submitted

      Keep a queue of requests that were not submitted; pass them to
      the kernel when a completion is reported, unless the queue is
      plugged.

      The array of iocbs is rebuilt every time from scratch.  This
      avoids keeping the iocbs array and list synchronized.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b5cf2c1b0897506a40e0c420391875acc484792b
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Dec 10 12:02:17 2014 +0000

      block: drop unused bdrv_clear_incoming_migration_all() prototype

      The bdrv_clear_incoming_migration_all() function has not existed since
      commit 7ea2d269cb84ca7a2f4b7c3735634176f7c1dc35 ("block/migration:
      Disable cache invalidate for incoming migration").

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1418212937-22222-1-git-send-email-stefanha@redhat.com

  commit 43c5d8f8001eb467abf091c3e2a8aca3d1e5b522
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 9 15:38:04 2014 +0800

      block: Don't add trailing space in "Formating..." message

      Change the message printing code to output a separator for each option
      string before it instead of after, then we don't one more extra ' ' in
      the end.

      To update qemu-iotests output files, most of the times one would just
      copy the *.out.bad to *.out. With this change we will not have the
      space disliked by checkpatch.pl.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418110684-19528-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7486458c33cd3e5714368f181a5fea39c54444ca
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 9 15:38:03 2014 +0800

      qemu-iotests: Remove traling whitespaces in *.out

      This is simply:

        $ cd tests/qemu-iotests; sed -i -e 's/ *$//' *.out

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418110684-19528-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 85b712c9d5b873562c864e72f69cbf0d87d2fe40
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:45 2014 -0500

      block: vhdx - set .bdrv_has_zero_init to bdrv_has_zero_init_1

      Now that new VHDX images will default to BAT block states of
      PAYLOAD_BLOCK_ZERO, we can indicate that VHDX has zero init.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 5e582703e36450b9ca939e2e5c9fa3930030f7fe.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3f394472c5bca59de5cab9baafdff1984b0213a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:12 2014 +0100

      iotests: Fix test 039

      Test 039 used qemu-io -c abort for simulating a qemu crash; however,
      abort() generally results in a core dump and ulimit -c 0 is no reliable
      way of preventing that. Use "sigraise $(kill -l KILL)" instead to have
      it crash without a core dump.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9e0c3e8df5d1b12517d587d60b2fe587ea252ebe
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:11 2014 +0100

      iotests: Filter for "Killed" in qemu-io output

      _filter_qemu_io already filters out the process ID when qemu-io is
      aborted; the same should be done when it is killed.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0e82dc7bbd96f9b0fb76e5fe263ba04b15e68127
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:10 2014 +0100

      qemu-io: Add sigraise command

      abort() has the sometimes undesirable side-effect of generating a core
      dump. If that is not needed, SIGKILL has the same effect of abruptly
      crash qemu; without a core dump.

      Thus, -c abort is not always useful to simulate a qemu-io crash;
      therefore, this patch adds a new sigraise command which allows raising
      a signal.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 30af51ce7f4aebb37359367c65b7405451e70702
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:44 2014 -0500

      block: vhdx - change .vhdx_create default block state to ZERO

      The VHDX spec specifies that the default new block state is
      PAYLOAD_BLOCK_NOT_PRESENT for a dynamic VHDX image, and
      PAYLOAD_BLOCK_FULLY_PRESENT for a fixed VHDX image.

      However, in order to create space-efficient VHDX images with qemu-img
      convert, it is desirable to be able to set has_zero_init to true for
      VHDX.

      There is currently an option when creating VHDX images, to use block
      state ZERO for new blocks.  However, this currently defaults to 'off'.
      In order to be able to eventually set has_zero_init to true for VHDX,
      this needs to default to 'on'.

      This patch changes the default to 'on', and provides some help
      information to warn against setting it to 'off' when using qemu-img
      convert.

      [Max Reitz pointed out that a full stop was missing at the end of the
      VHDX_BLOCK_OPT_ZERO option help text.  I have added it.
      --Stefan]

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 85164899eacc86e150c3ceba793cf93b398dedd7.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a9d1e9daa5527101c0b2dcf1a57aab549075144a
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:43 2014 -0500

      block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec

      The 0.95 VHDX spec defined PAYLOAD_BLOCK_UNMAPPED to be 5.  The 1.00
      VHDX spec redefines PAYLOAD_BLOCK_UNMAPPED to be 3 instead.

      The original value of 5 is now an undefined state in the spec, but it
      should be safe to treat it the same and return zeros for data read.
      This way, we can maintain compatibility with any images out in the wild
      that may have been created in accordance to the 0.95 spec.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 8a4d2da73a8dbc04cde62bea782fc09ff84b1cf1.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0571df44a1bf810113037abd14c13afd448601c9
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:42 2014 -0500

      block: vhdx - remove redundant comments

      Minor cleanup.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: e8718ae3fd3e40a527e46a00e394973fbaab4d53.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9281dbe6535d79ecae121f6c3e620c25d55230e9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Dec 4 14:34:11 2014 +0800

      block/rbd: fix memory leak

      Variable local_err going out of scope
      leaks the storage it points to.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Message-id: 1417674851-6248-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 942764cc3286d9931ea58fce4e299813daeabfe4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 14:57:23 2014 +0100

      iotests: Add test for vmdk JSON file names

      Add a test for vmdk files which use a file with a JSON file name, and
      which then try to open extents. That should fail and the error message
      should at least try to look helpful.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417615043-26174-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5c98415b2a2fde5739aefe51793f969ce8bb2758
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 14:57:22 2014 +0100

      vmdk: Fix error for JSON descriptor file names

      If vmdk blindly tries to use path_combine() using bs->file->filename as
      the base file name, this will result in a bad error message for JSON
      file names when calling bdrv_open(). It is better to only try
      bs->file->exact_filename; if that is empty, bs->file->filename will be
      useless for path_combine() and an error should be emitted (containing
      bs->file->filename because desc_file_path (which is
      bs->file->exact_filename) is empty).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417615043-26174-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ebd9fbd7e102c533143c2c8372312b75c2b2678a
  Author: Gary R Hook <gary.hook@nimboxx.com>
  Date:   Tue Nov 25 17:30:02 2014 -0600

      block migration: fix return value

      Modify block_save_iterate() to return positive/zero/negative
      (success/not done/failure) return status. The computation of
      the blocks transferred (an int64_t) exceeds the size of an
      int return value.

      Signed-off-by: Gary R Hook <gary.hook@nimboxx.com>
      Reviewed-by: ChenLiang <chenliang88@huawei.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1416958202-15913-1-git-send-email-gary.hook@nimboxx.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 99c9c3cb24e566258a0a141178934f9cb5198842
  Merge: b141290 64baadc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 18:27:02 2014 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2014-12-11' into staging

      trivial patches for 2014-12-11

      # gpg: Signature made Thu 11 Dec 2014 18:13:58 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2014-12-11:
        Sort include/qemu/typedefs.h
        hpet: increase spelling precision
        pflash_cfi02.c: associate "cfi.pflash02" to "Storage devices" category
        vt82c686: fix coverity warning about out-of-bounds write
        virtio: remove useless declaration of virtio_net_init()
        qapi-schema: fix typo about change-vnc-password
        fw_cfg: remove superfluous blank line
        get_maintainer.pl: Remove the --git-chief-penguins option
        configure: Replace which(1) with "has"
        util: Use g_new() & friends where that makes obvious sense
        util: Fuse g_malloc(); memset() into g_new0()
        util: Drop superfluous conditionals around g_free()
        Drop superfluous conditionals around g_strdup()
        Drop superfluous conditionals around qemu_opts_del()
        usb: delete redundant brackets in usb_host_handle_control()
        virtio-bus: avoid breaking build when open DEBUG switch
        acpi-build: Make DPRINTF working for acpi-build
        acpi-build: adjust indention 8 -> 4 spaces
        target-s390x: fix possible out of bounds read
        qmp: fix typo in input-send-event examples

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 64baadc2726ae929660dd0c61a42e8d9f3ba1828
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Dec 11 11:46:36 2014 +0000

      Sort include/qemu/typedefs.h

      Mainly to make it less likely to conflict during merges.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 97c61fb78ad22bbedc34da2af1db2fd9aa1cbff9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Dec 11 09:18:29 2014 +0000

      hpet: increase spelling precision

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b141290478f847ecaa25561f3b31fbf1ddde95e6
  Merge: 7c38433 25f2895
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 16:47:23 2014 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141211' into staging

      target-arm queue:
       * pass semihosting exit code out to system
       * more TrustZone support code (still not enabled yet)
       * allow user to direct semihosting to gdb or native explicitly
         rather than always auto-guessing the destination
       * fix memory leak in realview_init
       * fix coverity warning in hw/arm/boot
       * get state migration working for AArch64 CPUs
       * check errors in kvm_arm_reset_vcpu

      # gpg: Signature made Thu 11 Dec 2014 12:16:19 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20141211: (33 commits)
        target-arm: Check error conditions on kvm_arm_reset_vcpu
        target-arm: Support save/load for 64 bit CPUs
        target-arm/kvm: make reg sync code common between kvm32/64
        arm_gic_kvm: Tell kernel about number of IRQs
        hw/arm/boot: fix uninitialized scalar variable warning reported by coverity
        hw/arm/realview.c: Fix memory leak in realview_init()
        target-arm: make MAIR0/1 banked
        target-arm: make c13 cp regs banked (FCSEIDR, ...)
        target-arm: make VBAR banked
        target-arm: make PAR banked
        target-arm: make IFAR/DFAR banked
        target-arm: make DFSR banked
        target-arm: make IFSR banked
        target-arm: make DACR banked
        target-arm: make TTBCR banked
        target-arm: make TTBR0/1 banked
        target-arm: make CSSELR banked
        target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI
        target-arm: add SCTLR_EL3 and make SCTLR banked
        target-arm: add MVBAR support
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c3843332db39c2f27405b882a505144d62b3664
  Merge: a09f2d1 d899d2e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:36:32 2014 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Wed 10 Dec 2014 09:31:53 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (73 commits)
        vmdk: Set errp on failures in vmdk_open_vmdk4
        vmdk: Remove unnecessary initialization
        vmdk: Check descriptor file length when reading it
        vmdk: Clean up descriptor file reading
        vmdk: Fix comment to match code of extent lines
        vmdk: Use g_random_int to generate CID
        block: Use g_new0() for a bit of extra type checking
        block: remove BLOCK_OPT_NOCOW from vpc_create_opts
        block: remove BLOCK_OPT_NOCOW from vdi_create_opts
        qemu-iotests: Skip 099 for VMDK subformats with desc file
        block/raw-posix: Fix ret in raw_open_common()
        qcow2: Respect bdrv_truncate() error
        qcow2: Flushing the caches in qcow2_close may fail
        qcow2: Prevent numerical overflow
        iotests: Add test for unsupported image creation
        iotests: Only kill NBD server if it runs
        qemu-img: Check create_opts before image amendment
        qemu-img: Check create_opts before image creation
        block: Check create_opts before image creation
        block/nfs: Add create_opts
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25f2895e0e437a3548f9794846001fb5d5ab853d
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm: Check error conditions on kvm_arm_reset_vcpu

      When resetting a VCPU we currently call both kvm_arm_vcpu_init() and
      write_kvmstate_to_list(), both of which can fail, but we never check the
      return value.

      The only choice here is to print an error an exit if the calls fail.

      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418039630-11773-1-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a7130a3ef9b8dc3091a0700abb61e2926e89e916
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm: Support save/load for 64 bit CPUs

      For migration to work on 64 bit CPUs, we need to include both
      the 64-bit integer register file and the PSTATE. Everything
      else is either stored in the same place as existing 32-bit CPU
      state or handled by the generic sysreg mechanism.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1417788683-4038-3-git-send-email-peter.maydell@linaro.org

  commit 38df27c8a7ef9877583a46e74d99181c3224e078
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm/kvm: make reg sync code common between kvm32/64

      Before we launch a guest we query KVM for the list of "co-processor"
      registers it knows about. This is used to synchronize system
      register state for the bulk of coprocessor/system registers.
      Move this code from the 32-bit specific vcpu init function into
      a common routine and call it also from the 64-bit vcpu init.

      This allows system registers to migrate correctly when using
      KVM, and also permits QEMU code to see the current KVM register
      state (which will be needed to support big-endian guests, since
      the virtio endianness callback must check for some system register
      settings).

      Since vcpu reset also has to sync registers, we move the
      32 bit kvm_arm_reset_vcpu() into common code as well and
      share it with the 64 bit version.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      [PMM: just copy the 32-bit code rather than improving it along the way;
       don't share reg_syncs_via_tuple_list() between 32 and 64 bit;
       tweak function names; move reset]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 72149414e25784de60b821fe67c56108a5b03ce1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      arm_gic_kvm: Tell kernel about number of IRQs

      Newer kernels support a device attribute on the GIC which allows us to
      tell it how many IRQs this GIC instance is configured with; use it, if
      it exists.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1417718679-1071-1-git-send-email-peter.maydell@linaro.org

  commit a554ecb49d0021fd8bb0fd4f2f6be807b3c8b54f
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      hw/arm/boot: fix uninitialized scalar variable warning reported by coverity

      Coverity reports the 'size' may be used uninitialized, but that can't happen,
      because the caller has checked "if (binfo->dtb_filename || binfo->get_dtb)"
      before call 'load_dtb'.

      Here we simply remove the 'if (binfo->get_dtb)' to satisfy coverity.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Message-id: 1416826240-12368-1-git-send-email-zhang.zhanghailiang@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1ab03af890b2b6c5bafc9344b7fe05b392180a5
  Author: Nikita Belov <zodiac@ispras.ru>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      hw/arm/realview.c: Fix memory leak in realview_init()

      Variable 'ram_lo' is allocated unconditionally, but used only in some cases.
      When it is unused pointer will be lost at function exit, resulting in a
      memory leak. Allocate memory for 'ram_lo' only if it is needed.

      Valgrind output:
      ==16879== 240 bytes in 1 blocks are definitely lost in loss record 6,033 of 7,018
      ==16879==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16879==    by 0x33D2CE: malloc_and_trace (vl.c:2804)
      ==16879==    by 0x509E610: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
      ==16879==    by 0x288836: realview_init (realview.c:55)
      ==16879==    by 0x28988C: realview_pb_a8_init (realview.c:375)
      ==16879==    by 0x341426: main (vl.c:4413)

      Signed-off-by: Nikita Belov <zodiac@ispras.ru>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be693c87e440e671ed913784554384349ce8331d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make MAIR0/1 banked

      Added CP register info entries for the ARMv7 MAIR0/1 secure banks.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-26-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54bf36ed351c526cde0c853079f9ff1ab7e2ff89
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make c13 cp regs banked (FCSEIDR, ...)

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      FCSEIDR, CONTEXTIDR, TPIDRURW, TPIDRURO and TPIDRPRW have a secure
      and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-25-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb6c91ba2bb0b1c1b8662ceeeeb9474a025f9a6b
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make VBAR banked

      When EL3 is running in Aarch32 (or ARMv7 with Security Extensions)
      VBAR has a secure and a non-secure instance, which are mapped to
      VBAR_EL1 and VBAR_EL3.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-24-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 01c097f7960b330c4bf038d34bae17ad6c1ba499
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make PAR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      PAR has a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-23-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b848ce2b9cbd38da3f2530fd93dba76dba0621c0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make IFAR/DFAR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      IFAR and DFAR have a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-22-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4a7e2d7315bd2ce28e49ccd0bde73eabdfd7437b
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make DFSR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      DFSR has a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-21-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 88ca1c2d70523486a952065f3ed7b8fc823b5863
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make IFSR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      IFSR has a secure and a non-secure instance.  Adds IFSR32_EL2 definition and
      storage.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-20-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0c17d68c1d3d6c35f37f5692042d2edb65c8bcc0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make DACR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      DACR has a secure and a non-secure instance.  Adds definition for DACR32_EL2.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-19-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11f136ee25232a00f433cefe98ee33cd614ecccc
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make TTBCR banked

      Adds secure and non-secure bank register suport for TTBCR.
      Added new struct to compartmentalize the TCR data and masks.  Removed old
      tcr/ttbcr data and added a 4 element array of the new structs in cp15.  This
      allows for one entry per EL.  Added a CP register definition for TCR_EL3.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-18-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7dd8c9af0d9d18fb3e54a4843b3bb1398bd330bc
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make TTBR0/1 banked

      Adds secure and non-secure bank register suport for TTBR0 and TTBR1.
      Changes include adding secure and non-secure instances of ttbr0 and ttbr1 as
      well as a CP register definition for TTBR0_EL3.  Added a union containing
      both EL based array fields and secure and non-secure fields mapped to them.
      Updated accesses to use A32_BANKED_CURRENT_REG_GET macro.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-17-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b85a1fd61c4d72c7928cd9b70f9f59fb2895936d
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: make CSSELR banked

      Rename CSSELR (cache size selection register) and add secure
      instance (AArch32).

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-16-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6e8801f9dea9e10449f4fd7d85dbe8cab708a686
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI

      Add checks of SCR AW/FW bits when performing writes of CPSR.  These SCR bits
      are used to control whether the CPSR masking bits can be adjusted from
      non-secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-15-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 137feaa9a1622620adf19c0b707883dd990738e2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add SCTLR_EL3 and make SCTLR banked

      Implements SCTLR_EL3 and uses secure/non-secure instance when
      needed.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-14-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e89e51a17ea0d8aef9bf9b766c98f963e835fbf2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add MVBAR support

      Use MVBAR register as exception vector base address for
      exceptions taken to CPU monitor mode.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-13-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 144634ae6c1618dcee6aced9c0d4427844154091
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add SDER definition

      Added CP register defintions for SDER and SDER32_EL3 as well as cp15.sder for
      register storage.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-12-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 770225764f831031d2e1453f69c365eb1b647d87
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add NSACR register

      Implements NSACR register with corresponding read/write functions
      for ARMv7 and ARMv8.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-11-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de38d23b542efca54108ef28bcc0efe96f378d2e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: implement IRQ/FIQ routing to Monitor mode

      SCR.{IRQ/FIQ} bits allow to route IRQ/FIQ exceptions to monitor CPU
      mode. When taking IRQ exception to monitor mode FIQ exception is
      additionally masked.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-10-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0f1a3b2470d798ad5335eb9d6236f02ff64e31a8
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: move AArch32 SCR into security reglist

      Define a new ARM CP register info list for the ARMv7 Security Extension
      feature. Register that list only for ARM cores with Security Extension/EL3
      support. Moving AArch32 SCR into Security Extension register group.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3f3c82a57d128aa3ec823aa8032867c3a6e2e795
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: insert AArch32 cpregs twice into hashtable

      Prepare for cp register banking by inserting every cp register twice,
      once for secure world and once for non-secure world.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51a79b039728277e35fd19f7a7b4bc6cb323697f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add secure state bit to CPREG hash

      Added additional NS-bit to CPREG hash encoding.  Updated hash lookup
      locations to specify hash bit currently set to non-secure.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-7-git-send-email-greg.bellows@linaro.org
      [PMM: fix uses of ENCODE_CP_REG in kvm32.c to add extra argument]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c3e302606253a17568dc3ef30238f102468f7ee1
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add CPREG secure state support

      Prepare ARMCPRegInfo to support specifying two fieldoffsets per
      register definition. This will allow us to keep one register
      definition for banked registers (different offsets for secure/
      non-secure world).

      Also added secure state tracking field and flags.  This allows for
      identification of the register info secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-6-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3f342b9e0e64ad681cd39840bfa75ef12d2807c1
  Author: Sergey Fedorov <s.fedorov@samsung.com>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add non-secure Translation Block flag

      This patch is based on idea found in patch at
      git://github.com/jowinter/qemu-trustzone.git
      f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by
      Johannes Winter <johannes.winter@iaik.tugraz.at>.

      The TBFLAG captures the SCR NS secure state at the time when a TB is created so
      the correct bank is accessed on system register accesses.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea30a4b824ecc3c829b70eb9999ac5457dc5790f
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add banked register accessors

      If EL3 is in AArch32 state certain cp registers are banked (secure and
      non-secure instance). When reading or writing to coprocessor registers
      the following macros can be used.

      - A32_BANKED macros are used for choosing the banked register based on provided
        input security argument.  This macro is used to choose the bank during
        translation of MRC/MCR instructions that are dependent on something other
        than the current secure state.
      - A32_BANKED_CURRENT macros are used for choosing the banked register based on
        current secure state.  This is NOT to be used for choosing the bank used
        during translation as it breaks monitor mode.

      If EL3 is operating in AArch64 state coprocessor registers are not
      banked anymore. The macros use the non-secure instance (_ns) in this
      case, which is architecturally mapped to the AArch64 EL register.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0eeb17d618361a0f4faddc160e33598b23da6dd5
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add async excp target_el function

      Adds a dedicated function and a lookup table for determining the target
      exception level of IRQ and FIQ exceptions.  The lookup table is taken from the
      ARMv7 and ARMv8 specification exception routing tables.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57e3a0c7cb0ac2f0288890482e0a463adce2080a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: extend async excp masking

      This patch extends arm_excp_unmasked() to use lookup tables for determining
      whether IRQ and FIQ exceptions are masked.  The lookup tables are based on the
      ARMv8 and ARMv7 specification physical interrupt masking tables.

      If EL3 is using AArch64 IRQ/FIQ masking is ignored in all exception levels
      other than EL3 if SCR.{FIQ|IRQ} is set to 1 (routed to EL3).

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a38bb0792ca8b4082d81884a6cb25fa0d334b4a6
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      Add the "-semihosting-config" option.

      The usual semihosting behaviour is to process the system calls locally and
      return; unfortuantelly the initial implementation dinamically changed the
      target to GDB during debug sessions, which, for the usual arm-none-eabi-gdb,
      is not implemented. The result was that during debug sessions the semihosting
      calls were discarded.

      This patch adds a configuration variable and an option to set it on the
      command line:

          -semihosting-config [enable=on|off,]target=native|gdb|auto

      This option enables semihosting and defines where the semihosting calls will
      be addressed, to QEMU ('native') or to GDB ('gdb'). The default is auto, which
      means 'gdb' during debug sessions and 'native' otherwise.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Message-id: 1416341957-9796-1-git-send-email-ilg@livius.net
      [PMM: moved declaration and definition of semihosting_target to
       gdbstub.h and gdbstub.c to fix build failure on linux-user]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1ecc3a2df168034b8ab33ff5ba6434ce3593dbb5
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      Pass semihosting exit code back to system.

      In order to run unit tests under semihosting, it is necessary to pass the
      application exit code back to the system.

      ARM defines only the code to be used for non-error application exit
      (ADP_Stopped_ApplicationExit), all other codes should return non-zero
      exit codes.

      This patch checks if the application code passed via TARGET_SYS_EXIT is
      ADP_Stopped_ApplicationExit, and return 0, otherwise return 1.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a09f2d16f6b9f5bcdedb4d116bb54da86e9a3f6e
  Merge: 67a5eeb 328f1f0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 11:41:11 2014 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20141210' into staging

      TriCore BOL, BRC, BRN, BRR, RC, RCPW, RCRR, RCR, RLC and RCR insn added

      # gpg: Signature made Wed 10 Dec 2014 11:21:58 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20141210:
        target-tricore: Add instructions of RCR opcode format
        target-tricore: Add instructions of RLC opcode format
        target-tricore: Add instructions of RCPW, RCRR and RCRW opcode format
        target-tricore: Make TRICORE_FEATURES implying others.
        target-tricore: Add instructions of RC opcode format
        target-tricore: Add instructions of BRR opcode format
        target-tricore: Add instructions of BRN opcode format
        target-tricore: Add instructions of BRC opcode format
        target-tricore: Add instructions of BOL opcode format

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 67a5eebca1ac15442f06096977381a70a403bc5b
  Merge: 7fb8da2 4394838
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 11:19:57 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20141210-1' into staging

      vnc-enc-tight fix, keymaps code style.

      # gpg: Signature made Wed 10 Dec 2014 09:24:33 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20141210-1:
        keymaps: correct keymaps.c following Qemu coding style
        vnc-enc-tight: fix Arguments in wrong order

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit df6f93182a898c295d90dd502d49818c6bb98200
  Author: Antony Pavlov <antonynpavlov@gmail.com>
  Date:   Sun Dec 7 21:20:45 2014 +0300

      pflash_cfi02.c: associate "cfi.pflash02" to "Storage devices" category

      Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 328f1f0f08f1aa303eef7493bd7c3d97a8d9636a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Nov 2 17:31:45 2014 +0000

      target-tricore: Add instructions of RCR opcode format

      Add instructions of RCR opcode format.
      Add helper for madd32/64_ssov and madd32/64_suov.
      Add helper for msub32/64_ssov and msub32/64_suov.
      Add microcode generator function madd/msub for 32bit and 64bit, which calculate a mul and a add/sub.
      OPC2_32_RCR_MSUB_U_32 -> OPC2_32_RCR_MSUB_U_32.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2b2f7d97d856a4e7020d881ec1e6e60be64d0ab6
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 30 12:06:53 2014 +0000

      target-tricore: Add instructions of RLC opcode format

      Add instructions of RLC opcode format.
      Add helper psw_write/read.
      Add microcode generator gen_mtcr/mfcr, which loads/stores a value to a core special function register, which are defined in csfr.def

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ed51626066ea40092335f653780b6d1ca22c574a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Oct 29 19:48:18 2014 +0000

      target-tricore: Add instructions of RCPW, RCRR and RCRW opcode format

      Add instructions of RCPW, RCRR and RCRW opcode format.
      Add microcode generator function gen_insert.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 47e04430ed3e6ab835f023a5c84381ca2ce9f4d8
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 13 14:17:08 2014 +0000

      target-tricore: Make TRICORE_FEATURES implying others.

      Since all the TriCore instructionsets are subsets of each other (1.3 C 1.3.1 C 1.6),
      make the features implying each other, e.g 1.6 also has 1.3.1 and 1.3. This way
      we only need to check our features for the instructionset, where a instruction was first introduced.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0974257ed58ff3e9512d74ffa5b4039bbec49b2d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Oct 26 21:49:41 2014 +0000

      target-tricore: Add instructions of RC opcode format

      Add instructions of RC opcode format.
      Add helper for mul, sha, absdif with signed saturation on overflow.
      Add helper for add, sub, mul with unsigned saturation on overflow.
      Add microcode generator functions:
          * gen_add_CC, which calculates the carry bit.
          * gen_addc_CC, which adds the carry bit to the add and calculates the carry bit.
          * gen_absdif, which calculates the absolute difference.
          * gen_mul_i64s/u, which mul two 32 bits val into one 64bit reg.
          * gen_sh_hi, which shifts two 16bit words in one reg.
          * gen_sha_hi, which does a arithmetic shift on two 16bit words.
          * gen_sh_cond, which shifts left a reg by one and writes the result of cond into the lsb.
          * gen_accumulating_cond, which ands/ors/xors the result of cond of the lsbs
            with the lsb of the result.
          * gen_eqany_bi/hi, which checks ever byte/hword on equality.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit a68e0d547f042f1d75f4d56ca5b6c4cc719d7077
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 23 12:18:02 2014 +0100

      target-tricore: Add instructions of BRR opcode format

      Add instructions of BRR opcode format.
      Add MASK_OP_BRR_DISP15_SEXT.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 83c1bb1868848912f3d5516880e937cb247dfcd1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Oct 17 17:46:29 2014 +0100

      target-tricore: Add instructions of BRN opcode format

      Add instructions of BRN opcode format.
      Add MASK_OP_BRN_DISP15_SEXT.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fc2ef4a391c39688d35c7f78cec6a20d552e5a3b
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Oct 17 17:29:01 2014 +0100

      target-tricore: Add instructions of BRC opcode format

      Add instructions of BRC opcode format.
      Fixed OP2_BRC_JGE -> OP2_32_BRC_JGE

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 3fb763cb55c282a686e22b7639ff6615d527bb10
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 16 21:07:29 2014 +0100

      target-tricore: Add instructions of BOL opcode format

      Add instructions of BOL opcode format.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit d899d2e248b900c53dd9081bde9f110e05747433
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:34 2014 +0800

      vmdk: Set errp on failures in vmdk_open_vmdk4

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-7-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9aeecbbc62ce52a94b2621a0d53567b5d4ed915d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:33 2014 +0800

      vmdk: Remove unnecessary initialization

      It will be assigned to the return value of vmdk_read_desc.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-6-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 03c3359dfc490eaf922f88955d6a8cc51a37ce92
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:32 2014 +0800

      vmdk: Check descriptor file length when reading it

      Since a too small file cannot be a valid VMDK image, and also since the
      buffer's first 4 bytes will be unconditionally examined by
      vmdk_open_sparse, let's error out the small file case to be clear.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Message-id: 1417649314-13704-5-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73b7bcad439e0edaced05049897090cc10d84b5b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:31 2014 +0800

      vmdk: Clean up descriptor file reading

      Zeroing a buffer that will be filled right after is not necessary, and
      allocating a power of two + 1 is naughty.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-4-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a3e0bc370de9274170b82f48b0393204c3fb43b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:30 2014 +0800

      vmdk: Fix comment to match code of extent lines

      commit 04d542c8b (vmdk: support vmfs files) added support of VMFS extent
      type but the comment above the changed code is left out. Update the
      comment so they are consistent.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Message-id: 1417649314-13704-3-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e5dc64b8ff09cc4c186273e4461c7479739db2ae
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:29 2014 +0800

      vmdk: Use g_random_int to generate CID

      This replaces two "time(NULL)" invocations with "g_random_int()".
      According to VMDK spec, CID "is a random 32‐bit value updated the first
      time the content of the virtual disk is modified after the virtual disk
      is opened". Using "seconds since epoch" is just a "lame way" to generate
      it, and not completely safe because of the low precision.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-2-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3ba235a02284c39b34a68a2a588508ffb52a7b55
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 13:55:09 2014 +0100

      block: Use g_new0() for a bit of extra type checking

      g_new(T, 1) is safer than g_malloc(sizeof(T)), because it returns T *
      rather than void *, which lets the compiler catch more type errors.

      Missed in commit 02c4f26.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1417697709-13087-1-git-send-email-armbru@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 625fa9fe6fbf9d45607d2c0144e1a44712d0cefc
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Wed Dec 3 10:30:08 2014 -0500

      block: remove BLOCK_OPT_NOCOW from vpc_create_opts

      In commit fef6070, the need for NOCOW was removed from the vpc driver,
      as we removed the the posix calls.  However, the BLOCK_OPT_NOCOW was not
      removed from vpc_create_opts.  This was a mistake - remove the opt from
      there as well.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 8ba076fa725fed681cde7d8afc4fb239ae06a9c6.1417620301.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0d0d7f47b4c0fa4908e1747a94f96d4d9668f4aa
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Wed Dec 3 10:30:07 2014 -0500

      block: remove BLOCK_OPT_NOCOW from vdi_create_opts

      In commit 7074786, the need for NOCOW was removed from the vdi driver,
      as we removed the the posix calls.  However, the BLOCK_OPT_NOCOW was not
      removed from vdi_create_opts.  This was a mistake - remove the opt from
      there as well.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: e189364de11929d8fa04722f5d845de0a9834d44.1417620301.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0fc9b0d16265033403334a5fa7863dde6129a3cd
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Dec 3 09:49:30 2014 +0800

      qemu-iotests: Skip 099 for VMDK subformats with desc file

      VMDK extent parsing code doesn't handle the JSON file name, so the case
      fails for these subformats. Disabled them.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417571370-19495-1-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 01212d4ed68fc8daa29062a9a38650cf8febe392
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:53 2014 +0100

      block/raw-posix: Fix ret in raw_open_common()

      The return value must be negative on error; there is one place in
      raw_open_common() where errp is set, but ret remains 0. Fix it.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6a69b9620ac1562a067990d87284a85552bfd61b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:52 2014 +0100

      qcow2: Respect bdrv_truncate() error

      bdrv_truncate() may fail and qcow2_write_compressed() should return the
      error code in that case.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3b5e14c76a6bb142bf250ddf99e24a0ac8c7bc12
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:51 2014 +0100

      qcow2: Flushing the caches in qcow2_close may fail

      qcow2_cache_flush() may fail; if one of the caches failed to be flushed
      successfully to disk in qcow2_close() the image should not be marked
      clean, and we should emit a warning.

      This breaks the (qcow2-specific) iotests 026, 071 and 089; change their
      output accordingly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 11c89769dc3e638ef72915d97058411ddf79b64b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:50 2014 +0100

      qcow2: Prevent numerical overflow

      In qcow2_alloc_cluster_offset(), *num is limited to
      INT_MAX >> BDRV_SECTOR_BITS by all callers. However, since remaining is
      of type uint64_t, we might as well cast *num to that type before
      performing the shift.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2247798d13e5295a097da0a42f9d0d70d88690a4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:49 2014 +0100

      iotests: Add test for unsupported image creation

      Add a test for creating and amending images (amendment uses the creation
      options) with formats not supporting creation over protocols not
      supporting creation.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f798068c565918ead63218d083ff814b7635be72
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:48 2014 +0100

      iotests: Only kill NBD server if it runs

      There may be NBD tests which do not create a sample image and simply
      test whether wrong usage of the protocol is rejected as expected. In
      this case, there will be no NBD server and trying to kill it during
      clean-up will fail.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b2439d26f078c826e5e06b34d978a6f6d5c7c56f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:47 2014 +0100

      qemu-img: Check create_opts before image amendment

      The image options which can be amended are described by the .create_opts
      field for every driver. This field must therefore be non-NULL so that
      anything can be amended in the first place. Check that this holds true
      before going into qemu_opts_create() (because if .create_opts is NULL,
      the create_opts pointer in img_amend() will be NULL after
      qemu_opts_append()).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f75613cf2488a37fb8019bc32a06ddbcd477d0ce
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:46 2014 +0100

      qemu-img: Check create_opts before image creation

      If a driver supports image creation, it needs to set the .create_opts
      field. We can use that to make sure .create_opts for both drivers
      involved is not NULL for the target image in qemu-img convert, which is
      important so that the create_opts pointer in img_convert() is not NULL
      after the qemu_opts_append() calls and when going into
      qemu_opts_create().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6149724080af7b3d5d61eac8942655e6d212783
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:45 2014 +0100

      block: Check create_opts before image creation

      If a driver supports image creation, it needs to set the .create_opts
      field. We can use that to make sure .create_opts for both drivers
      involved is not NULL in bdrv_img_create(), which is important so that
      the create_opts pointer in that function is not NULL after the
      qemu_opts_append() calls and when going into qemu_opts_create().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fd752801ae1cc729359a37f29e32265de6948d37
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:44 2014 +0100

      block/nfs: Add create_opts

      The nfs protocol driver is capable of creating images, but did not
      specify any creation options. Fix it.

      A way to test this issue is the following:

      $ qemu-img create -f nfs nfs://127.0.0.1/foo.qcow2 64M

      Without this patch, it segfaults. With this patch, it does not. However,
      this is not something that should really work; qemu-img should check
      whether the parameter for the -f option (and -O for convert) is indeed a
      format, and error out if it is not. Therefore, I am not making it an
      iotest.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1bcb15cf776a57e8963072c1919a59a90aea8e94
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:43 2014 +0100

      block/vvfat: qcow driver may not be found

      Although virtually impossible right now, bdrv_find_format("qcow") may
      fail. The vvfat block driver should heed that case.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ef8104378c4a0497be079e48ee5ac5a89c68f978
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:42 2014 +0100

      block: Omit bdrv_find_format for essential drivers

      We can always assume raw, file and qcow2 being available; so do not use
      bdrv_find_format() to locate their BlockDriver objects but statically
      reference the respective objects.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5f535a941e52229d81e55603eb69b2bd449b937a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:41 2014 +0100

      block: Make essential BlockDriver objects public

      There are some block drivers which are essential to QEMU and may not be
      removed: These are raw, file and qcow2 (as the default non-raw format).
      Make their BlockDriver objects public so they can be directly referenced
      throughout the block layer without needing to call bdrv_find_format()
      and having to deal with an error at runtime, while the real problem
      occurred during linking (where raw, file or qcow2 were not linked into
      qemu).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b89689f5b2d2686ef83d2be0c854a5ef6e961e13
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 10:15:04 2014 +0100

      iotests: Specify qcow2 format for qemu-io in 059

      There are two instances of iotest 059 using qemu-io on a qcow2 image. As
      of "qemu-iotests: Use qemu-io -f $IMGFMT" the iotests can no longer rely
      on $QEMU_IO doing probing, therefore the qcow2 format has to be
      specified explicitly here.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d20051856cd2fa8f10fed2d2a0b2751de5f7b20d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Dec 3 13:21:32 2014 +0100

      ide: Check validity of logical block size

      Our IDE emulation can't handle logical block sizes other than 512. Check
      for it.

      The original assumption was that other values would silently be ignored
      (which is bad enough), but it's not quite true: The physical block size
      is exposed in IDENTIFY DEVICE as a multiple of the logical block size.
      Setting a logical block size therefore also corrupts the physical block
      size (4096/4096 doesn't silently downgrade to 4096/512, but 512/512).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit be0677a93cd4578122955db3c377c3de7e81fcd0
  Author: Anton Blanchard <anton@samba.org>
  Date:   Thu Nov 27 14:39:21 2014 +1100

      nvme: 64kB page size fixes

      Initialise our maximum page size capability to 64kB and increase
      the page_size variable from 16 to 32 bits.

      Signed-off-by: Anton Blanchard <anton@samba.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d11032315ac652d9283ffada7f9b679f368ee175
  Author: Michael Mueller <mimu@linux.vnet.ibm.com>
  Date:   Thu Nov 27 17:28:01 2014 +0100

      qemu-iotests: 082: Filter the real disk size

      The real on-disk size of an image depends on things like the host
      filesystem. _img_info already filters it out, use the function in 082.

      Signed-off-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e800e5d4e25192a6783c1a17e4df8261d9357e01
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 27 15:03:53 2014 +0100

      qemu-iotests: 060: Filter the real disk size

      The real on-disk size of an image depends on things like the host
      filesystem. _img_info already filters it out, use the function in 060.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit a56ebc6ba4be1b6060d87b115c48ff57236c8def
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Nov 28 11:38:03 2014 +0000

      block: do not use get_clock()

      Use the external qemu-timer API instead.

      No one else should be calling cpu_get_clock(), get_clock() and
      get_clock_realtime() directly; they are internal functions and they
      should be confined to qemu-timer.c and cpus.c (where the icount
      implementation resides).  All accesses should go through
      qemu_clock_get_ns.

      Cc: kwolf@redhat.com
      Cc: stefanha@redhat.com
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1417010463-3527-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c5f6e493bb5339d244eae5d3f21c5b6d73996739
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:42 2014 +0100

      block: Don't probe for unknown backing file format

      If a qcow2 image specifies a backing file format that doesn't correspond
      to any format driver that qemu knows, we shouldn't fall back to probing,
      but simply error out.

      Not looking up the backing file driver in bdrv_open_backing_file(), but
      just filling in the "driver" option if it isn't there moves us closer to
      the goal of having everything in QDict options and gets us the error
      handling of bdrv_open(), which correctly refuses unknown drivers.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-4-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8884dd1bbc5ce42cd657ffcbef3a477443468974
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:41 2014 +0100

      qcow2.py: Add required padding for header extensions

      The qcow2 specification requires that the header extension data be
      padded to round up the extension size to the next multiple of 8 bytes.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-3-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2ebafc854d109ff09b66fb4dd62c2c53fc29754a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:40 2014 +0100

      qcow2: Fix header extension size check

      After reading the extension header, offset is incremented, but not
      checked against end_offset any more. This way an integer overflow could
      happen when checking whether the extension end is within the allowed
      range, effectively disabling the check.

      This patch adds the missing check and a test case for it.

      Cc: qemu-stable@nongnu.org
      Reported-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3dc7ca3c97dff8732e38828b38e0497efba0fedf
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:49:00 2014 +0000

      blockdev: check for BLOCK_OP_TYPE_INTERNAL_SNAPSHOT

      The BLOCK_OP_TYPE_INTERNAL_SNAPSHOT op blocker exists but was never
      used!  Let's fix that so internal snapshots can be blocked.

      [Fixed s/external/internal/ typo as pointed out by Paolo Bonzini and Max
      Reitz.
      --Stefan]

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-5-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5d6e96efb81f94f39a50110e8178584fb1817f66
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:59 2014 +0000

      blockdev: acquire AioContext in QMP 'transaction' actions

      The transaction QMP command performs operations atomically on a group of
      drives.  This command needs to acquire AioContext in order to work
      safely when virtio-blk dataplane IOThreads are accessing drives.

      The transactional nature of the command means that actions are split
      into prepare, commit, abort, and clean functions.  Acquire the
      AioContext in prepare and don't release it until one of the other
      functions is called.  This prevents the IOThread from running the
      AioContext before the transaction has completed.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-4-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73f1f7564d58963fc692334bcf0c529e1e3536fb
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:58 2014 +0000

      blockdev: drop unnecessary DriveBackupState field assignment

      drive_backup_prepare() assigns DriveBackupState fields to NULL in the
      error path.  This is unnecessary because the DriveBackupState is
      allocated using g_malloc0() and other functions like
      external_snapshot_prepare() already rely on this.

      Do not explicitly assign fields to NULL so that the error path is
      concise and does not require modification when fields are added to
      DriveBackupState.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b756b9ce8a81cd0d95ae691cee541a149463c8c9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:57 2014 +0000

      blockdev: update outdated qmp_transaction() comments

      Originally the transaction QMP command was just for taking snapshots.
      The command became more general when drive-backup and abort were added.

      It is more accurate to say the command is about performing operations on
      an atomic group than to say it is about snapshots.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 00e047926e0e90cf25e39d6a5b3b1e4f3701d69c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:14 2014 +0100

      qemu-iotests: Test writing non-raw image headers to raw image

      This is forbidden if the raw driver was probed.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-10-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d71a8b0686b87e54587a2219ab0e502f0a889839
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:13 2014 +0100

      qemu-iotests: Fix stderr handling in common.qemu

      The original intention was to pipe stderr of qemu into $fifo_out.
      However, the redirections were specified in the wrong order for this.
      This patch fixes it.

      Now qemu's output on stderr can be retrieved with _send_qemu_cmd, which
      applies several useful filters on the output that were missing before.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-9-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 38f3ef574b48afc507c6f636ae4393fd36bda072
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:12 2014 +0100

      raw: Prohibit dangerous writes for probed images

      If the user neglects to specify the image format, QEMU probes the
      image to guess it automatically, for convenience.

      Relying on format probing is insecure for raw images (CVE-2008-2004).
      If the guest writes a suitable header to the device, the next probe
      will recognize a format chosen by the guest.  A malicious guest can
      abuse this to gain access to host files, e.g. by crafting a QCOW2
      header with backing file /etc/shadow.

      Commit 1e72d3b (April 2008) provided -drive parameter format to let
      users disable probing.  Commit f965509 (March 2009) extended QCOW2 to
      optionally store the backing file format, to let users disable backing
      file probing.  QED has had a flag to suppress probing since the
      beginning (2010), set whenever a raw backing file is assigned.

      All of these additions that allow to avoid format probing have to be
      specified explicitly. The default still allows the attack.

      In order to fix this, commit 79368c8 (July 2010) put probed raw images
      in a restricted mode, in which they wouldn't be able to overwrite the
      first few bytes of the image so that they would identify as a different
      image. If a write to the first sector would write one of the signatures
      of another driver, qemu would instead zero out the first four bytes.
      This patch was later reverted in commit 8b33d9e (September 2010) because
      it didn't get the handling of unaligned qiov members right.

      Today's block layer that is based on coroutines and has qiov utility
      functions makes it much easier to get this functionality right, so this
      patch implements it.

      The other differences of this patch to the old one are that it doesn't
      silently write something different than the guest requested by zeroing
      out some bytes (it fails the request instead) and that it doesn't
      maintain a list of signatures in the raw driver (it calls the usual
      probe function instead).

      Note that this change doesn't introduce new breakage for false positive
      cases where the guest legitimately writes data into the first sector
      that matches the signatures of an image format (e.g. for nested virt):
      These cases were broken before, only the failure mode changes from
      corruption after the next restart (when the wrong format is probed) to
      failing the problematic write request.

      Also note that like in the original patch, the restrictions only apply
      if the image format has been guessed by probing. Explicitly specifying a
      format allows guests to write anything they like.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1416497234-29880-8-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7cddd3728e964164e99c59e5c9443508d9ee0161
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:11 2014 +0100

      block: Read only one sector for format probing

      The only image format driver that even potentially accesses anything
      after 512 bytes in its bdrv_probe() implementation is VMDK, which reads
      a plain-text descriptor file. In practice, the field it's looking for
      seems to come first and will be well within the first 512 bytes, too.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-7-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6684249fd35f7e692bcf3039d2fc4b13dd32308
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Nov 20 16:27:10 2014 +0100

      block: Factor bdrv_probe_all() out of find_image_format()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-6-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8e665e4d8c6aece216e373da062ee60c82e0b6f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:09 2014 +0100

      qtests: Specify image format explicitly

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-5-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 90c9b1671e79a978b918ed4f93f9aa0d2d2bb72f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:08 2014 +0100

      qemu-iotests: Add qemu-io format option in Python tests

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-4-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8f9e835fd2e687d2bfe936819c3494af4343614d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:07 2014 +0100

      qemu-iotests: Use qemu-io -f $IMGFMT

      This patch changes $QEMU_IO so that all tests by default pass a format
      argument to qemu-io.

      There are a few cases where -f $IMGFMT is not wanted because it selects
      the wrong driver or json: filenames including a driver are used. They
      are changed to use $QEMU_IO_PROG, which doesn't include any options.

      Tests 071 and 081 have output changes because now the actual request
      fails instead of reading the 2k probing buffer.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-3-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit be6273da9e31d30fc95a65b09a0b819a89f1cc62
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:06 2014 +0100

      qemu-io: Allow explicitly specifying format

      This adds a -f option to qemu-io which allows to explicitly specify the
      block driver to use for the given image.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-2-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e465ce7d09939d631f1861e0bd8873417c1c0d65
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Nov 19 15:07:12 2014 +0800

      tests: Use "command -v" instead of which(1) in shell scripts

      When which(1) is not installed, we would complain "perl not found"
      because it's the first set_prog_path check. The error message is
      wrong.

      Fix it by using "command -v", a native way to query the existence of a
      command.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1416380832-9697-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c58e80acd61e24f307c1b2557079cc77dc9150a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:19 2014 +0100

      qemu-nbd: Use BlockBackend where reasonable

      Because qemu-nbd creates the BlockBackend by itself, it should create
      the according BlockDriverState tree by itself as well; that means, it
      has call bdrv_open() on its own. This is one of the places where
      qemu-nbd still needs to use a BlockDriverState directly (the root BDS
      below the BB); other places are the configuration of zero detection
      (which may be lifted into the BB eventually, but is not yet) and
      temporarily loading a snapshot.

      Everywhere else, though, qemu-nbd can and thus should use BlockBackend.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-7-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aadf99a792be864c8feb1cc61e2c8fd225fa7c01
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:18 2014 +0100

      nbd: Use BlockBackend internally

      With all externally visible functions changed to use BlockBackend, this
      patch makes nbd use BlockBackend for everything internally as well.

      While touching them, substitute 512 by BDRV_SECTOR_SIZE in the calls to
      blk_read(), blk_write() and blk_co_discard().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-6-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e140177d9cd067050004be6f725c3a0750ccdd94
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:17 2014 +0100

      nbd: Change external interface to BlockBackend

      Substitute BlockDriverState by BlockBackend in every globally visible
      function provided by nbd.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-5-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2c28b21f7c97ae4e2082536f36e97b1337e3d195
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:16 2014 +0100

      block: Add blk_add_close_notifier() for BB

      Adding something like a "delete notifier" to a BlockBackend would not
      make much sense, because whoever is interested in registering there will
      probably hold a reference to that BlockBackend; therefore, the notifier
      will never be called (or only when the notifiee already relinquished its
      reference and thus most probably is no longer interested in that
      notification).

      Therefore, this patch just passes through the close notifier interface
      of the root BDS. This will be called when the device is ejected, for
      instance, and therefore does make sense.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2019ba0a0197afc85495546f337345a7150710fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:15 2014 +0100

      block: Add AioContextNotifier functions to BB

      Because all BlockDriverStates behind a single BlockBackend reside in a
      single AioContext, it is fine to just pass these functions
      (blk_add_aio_context_notifier() and blk_remove_aio_context_notifier())
      through to the root BlockDriverState.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2bb0dce76245762dbc0a8fe12516faa127a64e5b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:14 2014 +0100

      block: Lift more functions into BlockBackend

      There are already some blk_aio_* functions, so we might as well have
      blk_co_* functions (as far as we need them). This patch adds
      blk_co_flush(), blk_co_discard(), and also blk_invalidate_cache() (which
      is not a blk_co_* function but is needed nonetheless).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 17fcb74af922ba9f761d11e874314c32a3445e97
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Nov 13 10:24:41 2014 +0000

      ahci: replace SATA FIS type magic numbers with constants

      SATA 3.0 "10.3.1 FIS Type values" defines the constants used to
      differentiate between FIS types.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1415874281-7371-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 192cf55cc02dc0838bbfa5ac17feb7f6c1651441
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Nov 13 10:24:40 2014 +0000

      ahci: avoid #ifdef DEBUG_AHCI bitrot

      Debug code using #ifdef is susceptible to bitrot because the compiler
      never checks the debug code.

      This is easy to avoid, change the DPRINTF() macro to use if (DEBUG_AHCI)
      and always give it a 0 or 1 value.

      This also allows us to drop an #ifdef DEBUG_AHCI in ahci_start_dma()
      since the compiler can now see the local variable is used.

      The motivation for this change is a recent DEBUG_AHCI build failure due
      to an outdated DPRINTF() format string.  From now on the compiler will
      catch these errors.

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1415874281-7371-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f48a33b608b6d98cbe2eaba27cbae925fc221284
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 11 10:23:45 2014 +0100

      iotests: Plain blkdebug filename generation

      Add one test whether blkdebug is able to generate a plain filename if
      given a configuration file and a file to be tested only; and add another
      test whether blkdebug is able to do the same without being given a
      configuration file.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1415697825-26678-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8779441b1b0e03bd3e5213dee447ab0c955e374b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 11 10:23:44 2014 +0100

      blkdebug: Simplify and improve filename generation

      Instead of actually recreating the options from scratch, just reuse the
      options given for creating the BDS, which are the configuration file
      name and additional options. In case there are no additional options we
      can thus create a plain filename.

      This obviously results in a different output for qemu-iotest 099 which
      exactly tests this filename generation. Fix it up as well.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1415697825-26678-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 48fe86f6400574165979e0db6f5937ad487b6888
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Nov 12 16:24:02 2014 +0100

      monitor: Fix HMP tab completion

      Commands with multiple boolean flag options (like 'info block') didn't
      provide correct completion because only the first one was skipped.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e6bb31ec6f7ef7c78c897390ecc6c6a34a7f9f5a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:19:14 2014 +0200

      block/hmp: Allow node-name in 'info block'

      The optional parameter specifying a block device allows now to use a
      node-name instead of a drive name (and therefore to inspect any node in
      the graph). The new -n options allows listing all named nodes instead of
      BlockBackends.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8d6adccda25d75dc152b68d15ac75e1670e59b23
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:12:52 2014 +0200

      block/hmp: Allow info = NULL in print_block_info()

      This allows printing infos of BlockDriverStates that aren't at the root
      of the graph (and logically implementing a BlockBackend).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 289b276c69a8b5f90531b41917a536e16bf71837
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:06:39 2014 +0200

      block/hmp: Factor out print_block_info()

      The new function prints the info for a single BlockDriverState.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9e193c5a652faff719d7186e27f680e3888925a6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 22 13:28:45 2014 +0200

      block/qapi: Add cache information to query-block

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 729962f6db43bf262a446f5e13d900ffb3c54a88
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:45 2014 +0000

      blockdev: acquire AioContext in change-backing-file

      Add dataplane support to the change-backing-file QMP commands.  By
      acquiring the AioContext we avoid race conditions with the dataplane
      thread which may also be accessing the BlockDriverState.

      Note that this command operates on both bs and a node in its chain
      (image_bs).  The bdrv_chain_contains(bs, image_bs) check guarantees that
      bs and image_bs are in the same AioContext.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e3442099a2794925dfbe83711cd204caf80eae60
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:44 2014 +0000

      blockdev: acquire AioContext in eject, change, and block_passwd

      By acquiring the AioContext we avoid race conditions with the dataplane
      thread which may also be accessing the BlockDriverState.

      Fix up eject, change, and block_passwd in a single patch because
      qmp_eject() and qmp_change_blockdev() both call eject_device().  Also
      fix block_passwd while we're tackling a command that takes a block
      encryption password.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b92885420c9cf42da27c63939d388e276a7ddde
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:43 2014 +0000

      blockdev: check for BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE

      The BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE op blocker exists but was
      never used!  Let's fix that so snapshot delete can be blocked.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4ef3982a99f9d2634588b4785c8d841605517946
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:42 2014 +0000

      blockdev: acquire AioContext in blockdev-snapshot-delete-internal-sync

      Add dataplane support to the blockdev-snapshot-delete-internal-sync QMP
      command.  By acquiring the AioContext we avoid race conditions with the
      dataplane thread which may also be accessing the BlockDriverState.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2389eeae690b68e9d6a17cb10a5a7c7ec58009a1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:06 2014 +0100

      iotests: Use -qmp-pretty in 067

      067 invokes query-block, resulting in a reference output with really
      long lines (which may pose a problem in email patches and always poses a
      problem when the output changes, because it is hard to see what has
      actually changed). Use -qmp-pretty to mitigate this issue.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit cc20b07a421ba39413111813b4016745fee11f08
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:05 2014 +0100

      iotests: _filter_qmp for pretty JSON output

      _filter_qmp should be able to correctly filter out the QMP version
      object for pretty JSON output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4821cd4cfd50185979d9a8c335acb62d97972dbb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:04 2014 +0100

      chardev: Add -qmp-pretty

      Add a command line option for adding a QMP monitor using pretty JSON
      formatting.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4b58554a0e60aba6f1c6f391759f148f7bca181b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Nov 21 10:29:59 2014 +0100

      qjson: Drop trailing space for pretty formatting

      For the pretty formatting, the functions converting QDicts and QLists to
      JSON should not print a space after the comma separating objects,
      because a newline will emitted immediately afterwards, making the
      whitespace superfluous.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f71eaa74c0bf2cf9da9a00b571d4b8162c61e29d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:57 2014 +0800

      qmp: Add optional switch "query-nodes" in query-blockstats

      This bool option will allow query all the node names. It iterates all
      the BDSes that are assigned a name, also in this case don't query up the
      backing chain.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4875a77950811631c26e156592e8b8df22208085
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:56 2014 +0800

      block: Include "node-name" if present in query-blockstats

      Node name is a better identifier of BDS.

      We will want to query statistics of a BDS node buried in the BDS graph,
      so reporting the node's name if there is one will do the trick.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20a9e77dfabb3e664c0873726be1540175a4fda1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:55 2014 +0800

      block: Add bdrv_get_node_name

      This returns the node name of a BDS. Remove the TODO comment and expect
      the callers to be explicit.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 04df765ab449df24666269b0de0caf6ff250c568
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:54 2014 +0800

      block: Add bdrv_next_node

      Similar to bdrv_next, this traverses through graph_bdrv_states. Will be
      useful to enumerate all the named nodes.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 43948386bb109b97b3de0bb48573f317bdcb5008
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:39:05 2014 +0800

      keymaps: correct keymaps.c following Qemu coding style

      It's hard to read because of the confused coding
      style in this file. Let's correct it following Qemu
      coding style.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 525965b85dcd9e0d0359f1cdb04b3f25d754ffd9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 20 17:07:06 2014 +0800

      vnc-enc-tight: fix Arguments in wrong order

      Arguments in wrong order (SWAPPED_ARGUMENTS)
      The positions of arguments in the call to
      tight_fill_palette do not match the ordering of the parameters:
       &fg is passed to bg
       &bg is passed to fg

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b196d969efa3987148994f0f8da79a10ebda7641
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue Dec 9 15:15:59 2014 +0800

      vt82c686: fix coverity warning about out-of-bounds write

      Refactor superio_ioport_writeb to fix the out of bounds write warning.

      In addition, fix two typos: s/chage/change/

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7766aa0c0e9e1b84c80c3a8168c6d97c4a3d49b8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Dec 9 10:09:22 2014 +0800

      virtio: remove useless declaration of virtio_net_init()

      commit 1773d9ee (virtio-net: cleanup: init and exit function)
      removed the definition of virtio_net_init(), but didn't remove its
      declaration in the header.  Clean that up.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1c854067b31a7764fa346ea74e0f0fa0ae718458
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:40:19 2014 +0800

      qapi-schema: fix typo about change-vnc-password

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d504fb4cecdb7c6f3b18c4d83296e84b6e970595
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:52:41 2014 +0800

      fw_cfg: remove superfluous blank line

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 80b57dda897f541dcaa66369241eebc6f2a18a78
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Wed Oct 22 14:28:38 2014 +0200

      get_maintainer.pl: Remove the --git-chief-penguins option

      Linus likely does not want to get e-mails about QEMU, so let's
      just remove this option.

      Suggested-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8ccefb91bf0b4be7a7434c55dae77ed3acb39f68
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 14:18:16 2014 +0800

      configure: Replace which(1) with "has"

      Using "has" is more slick because which(1) is not always there.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e1cf5582644ef63528993fb2b88dd3b43b9914c6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:03 2014 +0100

      util: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9be71be5bda27b068176ab9b982cf3d7d41a4acd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:02 2014 +0100

      util: Fuse g_malloc(); memset() into g_new0()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 44c2286b5df1f50fc9fedabd7b1a5a8022e583fc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:01 2014 +0100

      util: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 24588100ab39afead7b9a0e9c61182a02320a1b9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 10:26:55 2014 +0100

      Drop superfluous conditionals around g_strdup()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4ad608803c46c0acc09114a2e8352742ffd20b6b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Dec 3 11:28:02 2014 +0100

      Drop superfluous conditionals around qemu_opts_del()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7251711472a8b406640a62f25f860628d3056bb1
  Author: lijun <junmuzi@gmail.com>
  Date:   Wed Nov 19 14:57:43 2014 +0800

      usb: delete redundant brackets in usb_host_handle_control()

      When see usb codes, find there are redundant brackets !((udev->port->speedmask
      & USB_SPEED_MASK_SUPER)) here. So delete it.

      Signed-off-by: Jun Li <junmuzi@gmail.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c80ab15e218a0438627c2a79d74d5a13b864e15
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:39:32 2014 +0800

      virtio-bus: avoid breaking build when open DEBUG switch

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b310fc4f9eb2570bfb92a725bd094ce203800da
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:59:37 2014 +0800

      acpi-build: Make DPRINTF working for acpi-build

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fcf55f580d4c4755dfacabd7ac86501ebbb4167e
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:59:36 2014 +0800

      acpi-build: adjust indention 8 -> 4 spaces

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1a71992376792a0d11ea27688bd1a21cdffd1826
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 24 10:47:45 2014 +0800

      target-s390x: fix possible out of bounds read

      Array index starts at 0, so the valid index of ext_queue array,
      io_queue array, mchk_queue array should be MAX_EXT_QUEUE - 1,
      MAX_IO_QUEUE - 1, MAX_MCHK_QUEUE - 1.

      The original checks missed the invalid bound value, which will lead
      possible out of bounds read in the follow codes.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b5369dd841b55aa24dd107223e0a08d8624d1b19
  Author: Amos Kong <akong@redhat.com>
  Date:   Tue Nov 25 16:05:56 2014 +0800

      qmp: fix typo in input-send-event examples

      Lack of two closed bracket in json commands.

      Signed-off-by: Amos Kong <akong@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7fb8da2b8861795e0013e6ee97acd0363d868a35
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 9 21:48:34 2014 +0000

      Open 2.3 development tree

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


For bisection revision-tuple graph see:
   http://logs.test-lab.xenproject.org/osstest/results/bisect/libvirt/test-amd64-amd64-libvirt-vhd.debian-di-install.html
Revision IDs in each graph node refer, respectively, to the Trees above.

----------------------------------------
Running cs-bisection-step --graph-out=/home/logs/results/bisect/libvirt/test-amd64-amd64-libvirt-vhd.debian-di-install --summary-out=tmp/65231.bisection-summary --basis-template=63340 --blessings=real,real-bisect libvirt test-amd64-amd64-libvirt-vhd debian-di-install
Searching for failure / basis pass:
 65151 fail [host=nocera1] / 65068 [host=godello1] 65035 [host=chardonnay1] 65004 [host=huxelrebe0] 64980 [host=baroque0] 64932 [host=fiano0] 64762 [host=godello0] 64520 [host=baroque1] 64408 [host=rimava1] 64291 [host=italia1] 64179 [host=chardonnay0] 64130 [host=huxelrebe1] 64021 [host=godello1] 63903 [host=pinot0] 63733 [host=chardonnay1] 63702 [host=rimava0] 63578 [host=huxelrebe0] 63528 [host=baroque0] 63469 [host=elbling1] 63397 [host=godello0] 63373 [host=chardonnay0] 63352 [host=huxelrebe1] 63340 [host=godello1] 63231 [host=chardonnay1] 63207 [host=pinot0] 63022 [host=pinot1] 62995 [host=italia0] 62973 [host=huxelrebe0] 62955 [host=chardonnay0] 62942 [host=godello0] 62807 [host=rimava1] 62727 [host=huxelrebe1] 62701 [h
 ost=godello1] 62666 [host=fiano1] 62618 [host=pinot1] 62551 [host=godello0] 62435 [host=rimava1] 62281 [host=godello1] 62175 [host=huxelrebe0] 62098 [host=merlot1] 62029 [host=chardonnay1] 61890 [host=godello0] 61770 [host=rimava1] 61675 [host=godello1] 61593 [host=pinot1] 61304 [host=fiano1] 61259 [host=elbling1] 61008 [host=pinot0] 60961 [host=godello0] 60880 [host=godello1] 60848 [host=huxelrebe0] 60814 [host=rimava1] 60779 [host=pinot1] 60715 [host=italia1] 60681 [host=godello1] 60663 [host=godello0] 60650 [host=merlot0] 60629 [host=italia0] 60612 [host=rimava1] 60568 [host=fiano1] 60183 [host=godello1] 60102 [host=godello0] template as basis? using template as basis.
Failure / basis pass flights: 65151 / 63340
(tree with no url: ovmf)
(tree with no url: seabios)
Tree: libvirt git://libvirt.org/libvirt.git
Tree: libvirt_gnulib git://git.sv.gnu.org/gnulib.git
Tree: linux git://xenbits.xen.org/linux-pvops.git
Tree: linuxfirmware git://xenbits.xen.org/osstest/linux-firmware.git
Tree: qemu git://xenbits.xen.org/qemu-xen-traditional.git
Tree: qemuu git://xenbits.xen.org/qemu-xen.git
Tree: xen git://xenbits.xen.org/xen.git
Latest 35b2a2d99ae9aa66816d97876111997d9e9d7dec f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 713b7e4ef2aa4ec3ae697cde9c81d5a57548f9b1
Basis pass 3c7590e0a435d833895fc7b5be489e53e223ad95 f39477dba778e99392948dd3dd19ec0d46aee932 1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 e08f3834c2f375153f104c827dd7c2fea93b288e
Generating revisions with ./adhoc-revtuple-generator  git://libvirt.org/libvirt.git#3c7590e0a435d833895fc7b5be489e53e223ad95-35b2a2d99ae9aa66816d97876111997d9e9d7dec git://git.sv.gnu.org/gnulib.git#f39477dba778e99392948dd3dd19ec0d46aee932-f39477dba778e99392948dd3dd19ec0d46aee932 git://xenbits.xen.org/linux-pvops.git#1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9-769b79eb206ad5b0249a08665fefb913c3d1998e git://xenbits.xen.org/osstest/linux-firmware.git#c530a75c1e6a472b0eb9558310b518f0dfcd8860-c530a75c1e6a472b0eb9558310b518f0dfcd8860 git://xenbits.xen.org/qemu-xen-traditional.git#bc00cad75d8bcc3ba696992bec219c21db8406aa-bc00cad75d8bcc3ba696992bec219c21db8406aa git://xenbits.xen.org/qemu-xen.git#816609b2841297925a223ec377c336360e044ee5-3fb401edbd8e9741c611bfddf6a2032ca91f55ed git://xenbits.xen.org/x
 en.git#e08f3834c2f375153f104c827dd7c2fea93b288e-713b7e4ef2aa4ec3ae697cde9c81d5a57548f9b1
Loaded 24236 nodes in revision graph
Searching for test results:
 64021 [host=godello1]
 64179 [host=chardonnay0]
 64130 [host=huxelrebe1]
 64291 [host=italia1]
 64408 [host=rimava1]
 64520 [host=baroque1]
 64762 [host=godello0]
 64932 [host=fiano0]
 64980 [host=baroque0]
 65035 [host=chardonnay1]
 65004 [host=huxelrebe0]
 65068 [host=godello1]
 65137 pass 3c7590e0a435d833895fc7b5be489e53e223ad95 f39477dba778e99392948dd3dd19ec0d46aee932 1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 e08f3834c2f375153f104c827dd7c2fea93b288e
 65140 fail irrelevant
 65096 fail irrelevant
 65144 pass b091fef5cf3e9d685d1a8046f634e9a17c40470a f39477dba778e99392948dd3dd19ec0d46aee932 07bd6f89f7ff56495c31505985af690c976374d6 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 700772bc13a3d4e7a61cea166893c0f53b251f08
 65134 fail irrelevant
 65115 pass 3c7590e0a435d833895fc7b5be489e53e223ad95 f39477dba778e99392948dd3dd19ec0d46aee932 1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 e08f3834c2f375153f104c827dd7c2fea93b288e
 65124 fail irrelevant
 65142 pass b091fef5cf3e9d685d1a8046f634e9a17c40470a f39477dba778e99392948dd3dd19ec0d46aee932 07bd6f89f7ff56495c31505985af690c976374d6 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 32b31c17da1ba0da970cd182a8865ac20fabd0fa
 65146 fail irrelevant
 65151 fail 35b2a2d99ae9aa66816d97876111997d9e9d7dec f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 713b7e4ef2aa4ec3ae697cde9c81d5a57548f9b1
 65196 pass 16562bbc587add5a03a01c8eb8607c9e05819607 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 513c203a0046232c55adf6d70ec1dbe54e8d157f
 65168 pass 3c7590e0a435d833895fc7b5be489e53e223ad95 f39477dba778e99392948dd3dd19ec0d46aee932 1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9 c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 e08f3834c2f375153f104c827dd7c2fea93b288e
 65208 pass eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 827db7b26384ce083df7154d77f13379b2cf4121
 65226 pass eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 827db7b26384ce083df7154d77f13379b2cf4121
 65161 pass e340013ea85a8be7268fbb24fa1cabc8d9b152ad f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 abdf3c5b2b971dc12e665e8e0cda184b416efffe
 65183 fail 35b2a2d99ae9aa66816d97876111997d9e9d7dec f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 713b7e4ef2aa4ec3ae697cde9c81d5a57548f9b1
 65165 pass 27432ba70cace47fc671de89c6517f23b3551cf5 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 4fa72bd15564c59cbd54d4db31a3060293e782ca
 65199 pass b57ce788a76317b4e117e7e7deb48a5c9083a224 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 827db7b26384ce083df7154d77f13379b2cf4121
 65187 fail 0076d8db976d0ac19587a667fcc2b7bcc210f94e f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed c87303c04738b0e837da6e891eb561de0bf1b64e
 65189 pass f78d070d68f750f689bd097a76ee43e57ce843bc f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 b9730aaae72b813f0e01124e79ccc3b25509f3d3
 65192 fail e7aa45055cee32b6f98329c8270a649cd629d507 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 30e3f328a5cc3747d9e038f2a80f39363dd65ea0
 65203 fail e7aa45055cee32b6f98329c8270a649cd629d507 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 827db7b26384ce083df7154d77f13379b2cf4121
 65222 fail eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 827db7b26384ce083df7154d77f13379b2cf4121
 65214 fail eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 827db7b26384ce083df7154d77f13379b2cf4121
 65219 pass eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 827db7b26384ce083df7154d77f13379b2cf4121
 65231 fail eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 3fb401edbd8e9741c611bfddf6a2032ca91f55ed 827db7b26384ce083df7154d77f13379b2cf4121
 63352 [host=huxelrebe1]
 63340 [host=godello1]
 63373 [host=chardonnay0]
 63469 [host=elbling1]
 63397 [host=godello0]
 63578 [host=huxelrebe0]
 63528 [host=baroque0]
 63702 [host=rimava0]
 63733 [host=chardonnay1]
 63903 [host=pinot0]
Searching for interesting versions
 Result found: flight 65115 (pass), for basis pass
 Result found: flight 65151 (fail), for basis failure
 Repro found: flight 65168 (pass), for basis pass
 Repro found: flight 65183 (fail), for basis failure
 0 revisions at eebe58adeb08730d66fc407cf6024cd8ea319447 f39477dba778e99392948dd3dd19ec0d46aee932 769b79eb206ad5b0249a08665fefb913c3d1998e c530a75c1e6a472b0eb9558310b518f0dfcd8860 bc00cad75d8bcc3ba696992bec219c21db8406aa 816609b2841297925a223ec377c336360e044ee5 827db7b26384ce083df7154d77f13379b2cf4121
No revisions left to test, checking graph state.
 Result found: flight 65208 (pass), for last pass
 Result found: flight 65214 (fail), for first failure
 Repro found: flight 65219 (pass), for last pass
 Repro found: flight 65222 (fail), for first failure
 Repro found: flight 65226 (pass), for last pass
 Repro found: flight 65231 (fail), for first failure

*** Found and reproduced problem changeset ***

  Bug is in tree:  qemuu git://xenbits.xen.org/qemu-xen.git
  Bug introduced:  3fb401edbd8e9741c611bfddf6a2032ca91f55ed
  Bug not present: 816609b2841297925a223ec377c336360e044ee5
  Last fail repro: http://logs.test-lab.xenproject.org/osstest/logs/65231/


  commit 3fb401edbd8e9741c611bfddf6a2032ca91f55ed
  Merge: a44c280 816609b
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Nov 23 16:55:36 2015 +0000

      Merge remote-tracking branch 'qemu-xen/staging' into qemu-xen-4.7

  commit a44c2800d990252b3632bbb35af34ec5ff99e2f1
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Sep 18 12:07:18 2015 +0200

      spice: surface switch fast path requires same format too.

      Commit "555e72f spice: rework mirror allocation, add no-resize fast path"
      adds a fast path for surface switches which does't go through the full
      primary surface destroy and re-recreation in case the new surface is
      identical to the old one (page-flip).  It checks the size only though,
      but the format must be identical too.  This patch adds the format check.

      Commit "0002a51 ui/spice: Support shared surface for most pixman
      formats" increases the chance to actually trigger this.

      https://bugzilla.redhat.com/show_bug.cgi?id=1247479

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 10ef480941522fc8bbcbc190bc0546991361bfd5
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jul 24 03:38:28 2015 -0600

      xen/HVM: atomically access pointers in bufioreq handling

      The number of slots per page being 511 (i.e. not a power of two) means
      that the (32-bit) read and write indexes going beyond 2^32 will likely
      disturb operation. The hypervisor side gets I/O req server creation
      extended so we can indicate that we're using suitable atomic accesses
      where needed, allowing it to atomically canonicalize both pointers when
      both have gone through at least one cycle.

      The Xen side counterpart (which is not a functional prereq to this
      change, albeit a build one) went in already (commit b7007bc6f9).

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 32d24131b2d1d98384b96c80f6cd3482550dc68a
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu Oct 29 13:49:30 2015 -0500

      Update version for 2.4.1 release

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit fc63922556a5064173411d8cea1e303256ee3c8c
  Author: Pavel Butsykin <pbutsykin@virtuozzo.com>
  Date:   Mon Oct 26 14:42:57 2015 +0300

      virtio: sync the dataplane vring state to the virtqueue before virtio_save

      When creating snapshot with the dataplane enabled, the snapshot file gets
      not the actual state of virtqueue, because the current state is stored in
      VirtIOBlockDataPlane. Therefore, before saving snapshot need to sync
      the dataplane vring state to the virtqueue. The dataplane will resume its
      work at the next notify virtqueue.

      When snapshot loads with loadvm we get a message:
      VQ 0 size 0x80 Guest index 0x15f5 inconsistent with Host index 0x0:
          delta 0x15f5
      error while loading state for instance 0x0 of device
          '0000:00:08.0/virtio-blk'
      Error -1 while loading VM state

      to reproduce the error I used the following hmp commands:
      savevm snap1
      loadvm snap1

      qemu parameters:
      --enable-kvm -smp 4 -m 1024 -drive file=/var/lib/libvirt/images/centos6.4.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,aio=native -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk0,id=virtio-disk0 -set device.virtio-disk0.x-data-plane=on

      Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1445859777-2982-1-git-send-email-den@openvz.org
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: "Michael S. Tsirkin" <mst@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 10a06fd65f667a972848ebbbcac11bdba931b544)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 36e1eee7603ad1683df9446e104c6f5849d854c6
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Jul 19 10:02:37 2015 +0300

      target-xtensa: add window overflow check to L32E/S32E

      Despite L32E and S32E primary use is for window underflow and overflow
      exception handlers they are just normal instructions, and thus need to
      check for window overflow.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      (cherry picked from commit f822b7e497fa6a662094b491f86441015f363362)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 9137bd24c8165192917471dca67b778c301fcd54
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Oct 14 12:11:27 2015 +0300

      net: don't set native endianness

      commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991
          vhost-net: tell tap backend about the vnet endianness
      makes vhost net always try to set LE - even if that matches the
      native endian-ness.

      This makes it fail on older kernels on x86 without TUNSETVNETLE support.

      To fix, make qemu_set_vnet_le/qemu_set_vnet_be skip the
      ioctl if it matches the host endian-ness.

      Reported-by: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      (cherry picked from commit 052bd52fa978d3f04bc476137ad6e1b9a697f9bd)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 08231cbb7660876903019ef1b59ef332deea2a83
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:56 2015 +0200

      device-introspect-test: New, covering device introspection

      The test doesn't check that the output makes any sense, only that QEMU
      survives.  Useful since we've had an astounding number of crash bugs
      around there.

      In fact, we have a bunch of them right now: a few devices crash or
      hang, and some leave dangling pointers behind.  The test skips testing
      the broken parts.  The next commits will fix them up, and drop the
      skipping.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-Id: <1443689999-12182-8-git-send-email-armbru@redhat.com>
      (cherry picked from commit 2d1abb850fd15fd6eb75a92290be5f93b2772ec5)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 70a4483abbbe3ec938b6c39a3cd0b486b96da93e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:55 2015 +0200

      libqtest: New hmp() & friends

      New convenience function hmp() to facilitate use of
      human-monitor-command in tests.  Use it to simplify its existing uses.

      To blend into existing libqtest code, also add qtest_hmpv() and
      qtest_hmp().  That, and the egregiously verbose GTK-Doc comment format
      make this patch look bigger than it is.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-Id: <1443689999-12182-7-git-send-email-armbru@redhat.com>
      (cherry picked from commit 5fb48d9673b76fc53507a0e717a12968e57d846e)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 39809852a7769e4271928ce7d5f2f1c4baf16fcf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:53 2015 +0200

      tests: Fix how qom-test is run

      We want to run qom-test for every architecture, without having to
      manually add it to every architecture's list of tests.  Commit 3687d53
      accomplished this by adding it to every architecture's list
      automatically.

      However, some architectures inherit their tests from others, like this:

          check-qtest-x86_64-y = $(check-qtest-i386-y)
          check-qtest-microblazeel-y = $(check-qtest-microblaze-y)
          check-qtest-xtensaeb-y = $(check-qtest-xtensa-y)

      For such architectures, we ended up running the (slow!) test twice.
      Commit 2b8419c attempted to avoid this by adding the test only when
      it's not already present.  Works only as long as we consider adding
      the test to the architectures on the left hand side *after* the ones
      on the right hand side: x86_64 after i386, microblazeel after
      microblaze, xtensaeb after xtensa.

      Turns out we consider them in $(SYSEMU_TARGET_LIST) order.  Defined as

          SYSEMU_TARGET_LIST := $(subst -softmmu.mak,,$(notdir \
             $(wildcard $(SRC_PATH)/default-configs/*-softmmu.mak)))

      On my machine, this results in the oder xtensa, x86_64, microblazeel,
      microblaze, i386.  Consequently, qom-test runs twice for microblazeel
      and x86_64.

      Replace this complex and flawed machinery with a much simpler one: add
      generic tests (currently just qom-test) to check-qtest-generic-y
      instead of check-qtest-$(target)-y for every target, then run
      $(check-qtest-generic-y) for every target.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-Id: <1443689999-12182-5-git-send-email-armbru@redhat.com>
      (cherry picked from commit e253c287153c6f3ce4177686ac12c196f9bd8292)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit db97d9d886f7e16571e5eb242d814b6d345affb2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:52 2015 +0200

      macio: move DBDMA_init from instance_init to realize

      DBDMA_init is not idempotent, and calling it from instance_init
      breaks a simple object_new/object_unref pair.  Work around this,
      pending qdev-ification of DBDMA, by moving the call to realize.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-4-git-send-email-armbru@redhat.com>
      (cherry picked from commit c7104402353bf32ac1d3a276e3619a20e910506b)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 243b80c9c5e8be52c141ff976aecd40667aebd61
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:51 2015 +0200

      hw: do not pass NULL to memory_region_init from instance_init

      This causes the region to outlive the object, because it attaches the
      region to /machine.  This is not nice for the "realize" method, but
      much worse for "instance_init" because it can cause dangling pointers
      after a simple object_new/object_unref pair.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-3-git-send-email-armbru@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      (cherry picked from commit 81e0ab48dda611e9571dc2e166840205a4208567)

      Conflicts:
      	hw/display/cg3.c
      	hw/display/tcx.c

      * removed context dependencies on &error_fatal/&error_abort

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 91232d98da2bfe042d4c5744076b488880de3040
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Oct 1 10:59:50 2015 +0200

      memory: allow destroying a non-empty MemoryRegion

      This is legal; the MemoryRegion will simply unreference all the
      existing subregions and possibly bring them down with it as well.
      However, it requires a bit of care to avoid an infinite loop.
      Finalizing a memory region cannot trigger an address space update,
      but memory_region_del_subregion errs on the side of caution and
      might trigger a spurious update: avoid that by resetting mr->enabled
      first.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1443689999-12182-2-git-send-email-armbru@redhat.com>
      (cherry picked from commit 2e2b8eb70fdb7dfbec39f3a19b20f9a73f2f813e)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d68ba3cab357f73aa74525f86f5da448b39ae34a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 8 18:11:39 2015 +0200

      update-linux-headers: Rename SW_MAX to SW_MAX_

      The next commit will compile hw/input/virtio-input.c and
      hw/input/virtio-input-hid.c even when CONFIG_LINUX is off.  These
      files include both "include/standard-headers/linux/input.h" and
      <windows.h> then.  Doesn't work, because both define SW_MAX.  We don't
      actually use it.  Patch input.h to define SW_MAX_ instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1444320700-26260-2-git-send-email-armbru@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit ac98fa849e834f48e5a64cf4b22218ba4047e142)

      Conflicts:
      	scripts/update-linux-headers.sh

      * remove dependency on eddb4de3

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 381a290266df4161de71afc8a44e67ae66bde5be
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Sep 16 17:38:44 2015 +0200

      trace: remove malloc tracing

      The malloc vtable is not supported anymore in glib, because it broke
      when constructors called g_malloc.  Remove tracing of g_malloc,
      g_realloc and g_free calls.

      Note that, for systemtap users, glib also provides tracepoints
      glib.mem_alloc, glib.mem_free, glib.mem_realloc, glib.slice_alloc
      and glib.slice_free.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1442417924-25831-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 98cf48f60aa4999f5b2808569a193a401a390e6a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 696317f1895e836d53b670c7b77b7be93302ba08
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:30 2015 +0800

      virtio-net: correctly drop truncated packets

      When packet is truncated during receiving, we drop the packets but
      neither discard the descriptor nor add and signal used
      descriptor. This will lead several issues:

      - sg mappings are leaked
      - rx will be stalled if a lots of packets were truncated

      In order to be consistent with vhost, fix by discarding the descriptor
      in this case.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 0cf33fb6b49a19de32859e2cdc6021334f448fb3)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit c2a550d3dfa1f22eac77842aceed6047f6db2320
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:29 2015 +0800

      virtio: introduce virtqueue_discard()

      This patch introduces virtqueue_discard() to discard a descriptor and
      unmap the sgs. This will be used by the patch that will discard
      descriptor when packet is truncated.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a64d4cafa9dedad93da475f2f1e41133f433be67
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 25 13:21:28 2015 +0800

      virtio: introduce virtqueue_unmap_sg()

      Factor out sg unmapping logic. This will be reused by the patch that
      can discard descriptor.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Andrew James <andrew.james@hpe.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit ce317461573bac12b10d67699b4ddf1f97cf066c)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2f99c80963658b491d2f5fb98e6e602dd8d9ede2
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Oct 16 13:33:07 2015 +0200

      virtio-input: ignore events until the guest driver is ready

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit d9460a7557672af9c4d9d4f153200d1075ed5a78)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f62c10bd206b81644336f7e3c071ed76eab61ce6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Oct 13 12:21:27 2015 +0100

      Migration: Generate the completed event only when we complete

      The current migration-completed event is generated a bit too early,
      which means that an eager libvirt that's ready to go as soon
      as it sees the event ends up racing with the actual end of migration.

      This corresponds to RH bug:
      https://bugzilla.redhat.com/show_bug.cgi?id=1271145

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      xSigned-off-by: Juan Quintela <quintela@redhat.com>
      (cherry picked from commit ed1f3e0090069dcb9458aa9e450df12bf8eba0b0)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 8c4fa92d010db2ac88ed7a9e5bb51bbe43019872
  Author: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
  Date:   Mon Oct 12 11:36:21 2015 -0400

      util/qemu-config: fix missing machine command line options

      Commit 0a7cf217 ("util/qemu-config: fix regression of
      qmp_query_command_line_options") aimed to restore parsing of global
      machine options, but missed two: "aes-key-wrap" and
      "dea-key-wrap" (which were present in the initial version of that
      patch). Let's add them to the machine_opts again.

      Fixes: 0a7cf217 ("util/qemu-config: fix regression of
                        qmp_query_command_line_options")
      CC: Marcel Apfelbaum <marcel@redhat.com>
      CC: qemu-stable@nongnu.org
      Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1444664181-28023-1-git-send-email-akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

      (cherry picked from commit 5bcfa0c543b42a560673cafd3b5225900ef617e1)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 7c22dcdeb85dc8b1eb5f923e4c075d3046750513
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Oct 7 10:29:42 2015 +0200

      s390x/kvm: Fix vector validity bit in device machine checks

      Device hotplugs trigger a crw machine check. All machine checks
      have validity bits for certain register types. With vector support
      we also have to claim that vector registers are valid.
      This is a band-aid suitable for stable. Long term we should
      create the full  mcic value dynamically depending on the active
      features in the kernel interrupt handler.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      (cherry picked from commit 2ab75df38e34fe9bc271b5115ab52114e6e63a89)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 16514367efea1172e7b702c61c6f5637bf577f5b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Fri Oct 16 11:14:53 2015 +0100

      misc: zynq_slcr: Fix MMIO writes

      The /4 for offset calculation in MMIO writes was happening twice giving
      wrong write offsets. Fix.

      While touching the code, change the if-else to be a short returning if
      and convert the debug message to a GUEST_ERROR, which is more accurate
      for this condition.

      Cc: qemu-stable@nongnu.org
      Cc: Guenter Roeck <linux@roeck-us.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit c209b0537203c58a051e5d837320335cea23e494)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 55b4efb034155aa22d8392f4d6b7339807e3ab44
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:59 2015 +0200

      Revert "qdev: Use qdev_get_device_class() for -device <type>,help"

      This reverts commit 31bed5509dfcbdfc293154ce81086a4dbd7a80b6.

      The reverted commit changed qdev_device_help() to reject abstract
      devices and devices that have cannot_instantiate_with_device_add_yet
      set, to fix crash bugs like -device x86_64-cpu,help.

      Rejecting abstract devices makes sense: they're purely internal, and
      the implementation of the help feature can't cope with them.

      Rejecting non-pluggable devices makes less sense: even though you
      can't use them with -device, the help may still be useful elsewhere,
      for instance with -global.  This is a regression: -device FOO,help
      used to help even for FOO that aren't pluggable.

      The previous two commits fixed the crash bug at a lower layer, so
      reverting this one is now safe.  Fixes the -device FOO,help
      regression, except for the broken devices marked
      cannot_even_create_with_object_new_yet.  For those, the error message
      is improved.

      Example of a device where the regression is fixed:

          $ qemu-system-x86_64 -device PIIX4_PM,help
          PIIX4_PM.command_serr_enable=bool (on/off)
          PIIX4_PM.multifunction=bool (on/off)
          PIIX4_PM.rombar=uint32
          PIIX4_PM.romfile=str
          PIIX4_PM.addr=int32 (Slot and optional function number, example: 06.0 or 06)
          PIIX4_PM.memory-hotplug-support=bool
          PIIX4_PM.acpi-pci-hotplug-with-bridge-support=bool
          PIIX4_PM.s4_val=uint8
          PIIX4_PM.disable_s4=uint8
          PIIX4_PM.disable_s3=uint8
          PIIX4_PM.smb_io_base=uint32

      Example of a device where it isn't fixed:

          $ qemu-system-x86_64 -device host-x86_64-cpu,help
          Can't list properties of device 'host-x86_64-cpu'

      Both failed with "Parameter 'driver' expects pluggable device type"
      before.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-Id: <1443689999-12182-11-git-send-email-armbru@redhat.com>
      (cherry picked from commit 33fe96833015cf15f4c0aa5bf8d34f60526e0732)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2874c6565e989b7f9ab852ccac437f6d40c61a6b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:58 2015 +0200

      qdev: Protect device-list-properties against broken devices

      Several devices don't survive object_unref(object_new(T)): they crash
      or hang during cleanup, or they leave dangling pointers behind.

      This breaks at least device-list-properties, because
      qmp_device_list_properties() needs to create a device to find its
      properties.  Broken in commit f4eb32b "qmp: show QOM properties in
      device-list-properties", v2.1.  Example reproducer:

          $ qemu-system-aarch64 -nodefaults -display none -machine none -S -qmp stdio
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 4, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device-list-properties", "arguments": { "typename": "pxa2xx-pcmcia" } }
          qemu-system-aarch64: /home/armbru/work/qemu/memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
          Aborted (core dumped)
          [Exit 134 (SIGABRT)]

      Unfortunately, I can't fix the problems in these devices right now.
      Instead, add DeviceClass member cannot_destroy_with_object_finalize_yet
      to mark them:

      * Hang during cleanup (didn't debug, so I can't say why):
        "realview_pci", "versatile_pci".

      * Dangling pointer in cpus: most CPUs, plus "allwinner-a10", "digic",
        "fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such
        CPUs

      * Assert kvm_enabled(): "host-x86_64-cpu", host-i386-cpu",
        "host-powerpc64-cpu", "host-embedded-powerpc-cpu",
        "host-powerpc-cpu" (the powerpc ones can't currently reach the
        assertion, because the CPUs are only registered when KVM is enabled,
        but the assertion is arguably in the wrong place all the same)

      Make qmp_device_list_properties() fail cleanly when the device is so
      marked.  This improves device-list-properties from "crashes, hangs or
      leaves dangling pointers behind" to "fails".  Not a complete fix, just
      a better-than-nothing work-around.  In the above reproducer,
      device-list-properties now fails with "Can't list properties of device
      'pxa2xx-pcmcia'".

      This also protects -device FOO,help, which uses the same machinery
      since commit ef52358 "qdev-monitor: include QOM properties in -device
      FOO, help output", v2.2.  Example reproducer:

          $ qemu-system-aarch64 -machine none -device pxa2xx-pcmcia,help

      Before:

          qemu-system-aarch64: .../memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.

      After:

          Can't list properties of device 'pxa2xx-pcmcia'

      Cc: "Andreas Färber" <afaerber@suse.de>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: qemu-ppc@nongnu.org
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-Id: <1443689999-12182-10-git-send-email-armbru@redhat.com>
      (cherry picked from commit 4c315c27661502a0813b129e41c0bf640c34a8d6)

      Conflicts:
      	hw/arm/fsl-imx25.c
      	hw/arm/fsl-imx31.c
      	target-tilegx/cpu.c
      	tests/device-introspect-test.c

      * removed hunks pertaining to devices/tests not in 2.4

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2d0583fc79ab119def5cfd38b1c695654e332cf2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Oct 1 10:59:57 2015 +0200

      qmp: Fix device-list-properties not to crash for abstract device

      Broken in commit f4eb32b "qmp: show QOM properties in
      device-list-properties", v2.1.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-Id: <1443689999-12182-9-git-send-email-armbru@redhat.com>
      (cherry picked from commit edb1523d90415cb79f60f83b4028ef3820d15612)

      Conflicts:
      	tests/device-introspect-test.c

      * removed hunk specific to QAPI introspection (not in 2.4)

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 40161bf27b6f0143062f588b496f0a66b6ec769b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 10:26:27 2015 +0800

      vmxnet3: Drop net_vmxnet3_info.can_receive

      Commit 6e99c63 ("net/socket: Drop net_socket_can_send") changed the
      semantics around .can_receive for sockets to now require the device to
      flush queued pkts when transitioning to a .can_receive=true state. But
      it's OK to drop incoming packets when the link is not active.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 2734a20b8161831ba68c9166014e00522599d1e2)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2935ae915a618bab5b555b8963224fbeac4a5fa9
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Sep 11 16:01:56 2015 +0800

      virtio-net: unbreak self announcement and guest offloads after migration

      After commit 019a3edbb25f1571e876f8af1ce4c55412939e5d ("virtio: make
      features 64bit wide"). Device's guest_features was actually set after
      vdc->load(). This breaks the assumption that device specific load()
      function can check guest_features. For virtio-net, self announcement
      and guest offloads won't work after migration.

      Fixing this by defer them to virtio_net_load() where guest_features
      were guaranteed to be set. Other virtio devices looks fine.

      Fixes: 019a3edbb25f1571e876f8af1ce4c55412939e5d
             ("virtio: make features 64bit wide")
      Cc: qemu-stable@nongnu.org
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>

      (cherry picked from commit 1f8828ef573c83365b4a87a776daf8bcef1caa21)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2f3c3108186acc992858d2866d3aa20eb2eaf598
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Aug 17 11:48:29 2015 +0200

      virtio: avoid leading underscores for helpers

      Commit ef546f1275f6563e8934dd5e338d29d9f9909ca6 ("virtio: add
      feature checking helpers") introduced a helper __virtio_has_feature.
      We don't want to use reserved identifiers, though, so let's
      rename __virtio_has_feature to virtio_has_feature and virtio_has_feature
      to virtio_vdev_has_feature.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      (cherry picked from commit 95129d6fc9ead97155627a4ca0cfd37282883658)
      * prereq for 1f8828e
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 1f21d3b8dc11231c58b1f53804d33151ceeac84b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Sep 13 23:03:45 2015 +0200

      target-ppc: fix xscmpodp and xscmpudp decoding

      The xscmpodp and xscmpudp instructions only have the AX, BX bits in
      there encoding, the lowest bit (usually TX) is marked as an invalid
      bit. We therefore can't decode them with GEN_XX2FORM, which decodes
      the two lowest bit.

      Introduce a new form GEN_XX2FORM, which decodes AX and BX and mark
      the lowest bit as invalid.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 8f60f8e2e574f341709128ff7637e685fd640254)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit bac9ce97d33c8034e41bedc1e8d4c0604f069f5e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Sep 13 23:03:44 2015 +0200

      target-ppc: fix vcipher, vcipherlast, vncipherlast and vpermxor

      For vector instructions, the helpers get pointers to the vector register
      in arguments. Some operands might point to the same register, including
      the operand holding the result.

      When emulating instructions which access the vector elements in a
      non-linear way, we need to store the result in an temporary variable.

      This fixes openssl when emulating a POWER8 CPU.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 65cf1f65be0fc4883edbd66feeab3ddaceb11c00)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 33fca8589cf2aa7bf91564e6a8f26b3ba0910541
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Mon Sep 14 11:34:54 2015 +0100

      tcg/mips: Fix clobbering of qemu_ld inputs

      The MIPS TCG backend implements qemu_ld with 64-bit targets using the v0
      register (base) as a temporary to load the upper half of the QEMU TLB
      comparator (see line 5 below), however this happens before the input
      address is used (line 8 to mask off the low bits for the TLB
      comparison, and line 12 to add the host-guest offset). If the input
      address (addrl) also happens to have been placed in v0 (as in the second
      column below), it gets clobbered before it is used.

           addrl in t2              addrl in v0

       1 srl     a0,t2,0x7        srl     a0,v0,0x7
       2 andi    a0,a0,0x1fe0     andi    a0,a0,0x1fe0
       3 addu    a0,a0,s0         addu    a0,a0,s0
       4 lw      at,9136(a0)      lw      at,9136(a0)      set TCG_TMP0 (at)
       5 lw      v0,9140(a0)      lw      v0,9140(a0)      set base (v0)
       6 li      t9,-4093         li      t9,-4093
       7 lw      a0,9160(a0)      lw      a0,9160(a0)      set addend (a0)
       8 and     t9,t9,t2         and     t9,t9,v0         use addrl
       9 bne     at,t9,0x836d8c8  bne     at,t9,0x836d838  use TCG_TMP0
      10  nop                      nop
      11 bne     v0,t8,0x836d8c8  bne     v0,a1,0x836d838  use base
      12  addu   v0,a0,t2          addu   v0,a0,v0         use addrl, addend
      13 lw      t0,0(v0)         lw      t0,0(v0)

      Fix by using TCG_TMP0 (at) as the temporary instead of v0 (base),
      pushing the load on line 5 forward into the delay slot of the low
      comparison (line 10). The early load of the addend on line 7 also needs
      pushing even further for 64-bit targets, or it will clobber a0 before
      we're done with it. The output for 32-bit targets is unaffected.

       srl     a0,v0,0x7
       andi    a0,a0,0x1fe0
       addu    a0,a0,s0
       lw      at,9136(a0)
      -lw      v0,9140(a0)      load high comparator
       li      t9,-4093
      -lw      a0,9160(a0)      load addend
       and     t9,t9,v0
       bne     at,t9,0x836d838
      - nop
      + lw     at,9140(a0)      load high comparator
      +lw      a0,9160(a0)      load addend
      -bne     v0,a1,0x836d838
      +bne     at,a1,0x836d838
        addu   v0,a0,v0
       lw      t0,0(v0)

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      (cherry picked from commit 5eb4f645eba8a79ea643b228c74a79183d436c97)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a479b21c111a87a50203a7413c4e5ec419fc88dd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Aug 25 20:00:46 2015 +0200

      qom: Fix invalid error check in property_get_str()

      When a function returns a null pointer on error and only on error, you
      can do

          if (!foo(foos, errp)) {
              ... handle error ...
          }

      instead of the more cumbersome

          Error *err = NULL;

          if (!foo(foos, &err)) {
              error_propagate(errp, err);
              ... handle error ...
          }

      A StringProperty's getter, however, may return null on success!  We
      then fail to call visit_type_str().

      Screwed up in 6a146eb, v1.1.

      Fails tests/qom-test in my current, heavily hacked QAPI branch.  No
      reproducer for master known (but I didn't look hard).

      Cc: Anthony Liguori <anthony@codemonkey.ws>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      (cherry picked from commit e1c8237df5395f6a453f18109bd9dd33fb2a397c)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d11ff15fd5236bdb82b2def0ecc568290bfdba35
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Aug 25 20:00:45 2015 +0200

      qom: Do not reuse errp after a possible error

      The argument for an Error **errp parameter must point to a null
      pointer.  If it doesn't, and an error happens, error_set() fails its
      assertion.

      Instead of

          foo(foos, errp);
          bar(bars, errp);

      you need to do something like

          Error *err = NULL;

          foo(foos, &err);
          if (err) {
              error_propagate(errp, err);
              goto out;
          }

          bar(bars, errp);
      out:

      Screwed up in commit 0e55884 (v1.3.0): property_get_bool().

      Screwed up in commit 1f21772 (v2.1.0): object_property_get_enum() and
      object_property_get_uint16List().

      Screwed up in commit a8e3fbe (v2.4.0): property_get_enum(),
      property_set_enum().

      Found by inspection, no actual crashes observed.

      Fix them up.

      Cc: Anthony Liguori <anthony@codemonkey.ws>
      Cc: Hu Tao <hutao@cn.fujitsu.com>
      Cc: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      (cherry picked from commit 4715d42efe8632b0f9d2594a80e917de45e4ef88)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 1b8e1f7ad9dcf415e985e943cb7f18a686803fdd
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Sep 17 14:17:04 2015 -0400

      ide: unify io_buffer_offset increments

      IDEState's io_buffer_offset was originally added to keep track of offsets
      in AHCI rather exclusively, but it was added to IDEState instead of an
      AHCI-specific structure.

      AHCI fakes all PIO transfers using DMA and a scatter-gather list. When
      the core or atapi layers invoke HBA-specific mechanisms for transfers,
      they do not always know that it is being backed by DMA or a sglist, so
      this offset is not always updated by the HBA code everywhere.

      If we modify it in dma_buf_commit, however, any HBA that needs to use
      this offset to manage operating on only part of a sglist will have
      access to it.

      This will fix ATAPI PIO transfers performed through the AHCI HBA,
      which were previously not modifying this value appropriately.

      This will fix ATAPI PIO transfers larger than one sector.

      Reported-by: Hannes Reinecke <hare@suse.de>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1440546331-29087-2-git-send-email-jsnow@redhat.com
      CC: qemu-stable@nongnu.org
      (cherry picked from commit aaeda4a3c9e4d1d25c65ce8ca98e2de06daf1eec)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit e00bf9ee701b65a0fa7c6b011b0050845c798aa8
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Thu Jul 30 23:08:12 2015 +0200

      slirp: Fix non blocking connect for w32

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      (cherry picked from commit a246a01631f90230374c2b8ffce608232e2aa654)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 78aeb6984cedf8efdc6a007fddaed46d55a07edf
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Sep 16 16:35:46 2015 +0800

      nbd: release exp->blk after all clients are closed

      If the socket fd is shutdown, there may be some data which is received before
      shutdown. We will read the data and do read/write in nbd_trip(). But the exp's
      blk is NULL, and it will cause qemu crashed.

      Reported-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-Id: <55F929E2.1020501@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit d6268348493f32ecc096caa637620757472a1196)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 6d62d0e3dd47cbdc8a486a7c99cb0c07a1b916d8
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Sep 15 16:34:59 2015 -0500

      spapr_pci: fix device tree props for MSI/MSI-X

      PAPR requires ibm,req#msi and ibm,req#msi-x to be present in the
      device node to define the number of msi/msi-x interrupts the device
      supports, respectively.

      Currently we have ibm,req#msi-x hardcoded to a non-sensical constant
      that happens to be 2, and are missing ibm,req#msi entirely. The result
      of that is that msi-x capable devices get limited to 2 msi-x
      interrupts (which can impact performance), and msi-only devices likely
      wouldn't work at all. Additionally, if devices expect a minimum that
      exceeds 2, the guest driver may fail to load entirely.

      SLOF still owns the generation of these properties at boot-time
      (although other device properties have since been offloaded to QEMU),
      but for hotplugged devices we rely on the values generated by QEMU
      and thus hit the limitations above.

      Fix this by generating these properties in QEMU as expected by guests.

      In the future it may make sense to modify SLOF to pass through these
      values directly as we do with other props since we're duplicating SLOF
      code.

      Cc: qemu-ppc@nongnu.org
      Cc: qemu-stable@nongnu.org
      Cc: David Gibson <david@gibson.dropbear.id.au>
      Cc: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      (cherry picked from commit a8ad731a001d41582c9cec4015f73ab3bc11a28d)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5644f6f9242895db837d2c825cfe083f2a1d71ab
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Sep 10 18:19:32 2015 +0300

      gtk: use setlocale() for LC_MESSAGES only

      The QEMU code is not internationalized and assumes that it runs under
      the C locale, but if we use the GTK+ UI we'll end up importing the
      locale settings from the environment. This can break things, such as
      the JSON generator and iotest 120 in locales that use a decimal comma.

      We do however have translations for a few simple strings for the GTK+
      menu items, so in order to run QEMU using the C locale, and yet have a
      translated UI let's use setlocale() for LC_MESSAGES only.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit 2cb5d2a47c655331bcf0ab16bab8fe4701182c58)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 63d761388d6fea994ca498c6e7a210851a99ad93
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Sep 17 14:17:05 2015 -0400

      ide: fix ATAPI command permissions

      We're a little too lenient with what we'll let an ATAPI drive handle.
      Clamp down on the IDE command execution table to remove CD_OK permissions
      from commands that are not and have never been ATAPI commands.

      For ATAPI command validity, please see:
      - ATA4 Section 6.5 ("PACKET Command feature set")
      - ATA8/ACS Section 4.3 ("The PACKET feature set")
      - ACS3 Section 4.3 ("The PACKET feature set")

      ACS3 has a historical command validity table in Table B.4
      ("Historical Command Assignments") that can be referenced to find when
      a command was introduced, deprecated, obsoleted, etc.

      The only reference for ATAPI command validity is by checking that
      version's PACKET feature set section.

      ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
      therefore are assumed to have never been ATAPI commands.

      Mandatory commands, as listed in ATA8-ACS3, are:

      - DEVICE RESET
      - EXECUTE DEVICE DIAGNOSTIC
      - IDENTIFY DEVICE
      - IDENTIFY PACKET DEVICE
      - NOP
      - PACKET
      - READ SECTOR(S)
      - SET FEATURES

      Optional commands as listed in ATA8-ACS3, are:

      - FLUSH CACHE
      - READ LOG DMA EXT
      - READ LOG EXT
      - WRITE LOG DMA EXT
      - WRITE LOG EXT

      All other commands are illegal to send to an ATAPI device and should
      be rejected by the device.

      CD_OK removal justifications:

      0x06 WIN_DSM              Defined in ACS2. Not valid for ATAPI.
      0x21 WIN_READ_ONCE        Retired in ATA5. Not ATAPI in ATA4.
      0x94 WIN_STANDBYNOW2      Retired in ATA4. Did not coexist with ATAPI.
      0x95 WIN_IDLEIMMEDIATE2   Retired in ATA4. Did not coexist with ATAPI.
      0x96 WIN_STANDBY2         Retired in ATA4. Did not coexist with ATAPI.
      0x97 WIN_SETIDLE2         Retired in ATA4. Did not coexist with ATAPI.
      0x98 WIN_CHECKPOWERMODE2  Retired in ATA4. Did not coexist with ATAPI.
      0x99 WIN_SLEEPNOW2        Retired in ATA4. Did not coexist with ATAPI.
      0xE0 WIN_STANDBYNOW1      Not part of ATAPI in ATA4, ACS or ACS3.
      0xE1 WIN_IDLEIMMDIATE     Not part of ATAPI in ATA4, ACS or ACS3.
      0xE2 WIN_STANDBY          Not part of ATAPI in ATA4, ACS or ACS3.
      0xE3 WIN_SETIDLE1         Not part of ATAPI in ATA4, ACS or ACS3.
      0xE4 WIN_CHECKPOWERMODE1  Not part of ATAPI in ATA4, ACS or ACS3.
      0xE5 WIN_SLEEPNOW1        Not part of ATAPI in ATA4, ACS or ACS3.
      0xF8 WIN_READ_NATIVE_MAX  Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.

      This patch fixes a divide by zero fault that can be caused by sending
      the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
      attempt to use zeroed CHS values to perform sector arithmetic.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
      CC: qemu-stable@nongnu.org
      (cherry picked from commit d9033e1d3aa666c5071580617a57bd853c5d794a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit c13b1c8314d1178161a1fa1a0c4d460bd4d66a64
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Sep 14 16:39:47 2015 +0200

      qcow2: Make size_to_clusters() return uint64_t

      Sadly, some images may have more clusters than what can be represented
      using a plain int. We should be prepared for that case (in
      qcow2_check_refcounts() we actually were trying to catch that case, but
      since size_to_clusters() truncated the returned value, that check never
      did anything useful).

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      (cherry picked from commit b6d36def6d9e9fd187327182d0abafc9b7085d8f)

      Conflicts:
      	block/qcow2-cluster.c
      	block/qcow2.h

      * removed context dependency on ff99129a
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 052677b2c87779a6da6181b848825b29e65c0f54
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Sep 14 14:39:47 2015 +0100

      target-arm: Share all common TCG temporaries

      This is a bug fix for aarch64.  At present, we have branches using
      the 32-bit (translate.c) versions of cpu_[NZCV]F, but we set the flags
      using the 64-bit (translate-a64.c) versions of cpu_[NZCV]F.  From
      the view of the TCG code generator, these are unrelated variables.

      The bug is hard to see because we currently only read these variables
      from branches, and upon reaching a branch TCG will first spill live
      variables and then reload the arguments of the branch.  Since the
      32-bit versions were never live until reaching the branch, we'd re-read
      the data that had just been spilled from the 64-bit versions.

      There is currently no such problem with the cpu_exclusive_* variables,
      but there's no point in tempting fate.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1441909103-24666-2-git-send-email-rth@twiddle.net
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit 78bcaa3e37afbd0c5316634f917c13487384b6ca)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0fdf9f756fff60ec1c02dbd59698ba3dbb30eabe
  Author: Pierre Morel <pmorel@linux.vnet.ibm.com>
  Date:   Mon Sep 7 13:33:56 2015 +0200

      virtio dataplane: adapt dataplane for virtio Version 1

      Let dataplane allocate different region for the desc/avail/used
      ring regions.
      Take VIRTIO_RING_F_EVENT_IDX into account to increase the used/avail
      rings accordingly.

      [Fix 32-bit builds by changing 16lx format specifier to HWADDR_PRIx.
      --Stefan]

      Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
      Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Message-id: 1441625636-23773-1-git-send-email-pmorel@linux.vnet.ibm.com
      (changed __virtio16 into uint16_t,
       map descriptor table and available ring read-only)
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

      (cherry picked from commit a9718ef0005d6910097788936dc40c0204713729)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d077545dfef3d59f0286e0cb28cdb1c6d0570c22
  Author: Aníbal Limón <anibal.limon@linux.intel.com>
  Date:   Thu Sep 3 15:48:33 2015 -0500

      cpus.c: qemu_mutex_lock_iothread fix race condition at cpu thread init

      When QEMU starts the RCU thread executes qemu_mutex_lock_thread
      causing error "qemu:qemu_cpu_kick_thread: No such process" and exits.

      This isn't occur frequently but in glibc the thread id can exist and
      this not guarantee that the thread is on active/running state. If is
      inserted a sleep(1) after newthread assignment [1] the issue appears.

      So not make assumption that thread exist if first_cpu->thread is set
      then change the validation of cpu to created that is set into cpu
      threads (kvm, tcg, dummy).

      [1] https://sourceware.org/git/?p=glibc.git;a=blob;f=nptl/pthread_create.c;h=d10f4ea8004e1d8f3a268b95cc0f8d93b8d89867;hb=HEAD#l621

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
      Message-Id: <1441313313-3040-1-git-send-email-anibal.limon@linux.intel.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 46036b2462c7ff56c0af6466ea6b9248197a38a8)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f6737604da3b44322a91ebaa4b184aa519bbb66a
  Author: Vladislav Yasevich <vyasevic@redhat.com>
  Date:   Tue Sep 1 11:26:46 2015 -0400

      rtl8139: Do not consume the packet during overflow in standard mode.

      When operation in standard mode, we currently return the size
      of packet during buffer overflow.  This consumes the overflow
      packet.  Return 0 instead so we can re-process the overflow packet
      when we have room.

      This fixes issues with lost/dropped fragments of large messages.

      Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1441121206-6997-3-git-send-email-vyasevic@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 26c4e7ca72d970d120f0f51244bc8d37458512a0)
      *removed dependency on b76f21a7
      *removed context dependency on 4cbea598
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d2b0f96fe2762e2863a6fbbb0acb02606537cc9e
  Author: Vladislav Yasevich <vyasevic@redhat.com>
  Date:   Tue Sep 1 11:26:45 2015 -0400

      rtl8139: Fix receive buffer overflow check

      rtl8139_do_receive() tries to check for the overflow condition
      by making sure that packet_size + 8 does not exceed the
      available buffer space.  The issue here is that RxBuffAddr,
      used to calculate available buffer space, is aligned to a
      a 4 byte boundry after every update.  So it is possible that
      every packet ends up being slightly padded when written
      to the receive buffer.  This padding is not taken into
      account when checking for overflow and we may end up missing
      the overflow condition can causing buffer overwrite.

      This patch takes alignment into consideration when
      checking for overflow condition.

      Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1441121206-6997-2-git-send-email-vyasevic@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit fabdcd3392f16fc666b1d04fc1bbe5f1dbbf10a4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a00431853f6faef36618dad238a859e3d6805054
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Jul 24 12:08:37 2015 +0200

      s390x/css: start with cleared cstat/dstat

      When executing the start function, we should start with a clear state
      regarding subchannel and device status; it is easy to forget updating one
      of them after the ccw has been processed.

      Note that we don't need to care about resetting the various control
      fields: They are cleared by tsch(), and if they were still pending,
      we wouldn't be able to execute the start function in the first
      place.

      Also note that we don't want to clear cstat/dstat if a suspended
      subchannel is resumed.

      This fixes a bug where we would continue to present channel-program
      check in cstat even though later ccw requests for the subchannel
      finished without error (i.e. cstat should be 0).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      (cherry picked from commit 6b7741c2bedeae2e8c54fffce81723ca0a0c25c0)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit b51715e1c072ecc59a326f31c282501930f7c3ac
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Aug 28 13:10:17 2015 +0200

      PPC: E500: Update u-boot to commit 79c884d7e4

      The current U-Boot binary in QEMU has a bug where it fails to support
      dynamic CCSR addressing. Without this support, u-boot can not boot the
      ppce500 machine anymore. This has been fixed upstream in u-boot commit
      e834975b.

      Update the u-boot blob we carry in QEMU to the latest u-boot upstream,
      so that we can successfully run u-boot with the ppce500 machine again.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Tested-by: Thomas Huth <thuth@redhat.com>
      (cherry picked from commit d4574435a6530bbd96ae130eddfe5b676f91367a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 267bc474382f55eca082065a0f290695a5aa5242
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Aug 27 12:06:23 2015 +0300

      scripts/dump-guest-memory.py: fix after RAMBlock change

      commit 9b8424d5735278ca382f11adc7c63072b632ab83
          "exec: split length -> used_length/max_length"
      changed field names in struct RAMBlock

      It turns out that scripts/dump-guest-memory.py was
      poking at this field, update it accordingly.

      Cc: qemu-stable@nongnu.org
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1440666378-3152-1-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 0c71d41e2aa3c7356500ae624166f3bb8c201aee)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 955ff148de252b2fec92a1beef7f91c0987bb713
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Aug 26 09:52:51 2015 +0800

      vhost-scsi: fix wrong vhost-scsi firmware path

      vhost-scsi bootindex does't work because Qemu passes
      wrong fireware path to seabios.

      before:
        /pci@i0cf8/scsi@7channel@0/vhost-scsi@0,0
      after applying the patch:
        /pci@i0cf8/scsi@7/channel@0/vhost-scsi@0,0

      Reported-by: Subo <subo7@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1440553971-11108-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit f42bf6a262ab5923a1a3bc8f731b830396937c47)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 71b685832de15374e75e382a6ff60c95ced37f82
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Sun Aug 23 11:50:55 2015 +0100

      mac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete

      The code to flush the DBDMA channel was effectively duplicated in
      dbdma_control_write(), except for the fact that the copy executed outside of a
      RUN bit transition was broken by not clearing the FLUSH bit once the flush was
      complete.

      Newer PPC Linux kernels would timeout waiting for the FLUSH bit to clear again
      after submitting a FLUSH command. Fix this by always clearing the FLUSH bit
      once the channel flush is complete and removing the repeated code.

      Reported-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      (cherry picked from commit 1cde732d88af34849343dc1f0e68072eab0841b9)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 9a20ccaecd45f21ac4766ae6634aaa5499ddc772
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Aug 20 16:00:38 2015 -0700

      qemu-img: Fix crash in amend invocation

      Example:
      $ ./qemu-img create -f qcow2 /tmp/t.qcow2 64M
      $ ./qemu-img amend -f qcow2 -o backing_file=/tmp/t.qcow2, -o help \
          /tmp/t.qcow2

      This should not crash. This actually is tested by iotest 082, but not
      caught due to the segmentation fault being silent (which is something
      that needs to be fixed, too).

      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      (cherry picked from commit e814dffcc9810ed77fe99081be9751b620a894c4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d9af73191cc4a1f23ca8149ca2d5f71f74f5329d
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Aug 20 12:46:47 2015 +0200

      block/nfs: fix calculation of allocated file size

      st.st_blocks is always counted in 512 byte units. Do not
      use st.st_blksize as multiplicator which may be larger.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1440067607-14547-1-git-send-email-pl@kamp.de
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      (cherry picked from commit 055c6f912c8d3cd9a901972ae432c47e5872f71a)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 637dd0bb7c0e8a3275230b771085439f256b403d
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Aug 17 20:28:18 2015 -0700

      exec-all: Translate TCI return addresses backwards too

      This subtraction of return addresses applies directly to TCI as well as
      host-TCG. This fixes Linux boots for at least Microblaze, CRIS, ARM and
      SH4 when using TCI.

      [sw: Removed indentation for preprocessor statement]
      [sw: The patch also fixes Linux boot for x86_64]

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      (cherry picked from commit a17d448274575efbfcc1c04ec2641a0afeb74e17)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 2ac9fa162e25019eaa548f1fadfee256af88ca0f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Aug 14 13:33:36 2015 +0200

      block/iscsi: validate block size returned from target

      It has been reported that at least tgtd returns a block size of 0
      for LUN 0. To avoid running into divide by zero later on and protect
      against other problematic block sizes validate the block size right
      at connection time.

      Cc: qemu-stable@nongnu.org
      Reported-by: Andrey Korolyov <andrey@xdel.ru>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-Id: <1439552016-8557-1-git-send-email-pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit 6d1f252d8c1ba73bf6ed9af28731a9c9c3d473a2)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5b7d840e741aa06751b0fcec02ccda50a6bd574d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Sep 7 10:39:27 2015 +0100

      target-arm/arm-semi.c: Fix broken SYS_WRITE0 via gdb

      A spurious trailing "\n" in the gdb syscall format string used
      for SYS_WRITE0 meant that gdb would reject the remote syscall,
      with the effect that the output from the guest was silently dropped.
      Remove the newline so that gdb accepts the packet.

      Cc: qemu-stable@nongnu.org

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      (cherry picked from commit 857b55adb77004d9ec9202078b7f1f3a1a076112)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0de7d2b793f2e3cfeedfc822429a6bce6e48bda3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Aug 13 10:41:50 2015 +0200

      mirror: Fix coroutine reentrance

      This fixes a regression introduced by commit dcfb3beb ("mirror: Do zero
      write on target if sectors not allocated"), which was reported to cause
      aborts with the message "Co-routine re-entered recursively".

      The cause for this bug is the following code in mirror_iteration_done():

          if (s->common.busy) {
              qemu_coroutine_enter(s->common.co, NULL);
          }

      This has always been ugly because - unlike most places that reenter - it
      doesn't have a specific yield that it pairs with, but is more
      uncontrolled.  What we really mean here is "reenter the coroutine if
      it's in one of the four explicit yields in mirror.c".

      This used to be equivalent with s->common.busy because neither
      mirror_run() nor mirror_iteration() call any function that could yield.
      However since commit dcfb3beb this doesn't hold true any more:
      bdrv_get_block_status_above() can yield.

      So what happens is that bdrv_get_block_status_above() wants to take a
      lock that is already held, so it adds itself to the queue of waiting
      coroutines and yields. Instead of being woken up by the unlock function,
      however, it gets woken up by mirror_iteration_done(), which is obviously
      wrong.

      In most cases the code actually happens to cope fairly well with such
      cases, but in this specific case, the unlock must already have scheduled
      the coroutine for wakeup when mirror_iteration_done() reentered it. And
      then the coroutine happened to process the scheduled restarts and tried
      to reenter itself recursively.

      This patch fixes the problem by pairing the reenter in
      mirror_iteration_done() with specific yields instead of abusing
      s->common.busy.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1439455310-11263-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      (cherry picked from commit e424aff5f307227b1c2512bbb8ece891bb895cef)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f399ea092ea46c82b819ba1fdbcb082eb8019a32
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 29 16:45:11 2015 +0800

      scsi-disk: Fix assertion failure on WRITE SAME

      The last portion of an unaligned WRITE SAME command could fail the
      assertion in bdrv_aligned_pwritev:

          assert(!qiov || bytes == qiov->size);

      Because we updated data->iov.iov_len right above this if block, but
      data->qiov still has the old size.

      Reinitialize the qiov to make them equal and keep block layer happy.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1438159512-3871-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      (cherry picked from commit a56537a12757a8cdee24ad8c83e5af7a9833ea70)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 83c92b45140be773f0c5545dddea35a89db1ad03
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Sep 22 16:53:17 2015 -0500

      Update version for 2.4.0.1 release

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5a1ccdfe44946e726b4c6fda8a4493b3931a68c1
  Author: P J P <pjp@fedoraproject.org>
  Date:   Tue Sep 15 16:46:59 2015 +0530

      net: avoid infinite loop when receiving packets(CVE-2015-5278)

      Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
      bytes to process network packets. While receiving packets
      via ne2000_receive() routine, a local 'index' variable
      could exceed the ring buffer size, leading to an infinite
      loop situation.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 737d2b3c41d59eb8f94ab7eb419b957938f24943)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755
  Author: P J P <pjp@fedoraproject.org>
  Date:   Tue Sep 15 16:40:49 2015 +0530

      net: add checks to validate ring buffer pointers(CVE-2015-5279)

      Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
      bytes to process network packets. While receiving packets
      via ne2000_receive() routine, a local 'index' variable
      could exceed the ring buffer size, which could lead to a
      memory buffer overflow. Added other checks at initialisation.

      Reported-by: Qinghao Tang <luodalongde@gmail.com>
      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      (cherry picked from commit 9bbdbc66e5765068dce76e9269dce4547afd8ad4)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b
  Author: P J P <pjp@fedoraproject.org>
  Date:   Fri Sep 4 17:21:06 2015 +0100

      e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)

      While processing transmit descriptors, it could lead to an infinite
      loop if 'bytes' was to become zero; Add a check to avoid it.

      [The guest can force 'bytes' to 0 by setting the hdr_len and mss
      descriptor fields to 0.
      --Stefan]

      Signed-off-by: P J P <pjp@fedoraproject.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1441383666-6590-1-git-send-email-stefanha@redhat.com
      (cherry picked from commit b947ac2bf26479e710489739c465c8af336599e7)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit efec4dcd2552e85ed57f276b58f09fc385727450
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Aug 17 19:56:53 2015 +0200

      vnc: fix memory corruption (CVE-2015-5225)

      The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential
      memory corruption issues" can become negative.  Result is (possibly
      exploitable) memory corruption.  Reason for that is it uses the stride
      instead of bytes per scanline to apply limits.

      For the server surface is is actually fine.  vnc creates that itself,
      there is never any padding and thus scanline length always equals stride.

      For the guest surface scanline length and stride are typically identical
      too, but it doesn't has to be that way.  So add and use a new variable
      (guest_ll) for the guest scanline length.  Also rename min_stride to
      line_bytes to make more clear what it actually is.  Finally sprinkle
      in an assert() to make sure we never use a negative _cmp_bytes again.

      Reported-by: 范祚至(库特) <zuozhi.fzz@alibaba-inc.com>
      Reviewed-by: P J P <ppandit@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      (cherry picked from commit eb8934b0418b3b1d125edddc4fc334a54334a49b)
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 5c79ae3615d5dafdf1bb09b7a356a3a005714e3d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 11 15:30:34 2015 +0100

      Update version for v2.4.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2d697366a14ce95da2e9a59ea9872d3034eb49e4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Aug 5 17:02:58 2015 +0100

      Update version for v2.4.0-rc4 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0175409df42c20257171df87657dd705558aa94d
  Merge: e94867e 74aae7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Aug 5 16:02:00 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio fix for 2.4

      Fixes migration in virtio 1 mode.
      We still have a known bug with memory hotplug, it doesn't
      look like we can fix that in time for 2.4.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio: fix 1.0 virtqueue migration

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e94867ed5f241008d0f53142b2704a075f9ed505
  Author: Sascha Silbe <silbe@linux.vnet.ibm.com>
  Date:   Tue Aug 4 16:48:25 2015 +0200

      block: don't register quorum driver if SHA256 support is unavailable

      Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs]
      broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a
      compile-time check to a run-time check at device open time. The result
      is that we now advertise a feature (the quorum block driver) that will
      never work (on those hosts). There's no way (short of parsing
      human-readable error messages) for qemu-iotests or any other API
      consumer to recognise that the quorum block driver isn't _actually_
      available and shouldn't be used or tested.

      Move the run-time check to bdrv_quorum_init() to avoid registering the
      quorum block driver if we know it cannot work. This way API consumers
      can recognise it's unavailable.

      Fixes: 488981a4af396551a3178d032cc2b41d9553ada2
      Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1438699705-21761-1-git-send-email-silbe@linux.vnet.ibm.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 74aae7b22b8a67cf31937b2f4bdefe2881e799e9
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Wed Aug 5 17:50:07 2015 +0800

      virtio: fix 1.0 virtqueue migration

      1.0 does not requires physically-contiguous pages layout for a
      virtqueue. So we could not infer avail and used from desc. This means
      we need to migrate vring.avail and vring.used when host support virtio
      1.0. This fixes malfunction of virtio 1.0 device after migration.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2be4f242b50a84bf360df02480b173bfed161107
  Merge: 426d0e7 27751aa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 4 16:51:24 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-08-04

      # gpg: Signature made Tue 04 Aug 2015 16:49:42 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 27751aabd1e0359d84314bc230beccdef2168d1f
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Aug 4 16:17:21 2015 +0200

      target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

      Previous patch changed xlevel and missed the compatibility code.

      Fixes: 3046bb5debc8 ("target-i386: emulate CPUID level of real hardware")
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 426d0e7b7e031a1592292b3eb275483b341a2f28
  Merge: 260425a b7f26e5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Aug 4 12:57:06 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging

      MIPS patches 2015-08-04

      Changes:
      * fix semihosting for microMIPS R6
      * fix an abort when booting mips64 kernel with --enable-tcg-debug

      # gpg: Signature made Tue 04 Aug 2015 12:32:17 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150804:
        target-mips: Copy restrictions from ext/ins to dext/dins
        target-mips: fix semihosting for microMIPS R6

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7f26e523914b982a1c1bfa8295f77ff9787c33c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Aug 3 12:35:53 2015 -0700

      target-mips: Copy restrictions from ext/ins to dext/dins

      The checks in dins is required to avoid triggering an assertion
      in tcg_gen_deposit_tl.  The check in dext is just for completeness.
      Fold the other D cases in via fallthru.

      In this case the errant dins appears to be data, not code, as
      translation failed to stop after a break insn.

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 060ebfef1a09b58fb219b3769b72efb407515bf1
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Aug 3 13:01:19 2015 +0100

      target-mips: fix semihosting for microMIPS R6

      In semihosting mode the SDBBP 1 instructions should trigger UHI syscall,
      but in QEMU this does not happen for recently added microMIPS R6.
      Consequently bare metal microMIPS R6 programs supporting UHI will not run.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 260425ab405ea76c44dd59744d05176d4f579a52
  Merge: e95edef 6cd3878
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 18:52:55 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging

      cve-2015-5166

      # gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/cve-2015-5166-tag:
        Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e95edefbd0559e1d0aa09549641b5d9af1f96fac
  Merge: f60c871 8c6dc68
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 17:33:35 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into staging

      xen-migration-2.4

      # gpg: Signature made Mon 03 Aug 2015 17:18:36 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-migration-2.4-tag:
        migration: Fix regression for xenfv and pc,accel=xen machine.
        migration: Fix global state with Xen.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c6dc68f4cff9eef870497a19a5373dde9dbdcc2
  Author: Anthony PERARD <anthony.perard@citrix.com>
  Date:   Mon Aug 3 15:29:21 2015 +0100

      migration: Fix regression for xenfv and pc,accel=xen machine.

      This fix migration from the same QEMU version and from previous QEMU
      version.

      >From the global state section, we don't need runstate with Xen. Right now,
      the way the Xen toolstack knows when QEMU is ready is when QEMU reach
      "running" runstate.

      The configuration section and the section footers are not going to be
      present in previous version of QEMU with xenfv machine, so we skip them.

      The Xen toolstack libxenlight does not specify a particular version of the
      'pc' machine, so migration from older version of QEMU used by Xen to newer
      one would break due to missing "configuration" section and section footers.

      Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit c69adea462a97c02001b2dd1edd2a0692d27f5a2
  Author: Anthony PERARD <anthony.perard@citrix.com>
  Date:   Mon Aug 3 15:29:19 2015 +0100

      migration: Fix global state with Xen.

      When doing migration via the QMP command xen_save_devices_state, the
      current runstate is not store into the global state section. Also the
      current runstate is not the one we want on the receiver side.

      During migration, the Xen toolstack paused QEMU before save the devices
      state. Also, the toolstack expect QEMU to autostart when the migration is
      finished.
      So this patch store "running" as it's current runstate.

      Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit f60c87154ac722c528fd5582f7137914a93c5eec
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Jul 24 16:47:37 2015 +0200

      configure: Drop vnc-ws feature from help text

      Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped
      the --enable-vnc-ws option but forgot to update the help text. Fix this.

      Cc: Daniel P. Berrange <berrange@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Message-id: 1437749257-3313-1-git-send-email-afaerber@suse.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cd387833d05e8ad31829d97e474dc420625aed9
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Aug 3 13:56:57 2015 +0000

      Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

      pci_piix3_xen_ide_unplug should completely unhook the unplugged
      IDEDevice from the corresponding BlockBackend, otherwise the next call
      to release_drive will try to detach the drive again.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef
  Merge: bd80b59 8357946
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 13:09:10 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging

      Pull request

      # gpg: Signature made Mon Aug  3 13:08:25 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request:
        rtl8139: check TCP Data Offset field (CVE-2015-5165)
        rtl8139: skip offload on short TCP header (CVE-2015-5165)
        rtl8139: check IP Total Length field (CVE-2015-5165)
        rtl8139: check IP Header Length field (CVE-2015-5165)
        rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
        rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
        rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8357946b15f0a31f73dd691b7da95f29318ed310
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:39:29 2015 +0100

      rtl8139: check TCP Data Offset field (CVE-2015-5165)

      The TCP Data Offset field contains the length of the header.  Make sure
      it is valid and does not exceed the IP data length.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4240be45632db7831129f124bcf53c1223825b0f
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:36:15 2015 +0100

      rtl8139: skip offload on short TCP header (CVE-2015-5165)

      TCP Large Segment Offload accesses the TCP header in the packet.  If the
      packet is too short we must not attempt to access header fields:

        tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
        int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c6296ea88df040054ccd781f3945fe103f8c7c17
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:34:40 2015 +0100

      rtl8139: check IP Total Length field (CVE-2015-5165)

      The IP Total Length field includes the IP header and data.  Make sure it
      is valid and does not exceed the Ethernet payload size.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 03247d43c577dfea8181cd40177ad5ba77c8db76
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:32:32 2015 +0100

      rtl8139: check IP Header Length field (CVE-2015-5165)

      The IP Header Length field was only checked in the IP checksum case, but
      is used in other cases too.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e1c120a9c54872f8a538ff9129d928de4e865cbd
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 14:30:37 2015 +0100

      rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)

      Transmit offload features access Ethernet and IP headers the packet.  If
      the packet is too short we must not attempt to access header fields:

        int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
        ...
        eth_payload_data = saved_buffer + ETH_HLEN;
        ...
        ip = (ip_header*)eth_payload_data;
        if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d6812d60e7932de3cd0f602c0ee63dd3d09f1847
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:17:28 2015 +0100

      rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)

      The previous patch stopped using the ip pointer as an indicator that the
      IP header is present.  When we reach the if (ip) {...} statement we know
      ip is always non-NULL.

      Remove the if statement to reduce nesting.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 39b8e7dcaf04cbdb926b478f825b160d852752b5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 15 17:13:32 2015 +0100

      rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

      Transmit offload needs to parse packet headers.  If header fields have
      unexpected values the offload processing is skipped.

      The code currently uses nested ifs because there is relatively little
      input validation.  The next patches will add missing input validation
      and a goto label is more appropriate to avoid deep if statement nesting.

      Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bd80b5963f58c601f31d3186b89887bf8e182fb5
  Merge: ff90f84 c99d696
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 11:44:07 2015 +0100

      Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging

      TCG MIPS and S390 fixes for 2.4.

      # gpg: Signature made Mon Aug  3 09:09:59 2015 BST using RSA key ID 1DDD8C9B
      # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
      # gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
      # gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

      * remotes/aurel/tags/pull-tcg-mips-s390-20150803:
        tcg/mips: fix add2
        tcg/s390x: Mask TCGMemOp appropriately for indexing
        tcg/mips: Mask TCGMemOp appropriately for indexing
        tcg/mips: fix TLB loading for BE host with 32-bit guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff90f84e74d7c8641a493585ba9ea8d6e0d19855
  Merge: cb48f67 91ced51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Aug 3 10:44:23 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: fix ICC mask definition
        macio: re-add TRIM support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c99d69694af4ed15b33e3f7c2e3ef6972c14358d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jul 31 16:38:25 2015 +0200

      tcg/mips: fix add2

      The add2 code in the tcg_out_addsub2 function doesn't take into account
      the case where rl == al == bl. In that case we can't compute the carry
      after the addition. As it corresponds to a multiplication by 2, the
      carry bit is the bit 31.

      While this is a corner case, this prevents x86-64 guests to boot on a
      MIPS host.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 3c8691f568f49bf623dcb2850464d4156d95e61b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 22:13:26 2015 +0200

      tcg/s390x: Mask TCGMemOp appropriately for indexing

      Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
      but two cases were forgotten in the TCG S390 backend.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 4214a8cb7c15ec43d4b2a43ebf248b273a0f4d45
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 22:11:51 2015 +0200

      tcg/mips: Mask TCGMemOp appropriately for indexing

      Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
      but two cases were forgotten in the TCG MIPS backend.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e72c4fb81db52be881c9356f1c60e0a7817d2d32
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jul 30 23:39:34 2015 +0200

      tcg/mips: fix TLB loading for BE host with 32-bit guests

      For 32-bit guest, we load a 32-bit address from the TLB, so there is no
      need to compensate for the low or high part. This fixes 32-bit guests on
      big-endian hosts.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91ced514461e1a533bfb9e2eea32bd7df678b1cd
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Jul 21 14:02:01 2015 -0400

      ahci: fix ICC mask definition

      There are likely others that could be updated, but we'll
      go with a light touch for 2.4 for now.

      Without the Unsigned specifier, this shifts bits into the
      signed bit, which makes clang unhappy and could cause
      unwanted behavior.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1437501721-24495-1-git-send-email-jsnow@redhat.com

  commit 0e826a061a3e8e8485488a7da02cc139fc07d620
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jul 29 21:27:48 2015 +0200

      macio: re-add TRIM support

      Commit bd4214fc dropped TRIM support by mistake. Given it is still
      advertised to the host when using a drive with discard=on, this cause
      the IDE bus to hang when the host issues a TRIM command.

      This patch fixes that by re-adding the TRIM code, ported to the new
      new DMA implementation.

      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-id: 1438198068-32428-1-git-send-email-aurelien@aurel32.net
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit cb48f67ad8c7b33c617d4f8144a27706e69fd688
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed Jul 29 11:40:52 2015 -0700

      bsd-user: Fix operand to cpu_x86_exec

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1438195252-21968-1-git-send-email-rth@twiddle.net
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7008d580acad326148a725bd20695882ba10247a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 29 18:50:11 2015 +0100

      Update version for v2.4.0-rc3 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46739a2d7ace71b43cacf73ea71c10429db0d5e8
  Merge: b83d017 ca96ac4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 29 17:08:38 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      These fixes make dataplane work again after the notify_me optimization was
      added.  They also solve QEMUBH memory leaks and fix a bug in dataplane's
      cleanup code.

      # gpg: Signature made Wed Jul 29 14:50:26 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        AioContext: force event loop iteration using BH
        AioContext: avoid leaking BHs on cleanup
        virtio-blk-dataplane: delete bottom half before the AioContext is freed

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca96ac44dcd290566090b2435bc828fded356ad9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jul 28 18:34:09 2015 +0200

      AioContext: force event loop iteration using BH

      The notify_me optimization introduced in commit eabc97797310
      ("AioContext: fix broken ctx->dispatching optimization") skips
      event_notifier_set() calls when the event loop thread is not blocked in
      ppoll(2).

      This optimization causes a deadlock if two aio_context_acquire() calls
      race.  notify_me = 0 during the race so the winning thread can enter
      ppoll(2) unaware that the other thread is waiting its turn to acquire
      the AioContext.

      This patch forces ppoll(2) to return by scheduling a BH instead of
      calling aio_notify().

      The following deadlock with virtio-blk dataplane is fixed:

        qemu ... -object iothread,id=iothread0 \
                 -drive if=none,id=drive0,file=test.img,... \
                 -device virtio-blk-pci,iothread=iothread0,drive=drive0

      This command-line results in a hang early on without this patch.

      Thanks to Paolo Bonzini <pbonzini@redhat.com> for investigating this bug
      with me.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-4-git-send-email-pbonzini@redhat.com
      Message-Id: <1438014819-18125-3-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a076972a4d36381d610a854f0c336507650a1d34
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jul 28 18:34:08 2015 +0200

      AioContext: avoid leaking BHs on cleanup

      BHs are freed during aio_bh_poll().  This leads to memory leaks if there
      is no aio_bh_poll() between qemu_bh_delete() and aio_ctx_finalize().

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-3-git-send-email-pbonzini@redhat.com
      Message-Id: <1438014819-18125-2-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fed105e2756dde98efa5e80baca02ae516dd1e51
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 28 18:34:07 2015 +0200

      virtio-blk-dataplane: delete bottom half before the AioContext is freed

      Other uses of aio_bh_new are safe as long as all scheduled bottom
      halves are run before an iothread is destroyed, which bdrv_drain will
      ensure:

      - archipelago_finish_aiocb: BH deletes itself

      - inject_error: BH deletes itself

      - blkverify_aio_bh: BH deletes itself

      - abort_aio_request: BH deletes itself

      - curl_aio_readv: BH deletes itself

      - gluster_finish_aiocb: BH deletes itself

      - bdrv_aio_rw_vector: BH deletes itself

      - bdrv_co_maybe_schedule_bh: BH deletes itself

      - iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself

      - laio_attach_aio_context: deleted in laio_detach_aio_context,
      called through bdrv_detach_aio_context before deleting the iothread

      - nfs_co_generic_cb: BH deletes itself

      - null_aio_common: BH deletes itself

      - qed_aio_complete: BH deletes itself

      - rbd_finish_aiocb: BH deletes itself

      - dma_blk_cb: BH deletes itself

      - virtio_blk_dma_restart_cb: BH deletes itself

      - qemu_bh_new: main loop AioContext is never destroyed

      - test-aio.c: bh_delete_cb deletes itself, otherwise deleted in
      the same function that calls aio_bh_new

      Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1438101249-25166-2-git-send-email-pbonzini@redhat.com
      Message-Id: <1438086628-13000-1-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b83d017d88b2c4710c7a4614ecf9f845e4db80ba
  Merge: 170f209 7bba83b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 19:02:04 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      Pull request

      These two .can_receive() are now reviewed.  The net subsystem queue for 2.4 is now empty.

      # gpg: Signature made Tue Jul 28 13:26:03 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        xen: Drop net_rx_ok
        hw/net: handle flow control in mcf_fec driver receiver

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 170f209d7848dc2f14b3f3dccc34a49558680d4d
  Merge: 8b89b3a c147b51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 17:09:56 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio fixes for 2.4

      Mostly virtio 1 spec compliance fixes.
      We are unlikely to make it perfectly compliant in
      the first release, but it seems worth it to try.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio: minor cleanup
        acpi: fix pvpanic device is not shown in ui
        virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device
        virtio-blk: fail get_features when both scsi and 1.0 were set
        virtio: get_features() can fail
        virtio-pci: fix memory MR cleanup for modern
        virtio: set any_layout in virtio core
        virtio-9p: fix any_layout
        virtio-serial: fix ANY_LAYOUT
        virtio: hide legacy features from modern guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8b89b3a8df0a7d1ddbc9744f66a495986af667ca
  Merge: 5e868d2 52579c6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 15:25:24 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into staging

      MIPS patches 2015-07-28

      Changes:
      * net/dp8393x fixes
      * Vectored Interrupts bug fix
      * fix for a bug in machine.c which was provoking a warning on FreeBSD

      # gpg: Signature made Tue Jul 28 10:47:19 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150728:
        net/dp8393x: do not use memory_region_init_rom_device with NULL
        net/dp8393x: remove check of runt packets
        net/dp8393x: disable user creation
        target-mips: fix offset calculation for Interrupts
        target-mips: fix passing incompatible pointer type in machine.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e868d2e5e4aff76bdef787e44bc2d1eca18901f
  Merge: 9f8c5b6 52c91da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 14:19:16 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * crypto fixes
      * megasas SIGSEGV fix
      * memory refcount change to fix virtio hot-unplug

      # gpg: Signature made Tue Jul 28 08:29:07 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        memory: do not add a reference to the owner of aliased regions
        megasas: Add write function to handle write access to PCI BAR 3
        crypto: extend unit tests to cover decryption too
        crypto: fix built-in AES decrypt function

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f8c5b69c2b9ca8b9c3e569b0f41bd60a0b9e9fe
  Merge: 776f878 325e390
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 13:22:57 2015 +0100

      Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

      # gpg: Signature made Tue Jul 28 05:22:29 2015 BST using RSA key ID C0DE3057
      # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
      # gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
      # gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

      * remotes/cody/tags/jtc-for-upstream-pull-request:
        block/ssh: Avoid segfault if inet_connect doesn't set errno.
        sheepdog: serialize requests to overwrapping area

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7bba83bf80eae9c9e323319ff40d0ca477b0a77a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jul 28 17:52:56 2015 +0800

      xen: Drop net_rx_ok

      Let net_rx_packet() (which checks the same conditions) drops the packet
      if the device is not ready. Drop net_xen_info.can_receive and update the
      return value for the buffer full case.

      We rely on the qemu_flush_queued_packets() in net_event() to wake up
      the peer when the buffer becomes available again.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1438077176-378-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 776f87845137a9b300a4815ba6bf6879310795aa
  Merge: 84a29c7 226d007
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 11:28:44 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into staging

      trivial patches for 2015-07-27

      # gpg: Signature made Mon Jul 27 20:50:14 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-07-27:
        gdbstub: Set current CPU on interruptions
        qapi: add missing @
        Fix Cortex-A9 global timer
        gitignore: Ignore shader generated files
        vmstate: remove unused declaration
        make: Clean build messages
        qemu-common.h: Document cutils.c string functions
        device_tree: Fix a typo
        hw/acpi/ich9: clean up stale comment about KVM not supporting SMM
        hw/acpi/ich9: clear smi_en on reset

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff1d2ac949dc94d8a0e71fd46939fb69c2ef075b
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Tue Jul 28 11:02:54 2015 +1000

      hw/net: handle flow control in mcf_fec driver receiver

      The network mcf_fec driver emulated receive side method is not dealing
      with network queue flow control properly.

      Modify the receive side to check if we have enough space in the
      descriptors to store the current packet. If not we process none of it
      and return 0. When the guest frees up some buffers through its descriptors
      we signal the qemu net layer to send more packets.

      [Fixed coding style: 4-space indent and curly braces on if statement.
      --Stefan]

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Message-id: 1438045374-10358-1-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 52579c681cb12bf64de793e85edc50d990f4d42f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Jul 26 22:32:55 2015 +0200

      net/dp8393x: do not use memory_region_init_rom_device with NULL

      Replace memory_region_init_rom_device() with memory_region_init_ram() and
      memory_region_set_readonly().
      This fixes a guest-triggerable QEMU crash when guest tries to write to PROM.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      [leon.alrae@imgtec.com: shorten subject length]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 30dfa9a46cd845db3f43f5c11b129f4a50941b02
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Fri Jul 24 20:42:23 2015 +0200

      net/dp8393x: remove check of runt packets

      Ethernet requires that messages are at least 64 bytes on the wire. This
      limitation does not exist on emulation (no wire message), so remove the
      check. Netcard is now able to receive small network packets.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f6351288b65130deb8102b17143f5d84f817a02a
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Fri Jul 24 20:42:21 2015 +0200

      net/dp8393x: disable user creation

      Netcard needs an address space to write data to, which can't be specified
      on command line.
      This fixes a crash when user starts QEMU with "-device dp8393x"

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 84a29c7efd02baa97b0d60d1e59e8357f7a5e0f1
  Merge: f8787f8 77c102c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 28 09:11:48 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc3

      # gpg: Signature made Mon Jul 27 16:19:17 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block: qemu-iotests - add check for multiplication overflow in vpc
        block: vpc - prevent overflow if max_table_entries >= 0x40000000

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da52a4dfcc4864fd2260ec4eab331f75b1f0240b
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Fri Jul 10 12:10:02 2015 +0100

      target-mips: fix offset calculation for Interrupts

      Correct computation of vector offsets for EXCP_EXT_INTERRUPT.
      For instance, if Cause.IV is 0 the vector offset should be 0x180.

      Simplify the finding vector number logic for the Vectored Interrupts.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      [leon.alrae@imgtec.com: cosmetic changes]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8bcbb834a015432bfb4d09a883c21f017eadd978
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Jul 22 14:59:23 2015 +0100

      target-mips: fix passing incompatible pointer type in machine.c

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 325e3904210c779a13fbbc9ee156056d045d7eee
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 22 14:27:47 2015 +0100

      block/ssh: Avoid segfault if inet_connect doesn't set errno.

      On some (but not all) systems:

        $ qemu-img create -f qcow2 overlay -b ssh://xen/
        Segmentation fault

      It turns out this happens when inet_connect returns -1 in the
      following code, but errno == 0.

        s->sock = inet_connect(s->hostport, errp);
        if (s->sock < 0) {
            ret = -errno;
            goto err;
        }

      In the test case above, no host called "xen" exists, so getaddrinfo fails.

      On Fedora 22, getaddrinfo happens to set errno = ENOENT (although it
      is *not* documented to do that), so it doesn't segfault.

      On RHEL 7, errno is not set by the failing getaddrinfo, so ret =
      -errno = 0, so the caller doesn't know there was an error and
      continues with a half-initialized BDRVSSHState struct, and everything
      goes south from there, eventually resulting in a segfault.

      Fix this by setting ret to -EIO (same as block/nbd.c and
      block/sheepdog.c).  The real error is saved in the Error** errp
      struct, so it is printed correctly:

        $ ./qemu-img create -f qcow2 overlay -b ssh://xen/
        qemu-img: overlay: address resolution failed for xen:22: No address associated with hostname

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reported-by: Jun Li
      BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1147343
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 6a55c82cece217ab99ed95a412fa7ddf5d5f257b
  Author: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
  Date:   Sat Jul 18 01:44:24 2015 +0900

      sheepdog: serialize requests to overwrapping area

      Current sheepdog driver only serializes create requests in oid
      unit. This mechanism isn't enough for handling requests to
      overwrapping area spanning multiple oids, so it can result bugs like
      below:
      https://bugs.launchpad.net/sheepdog-project/+bug/1456421

      This patch adds a new serialization mechanism for the problem. The
      difference from the old one is:
      1. serialize entire aiocb if their targetting areas overwrap
      2. serialize all requests (read, write, and discard), not only creates

      This patch also removes the old mechanism because the new one can be
      an alternative.

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
      Cc: Vasiliy Tolstov <v.tolstov@selfip.ru>
      Signed-off-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
      Tested-by: Vasiliy Tolstov <v.tolstov@selfip.ru>
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 52c91dac6bd891656f297dab76da51fc8bc61309
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 27 16:29:56 2015 +0200

      memory: do not add a reference to the owner of aliased regions

      Very often the owner of the aliased region is the same as the owner of the alias
      region itself.  When this happens, the reference count can never go back to 0 and
      the owner is leaked.  This is for example breaking hot-unplug of virtio-pci
      devices (the device cannot be plugged back again with the same id).

      Another common use for alias is to transform the system I/O address space
      into an MMIO regions; in this case the aliased region never dies, so there
      is no problem.  Otherwise the owner is always the same for aliasing
      and aliased region.

      I checked all calls to memory_region_init_alias introduced after commit
      dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the
      reference in order to keep the owner of the aliased region alive.

      Reported-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 55875fc4ca45a35e36134663ade946d86fe7bfcd
  Author: Salva Peiró <speirofr@gmail.com>
  Date:   Mon Jul 27 10:51:52 2015 +0200

      megasas: Add write function to handle write access to PCI BAR 3

      This patch fixes a QEMU SEGFAULT when a write operation is performed on
      the memory region of the PCI BAR 3 (base address space).
      When a writeb(0xe0000000) is performed the .write function is invoked to
      handle the write access, however, since the .write is not initialised,
      the call to 0, causes QEMU to SEGFAULT.

      Signed-off-by: Salva Peiró <speirofr@gmail.com>
      Acked-by: Hannes Reinecke <hare@suse.com>
      Message-Id: <1437987112-24744-1-git-send-email-speirofr@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c147b5153e733a14fc65d2098e7036754c185ad1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 27 18:39:37 2015 +0300

      virtio: minor cleanup

      There's no need for blk to set ANY_LAYOUT, it's
      done by virtio core as necessary.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ef3ea253b5aaaa00f3b9999f3ff19e74cfa26f8
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Sun Jul 26 11:00:51 2015 +0300

      acpi: fix pvpanic device is not shown in ui

      Commit 2332333c added a _STA method that hides the device. The fact
      that the device is not shown in the gui make it harder to install its
      Windows' device.

      https://bugzilla.redhat.com/show_bug.cgi?id=1238141

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 226d007dbd75ec8d0f12d0f9e1ce66caf55d49e4
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Fri Jul 24 18:52:31 2015 +0200

      gdbstub: Set current CPU on interruptions

      gdb expects that the thread ID for c and g-class operations is set to
      the CPU we provide when reporting VM stop conditions. If the stub is
      still tuned to a different CPU, the wrong information is delivered to
      the gdb frontend.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 801db5ecdac7575a1b0250243eea1767da553e50
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Fri Jul 3 11:51:01 2015 +0200

      qapi: add missing @

      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 786f9ce20382704249883d7052f6869011d44281
  Author: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
  Date:   Mon Jun 29 17:45:41 2015 +0200

      Fix Cortex-A9 global timer

      The auto increment bit of the timer control register was wrongly
      defined.

      See Cortex-A9 MPcore Technical Reference Manual, Section 4.4.2.

      Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e71e111e0544ec35af40c3dc29f21697c8f17bf
  Author: Michal Privoznik <mprivozn@redhat.com>
  Date:   Tue Jun 23 14:30:20 2015 +0200

      gitignore: Ignore shader generated files

      As of d98bc0b65 there are two files that are automatically generated:
      ui/shader/texture-blit-frag.h and /ui/shader/texture-blit-vert.h. None
      of them is wanted to be tracked by git. Put them into the ignore file
      then.

      Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7155f2ca9d66f5598fd8d071e71d6758019a6e48
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Jun 23 18:41:27 2015 +0200

      vmstate: remove unused declaration

      Since 38e0735e, register_device_unmigratable() has been removed

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f6288b9c88bae7d76d8bfe17e672976d79079296
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jul 18 16:54:32 2015 +0200

      make: Clean build messages

      We want to have uniform build messages, so fix some messages
      which did not follow the standard pattern.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ab6036630865eff8bb12dd51dfa6921b4607fc81
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 19 21:34:22 2015 +0100

      qemu-common.h: Document cutils.c string functions

      Add documentation comments for various utility string functions
      which we have implemented in util/cutils.c:
       pstrcpy()
       strpadcpy()
       pstrcat()
       strstart()
       stristart()
       qemu_strnlen()
       qemu_strsep()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit cc47a16bcbbc2d1f79511799ca3625c6522f5838
  Author: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
  Date:   Fri Jul 24 13:48:13 2015 +0530

      device_tree: Fix a typo

      Fix spelling of 'allocting' -> 'allocating'.

      Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f3c30aeaa7888aee96a1fa28f259fb8312d47ab2
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jul 24 20:16:01 2015 +0200

      hw/acpi/ich9: clean up stale comment about KVM not supporting SMM

      Commit fba72476c6 ("ich9: add smm_enabled field and arguments") detached
      SMM availability from kvm_enabled(). However, the comment in pm_reset()
      was not updated; let's do it now.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-trivial@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit be66680e8320d612f1c96096a217e642e458f47b
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jul 24 20:16:00 2015 +0200

      hw/acpi/ich9: clear smi_en on reset

      Otherwise on reboot firmware might think (due to APMC_EN remaining set
      from the previous boot) that SMI support is absent.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-trivial@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f8787f8723eaca1be99e3b1873e54de163fffa93
  Merge: edec47c bbeb823
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 19:37:09 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150727' into staging

      Fix buglets for 2.4

      # gpg: Signature made Mon Jul 27 15:26:48 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150727:
        tcg: mark temps as mem_coherent = 0 for mov with a constant
        tcg: correctly mark dead inputs for mov with a constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit edec47cfef96209987cb7922286cb384916aae02
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jul 24 13:42:55 2015 +0200

      main-loop: fix qemu_notify_event for aio_notify optimization

      aio_notify can be optimized away, and in fact almost always will.  However,
      qemu_notify_event is used in places where this is incorrect---most notably,
      when handling SIGTERM.  When aio_notify is optimized away, it is possible that
      QEMU enters a blocking ppoll immediately afterwards and stays there, without
      reaching main_loop_should_exit().

      Fix this by using a bottom half.  The bottom half can be optimized too, but
      scheduling it is enough for the ppoll not to block.  The hang is thus avoided.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1437738175-23624-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 77c102c26ead946fe7589d4bddcdfa5cb431ebfe
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Jul 24 10:26:52 2015 -0400

      block: qemu-iotests - add check for multiplication overflow in vpc

      This checks that VPC is able to successfully fail (without segfault)
      on an image file with a max_table_entries that exceeds 0x40000000.

      This table entry is within the valid range for VPC (although too large
      for this sample image).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b15deac79530d818092cb49a8021bcce83d71b5b
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Jul 24 10:26:51 2015 -0400

      block: vpc - prevent overflow if max_table_entries >= 0x40000000

      When we allocate the pagetable based on max_table_entries, we multiply
      the max table entry value by 4 to accomodate a table of 32-bit integers.
      However, max_table_entries is a uint32_t, and the VPC driver accepts
      ranges for that entry over 0x40000000.  So during this allocation:

      s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);

      The size arg overflows, allocating significantly less memory than
      expected.

      Since qemu_try_blockalign() size argument is size_t, cast the
      multiplication correctly to prevent overflow.

      The value of "max_table_entries * 4" is used elsewhere in the code as
      well, so store the correct value for use in all those cases.

      We also check the Max Tables Entries value, to make sure that it is <
      SIZE_MAX / 4, so we know the pagetable size will fit in size_t.

      Cc: qemu-stable@nongnu.org
      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3737129917c918767cdb8acd8ca6b342c45fa154
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 18:28:08 2015 +0100

      configure: Work around broken static pkg-config info for Ubuntu gnutls

      Unfortunately Ubuntu's pkg-config information for gnutls is broken
      for the static linking case, and outputs --libs options which the
      compiler does not recognize. Work around this problem by testing
      that the --cflags/--libs output will at least allow compilation
      before enabling gnutls support.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Message-id: 1437758888-22486-1-git-send-email-peter.maydell@linaro.org

  commit c9b11f971cfa1fd3eed716f62f4b835553b75490
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:21 2015 +0800

      virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device

      Chapter 6.3 of spec said

      "
      Transitional devices MUST offer, and if offered by the device
      transitional drivers MUST accept the following:

      VIRTIO_F_ANY_LAYOUT (27)
      "

      So this patch only clear VIRTIO_F_LAYOUT for legacy device.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit efb8206ca7f19f5a6ece1f2851a73a29de309b1e
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:20 2015 +0800

      virtio-blk: fail get_features when both scsi and 1.0 were set

      SCSI passthrough was no longer supported in virtio 1.0, so this patch
      fail the get_features() when both 1.0 and scsi is set. And also only
      advertise VIRTIO_BLK_F_SCSI for legacy virtio-blk device.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d5b731dd2d64deb3bc798ef4e3c08603d54ae02
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 27 17:49:19 2015 +0800

      virtio: get_features() can fail

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 27462695cde2a2208b1ff8074c2e917b8203590b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 27 11:06:17 2015 +0300

      virtio-pci: fix memory MR cleanup for modern

      Each memory_region_add_subregion must be paired with
      memory_region_del_subregion.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bbeb82395eaca0e3c38b433b2d2a5bad4a5fbd81
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jul 27 12:55:58 2015 +0200

      tcg: mark temps as mem_coherent = 0 for mov with a constant

      When a constant has to be loaded in a mov op, we fail to set
      mem_coherent = 0. This patch fixes that.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1437994568-7825-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7df69deadf2f25c19b3ac121404ee31f71dce845
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jul 27 12:55:57 2015 +0200

      tcg: correctly mark dead inputs for mov with a constant

      When tcg_reg_alloc_mov propagate a constant, we failed to correctly mark
      a temp as dead if the liveness analysis hints so. This fixes the
      following assert when configure with --enable-debug-tcg:

        qemu-x86_64: tcg/tcg.c:1827: tcg_reg_alloc_bb_end: Assertion `ts->val_type == TEMP_VAL_DEAD' failed.

      Cc: Richard Henderson <rth@twiddle.net>
      Reported-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1437994568-7825-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 122e7dab8ac549c8c5a9e1e13aa2464190e888de
  Merge: e40db4c f9f7492
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 14:53:42 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      Pull request

      Here are NIC fixes from Fam Zheng that prevent rx hangs (caused by NIC models
      where .can_receive() stops rx but qemu_flush_queued_packets() isn't called).

      # gpg: Signature made Mon Jul 27 14:51:48 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        axienet: Flush queued packets when rx is done
        dp8393x: Flush packets when link comes up
        stellaris_enet: Flush queued packets when read done
        mipsnet: Flush queued packets when receiving is enabled
        milkymist-minimac2: Flush queued packets when link comes up
        mcf_fec: Drop mcf_fec_can_receive
        etsec: Flush queue when rx buffer is consumed
        etsec: Move etsec_can_receive into etsec_receive
        usbnet: Drop usbnet_can_receive
        eepro100: Drop nic_can_receive
        pcnet: Drop pcnet_can_receive
        xgmac: Drop packets with eth_can_rx is false.
        hw/net: fix mcf_fec driver receiver
        hw/net: add simple phy support to mcf_fec driver
        hw/net: add ANLPAR bit definitions to generic mii
        hw/net: create common collection of MII definitions

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9f7492ea4a9dda538fedeec31399fb940533a16
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:13 2015 +0800

      axienet: Flush queued packets when rx is done

      eth_can_rx checks s->rxsize and returns false if it is non-zero. Because
      of the .can_receive semantics change, this will make the incoming queue
      disabled by peer, until it is explicitly flushed. So we should flush it
      when s->rxsize is becoming zero.

      Squash eth_can_rx semantics into etx_rx and drop .can_receive()
      callback, also add flush when rx buffer becomes available again after a
      packet gets queued.

      The other conditions, "!axienet_rx_resetting(s) &&
      axienet_rx_enabled(s)" are OK because enet_write already calls
      qemu_flush_queued_packets when the register bits are changed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-13-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4594f93a732f1f5936c3a5225481586e24bffa9e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:12 2015 +0800

      dp8393x: Flush packets when link comes up

      .can_receive callback changes semantics that once return 0, backend will
      try sending again until explicitly flushed, change the device to meet
      that.

      dp8393x_can_receive checks SONIC_CR_RXEN bit in SONIC_CR register and
      SONIC_ISR_RBE bit in SONIC_ISR register, try flushing the queue when
      either bit is being updated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-12-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ef4a6069f8b4c09c3383cd4b8e27b6ff25b2d41
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:11 2015 +0800

      stellaris_enet: Flush queued packets when read done

      If s->np reaches 31, the queue will be disabled by peer when it sees
      stellaris_enet_can_receive() returns false, until we explicitly flushes
      it which notifies the peer. Do this when guest is done reading all
      existing data.

      Move the semantics to stellaris_enet_receive, by returning 0 when the
      buffer is full, so that new packets will be queued.  In
      stellaris_enet_read, flush and restart the queue when guest has done
      reading.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-11-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1dd58ae0583c3d3fb15fa1d563d6b497558d3ad0
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:10 2015 +0800

      mipsnet: Flush queued packets when receiving is enabled

      Drop .can_receive and move the semantics to mipsnet_receive, by
      returning 0.

      After 0 is returned, we must flush the queue explicitly to restart it:
      Call qemu_flush_queued_packets when s->busy or s->rx_count is being
      updated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-10-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3b7031e9609baf710823aa7880fd9802b39c4563
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:09 2015 +0800

      milkymist-minimac2: Flush queued packets when link comes up

      Drop .can_receive and move the semantics into minimac2_rx, by returning
      0.

      That is once minimac2_rx returns 0, incoming packets will be queued
      until the queue is explicitly flushed. We do this when s->regs[R_STATE0]
      or s->regs[R_STATE1] is changed in minimac2_write.

      Also drop the unused trace point.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-9-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e813f0d8813944061fa9bde861cf6899379843e6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:08 2015 +0800

      mcf_fec: Drop mcf_fec_can_receive

      The semantics of .can_receive requires us to flush the queue explicitly
      when s->rx_enabled becomes true after it returns 0, but the packet being
      queued is not meaningful since the guest hasn't activated the card.
      Let's just drop the packet in this case.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-8-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 575bafd1f387c5f06b59cf2515f6bb1eff9d119d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:07 2015 +0800

      etsec: Flush queue when rx buffer is consumed

      The BH will be scheduled when etsec->rx_buffer_len is becoming 0, which
      is the condition of queuing.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436955553-22791-7-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b6cb6610c27c5b0773a340499f19c3477bf45aeb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:06 2015 +0800

      etsec: Move etsec_can_receive into etsec_receive

      When etsec_reset returns 0, peer would queue the packet as if
      .can_receive returns false. Drop etsec_can_receive and let etsec_receive
      carry the semantics.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 913440249ea2e697177e9d43167ac325a8dfe907
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:05 2015 +0800

      usbnet: Drop usbnet_can_receive

      usbnet_receive already drops packet if rndis_state is not
      RNDIS_DATA_INITIALIZED, and queues packet if in buffer is not available.
      The only difference is s->dev.config but that is similar to rndis_state.

      Drop usbnet_can_receive and move these checks to usbnet_receive, so that
      we don't need to explicitly flush the queue when s->dev.config changes
      value.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 363db4b249244f31d3c47fbd5a8b128c95ba8fe7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:04 2015 +0800

      eepro100: Drop nic_can_receive

      nic_receive already checks the conditions and drop packets if false.
      Due to the new semantics since 6e99c63 ("net/socket: Drop
      net_socket_can_send"), having .can_receive returning 0 requires us to
      explicitly flush the queued packets when the conditions are becoming
      true, but queuing the packets when guest driver is not ready doesn't
      make much sense.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0ba0b9b6b402d738f11f27eea6c94d97bf84cbf
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:03 2015 +0800

      pcnet: Drop pcnet_can_receive

      pcnet_receive already checks the conditions and drop packets if false.
      Due to the new semantics since 6e99c63 ("net/socket: Drop
      net_socket_can_send"), having .can_receive returning 0 requires us to
      explicitly flush the queued packets when the conditions are becoming
      true, but queuing the packets when guest driver is not ready doesn't
      make much sense.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8c8c460c5f38f878675631a66286a6e87bb4d111
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 18:19:02 2015 +0800

      xgmac: Drop packets with eth_can_rx is false.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1436955553-22791-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 491a1f494ed4c0d1a8593dd04b645f8e63c4cfae
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:16 2015 +1000

      hw/net: fix mcf_fec driver receiver

      The network mcf_fec driver emulated receive side method is returning a
      result of 0 causing the network layer to disable receive for this emulated
      device. This results in the guest only ever receiving one packet.

      Fix the recieve side processing to return the number of bytes that we
      passed back through to the guest.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-5-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 299f7bec5a109db7563e1286cedf1f4d84e69e6d
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:15 2015 +1000

      hw/net: add simple phy support to mcf_fec driver

      The Linux fec driver needs at least basic phy support to probe and work.
      The current qemu mcf_fec emulation has no support for the reading or
      writing of the MDIO lines to access an attached phy.

      This code adds a very simple set of register results for a fixed phy
      setup - very similar to that used on an m5208evb board. This is enough
      to probe and identify an emulated attached phy.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-4-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3634869b27b6b2ff538bcc5bf8dfd1235ede7034
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:14 2015 +1000

      hw/net: add ANLPAR bit definitions to generic mii

      Add a base set of bit definitions for the standard MII phy "Auto-Negotiation
      Link Partner Ability Register" (ANLPAR).

      The original definitions moved into mii.h from the allwinner_emac driver
      did not define these.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-3-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3e230569bf16aa36562967cd76b742c6824481b1
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 26 15:27:13 2015 +1000

      hw/net: create common collection of MII definitions

      Create a common set of definitions of address and register values for
      ethernet MII phys. A few of the current ethernet drivers have at least
      a partial set of these definitions. Others just use hard coded raw
      constant numbers.

      This initial set is copied directly from the allwinner_emac code.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435296436-12152-2-git-send-email-gerg@uclinux.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e40db4c6d391419c0039fe274c74df32a6ca1a28
  Merge: f793d97 cb72cba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 27 13:10:00 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/cve-2015-5154-pull-request' into staging

      # gpg: Signature made Mon Jul 27 13:01:10 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/cve-2015-5154-pull-request:
        ide: Clear DRQ after handling all expected accesses
        ide/atapi: Fix START STOP UNIT command completion
        ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 019c2ab8623daee210df8b1085a33b1e83c9ee11
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Jul 21 09:55:02 2015 +0100

      crypto: extend unit tests to cover decryption too

      The current unit test only verifies the encryption API,
      resulting in us missing a recently introduced bug in the
      decryption API from commit d3462e3. It was fortunately
      later discovered & fixed by commit bd09594, thanks to the
      QEMU I/O tests for qcow2 encryption, but we should really
      detect this directly in the crypto unit tests. Also remove
      an accidental debug message and simplify some asserts.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1437468902-23230-1-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6775e2c4298618828de9bb3c5584d4de20120e46
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Fri Jul 24 13:23:54 2015 +0100

      crypto: fix built-in AES decrypt function

      The qcrypto_cipher_decrypt_aes method was using the wrong
      key material, and passing the wrong mode. This caused it
      to incorrectly decrypt ciphertext.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1437740634-6261-1-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 09999a5f7fc8e3636feda4358a79a25a09467594
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 22 12:32:25 2015 +0300

      virtio: set any_layout in virtio core

      Exceptions:
          - virtio-blk
          - compat machine types

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cd4bfbb20d957a480032e2626ef1188b62c74d00
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 23 20:57:53 2015 +0300

      virtio-9p: fix any_layout

      virtio pci allows any device to have a modern interface,
      this in turn requires ANY_LAYOUT support.
      Fix up ANY_LAYOUT for virtio-9p.

      Reported-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 7882080388be5088e72c425b02223c02e6cb4295
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 23 17:52:02 2015 +0300

      virtio-serial: fix ANY_LAYOUT

      Don't assume a specific layout for control messages.
      Required by virtio 1.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 5f456073aa9ba54e421aa82dd38e4d40d0a0af85
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 22 13:09:25 2015 +0300

      virtio: hide legacy features from modern guests

      NOTIFY_ON_EMPTY, ANY_LAYOUT and BAD are only valid on the legacy
      interface.

      Hide them from modern guests.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cb72cba83021fa42719e73a5249c12096a4d1cfc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide: Clear DRQ after handling all expected accesses

      This is additional hardening against an end_transfer_func that fails to
      clear the DRQ status bit. The bit must be unset as soon as the PIO
      transfer has completed, so it's better to do this in a central place
      instead of duplicating the code in all commands (and forgetting it in
      some).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit 03441c3a4a42beb25460dd11592539030337d0f8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide/atapi: Fix START STOP UNIT command completion

      The command must be completed on all code paths. START STOP UNIT with
      pwrcnd set should succeed without doing anything.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit d2ff85854512574e7209f295e87b0835d5b032c6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Sun Jul 26 23:42:53 2015 -0400

      ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

      If the end_transfer_func of a command is called because enough data has
      been read or written for the current PIO transfer, and it fails to
      correctly call the command completion functions, the DRQ bit in the
      status register and s->end_transfer_func may remain set. This allows the
      guest to access further bytes in s->io_buffer beyond s->data_end, and
      eventually overflowing the io_buffer.

      One case where this currently happens is emulation of the ATAPI command
      START STOP UNIT.

      This patch fixes the problem by adding explicit array bounds checks
      before accessing the buffer instead of relying on end_transfer_func to
      function correctly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit f793d97e454a56d17e404004867985622ca1a63b
  Merge: 30fdfae 178846b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 13:07:10 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * qemu-char fixes
      * SCSI fixes (including CVE-2015-5158)
      * RCU fixes
      * Framebuffer logic to set DIRTY_MEMORY_VGA
      * Fix compiler warning for --disable-vnc
      * qemu-doc fixes
      * x86 TCG pasto fix

      # gpg: Signature made Fri Jul 24 12:57:52 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        target-i386/FPU: a misprint in helper_fistll_ST0
        qemu-doc: fix typos
        framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer
        memory: count number of active VGA logging clients
        vl: Fix compiler warning for builds without VNC
        scsi: Handle no media case for scsi_get_configuration
        rcu: actually register threads that have RCU read-side critical sections
        scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)
        vnc: fix memory leak
        qemu-char: Fix missed data on unix socket
        qemu-char: handle EINTR for TCP character devices
        exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 178846bdd93994c1acafe4423f99ead8bb24cf38
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Wed Jul 8 12:48:40 2015 +0300

      target-i386/FPU: a misprint in helper_fistll_ST0

      There is a cut-and-paste mistake in the patch
      https://lists.gnu.org/archive/html/qemu-devel/2014-11/msg01657.html .
      It cause errors in guest work.  Here is the bugfix.

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Reported-by: Kirill Batuzov <batuzovk@ispras.ru>
      Message-Id: <2692911436348920@web2m.yandex.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d274e07c6df4cc8207b01892ff6f81118ea6083c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 3 17:50:57 2015 +0800

      qemu-doc: fix typos

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1435917057-9396-1-git-send-email-arei.gonglei@huawei.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c1076c3e13a86140cc2ba29866512df8460cc7c2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 13 12:00:29 2015 +0200

      framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer

      The MemoryRegionSection contains enough information to access the
      RAM region underlying the framebuffer, and can be cached inside the
      display device.

      By doing this, the new framebuffer_update_memory_section function can
      enable dirty memory logging on the relevant RAM region.  The function
      must be called whenever the stride or base of the framebuffer changes;
      a simple way to cover these cases is to call it on every full frame
      invalidation, which is a rare case.

      framebuffer_update_display now works entirely on a MemoryRegionSection,
      without going through cpu_physical_memory_map/unmap.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit deb809edb85334c8e90530e1071b98f4da25ebaa
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 13:56:53 2015 +0200

      memory: count number of active VGA logging clients

      For a board that has multiple framebuffer devices, both of them
      might want to use DIRTY_MEMORY_VGA on the same memory region.
      The lack of reference counting in memory_region_set_log makes
      this very awkward to implement.

      Suggested-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb4309695905de889d318caec8eb13d3b2c118d5
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Jul 22 19:53:30 2015 +0200

      vl: Fix compiler warning for builds without VNC

      This regression was caused by commit 70b94331.

        CC    vl.o
      vl.c: In function ‘select_display’:
      vl.c:2064:12: error: unused variable ‘err’ [-Werror=unused-variable]
           Error *err = NULL;
                  ^

      Reported-by: Claudio Fontana <claudio.fontana@huawei.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1437587610-26433-1-git-send-email-sw@weilnetz.de>
      Reviewed-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7d99f4c1b5d12de7644a5bd8c3d46bff05c9ca7c
  Author: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
  Date:   Wed Jul 15 14:52:32 2015 -0400

      scsi: Handle no media case for scsi_get_configuration

      Currently, scsi_get_configuration always returns a current
      profile (DVD or CD), even when there is actually no media present.
      By comparison, ide/atapi uses a default profile of 0 (MMC_PROFILE_NONE)
      for this case and checks for tray_open, so let's do the same for scsi.

      This fixes a problem I'm seeing with Fedora 22 guests where systemd
      cdrom_id fails to unmount after a QEMU-initiated eject against a
      scsi cdrom device because it believes the media is still present
      (but unreadable).

      Signed-off-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Message-Id: <1436986352-10695-1-git-send-email-mjrosato@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ab28bd23125fb4a0411c3a3f01c4edacbc261486
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 08:55:38 2015 +0200

      rcu: actually register threads that have RCU read-side critical sections

      Otherwise, grace periods are detected too early!

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c170aad8b057223b1139d72e5ce7acceafab4fa9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 08:59:39 2015 +0200

      scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)

      This is a guest-triggerable buffer overflow present in QEMU 2.2.0
      and newer.  scsi_cdb_length returns -1 as an error value, but the
      caller does not check it.

      Luckily, the massive overflow means that QEMU will just SIGSEGV,
      making the impact much smaller.

      Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com>
      Fixes: 1894df02811f6b79ea3ffbf1084599d96f316173
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 60928458e5eea3c77a7eb0a4194927872f463947
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Jul 22 17:08:53 2015 +0800

      vnc: fix memory leak

      If vnc's password is configured, it will leak memory
      which cipher variable pointed on every vnc connection.

      Cc: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1437556133-11268-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 30fdfae49d53cfc678859095e49ac60b79562d6f
  Merge: f75b709 9615212
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 11:11:30 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150723' into staging

      Last minute fixes for 2.4.

      # gpg: Signature made Fri Jul 24 04:42:31 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150723:
        tcg/optimize: fix tcg_opt_gen_movi
        tcg/aarch64: use 32-bit offset for 32-bit softmmu emulation
        tcg/aarch64: use 32-bit offset for 32-bit user-mode emulation
        tcg/aarch64: add ext argument to tcg_out_insn_3310
        tcg/i386: Extend addresses for 32-bit guests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f75b709853d2b2b0f2a8e149229aa1c7c1ee1c60
  Merge: 12e21eb 759b484
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 24 09:17:44 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-fixes-20150723.0' into staging

      VFIO fixes for v2.4.0-rc3
      - Fix Realtek NIC quirk (Alex Williamson)
      - Restore bootindex functionality (Alex Williamson)

      # gpg: Signature made Thu Jul 23 19:51:23 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-fixes-20150723.0:
        vfio/pci: Fix bootindex
        vfio/pci: Fix RTL8168 NIC quirks

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 961521261a3d600b0695b2e6d2b0f490076f7e90
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jul 10 18:03:30 2015 +0200

      tcg/optimize: fix tcg_opt_gen_movi

      Due to a copy&paste, the new op value is tested against mov_i32 instead
      of movi_i32. The test is therefore always false. Fix that.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1436544211-2769-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 80adb8fcad4778376a11d394a9e01516819e2327
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 23 18:04:52 2015 -0400

      tcg/aarch64: use 32-bit offset for 32-bit softmmu emulation

      Similar to the same fix for user-mode, except this instance
      occurs on the softmmu path.  Again, the tlb addend must be
      the base register, while the guest address is the index.

      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ffc6372851d8631a9f9fa56ec613b3244dc635b9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jul 15 17:27:01 2015 +0200

      tcg/aarch64: use 32-bit offset for 32-bit user-mode emulation

      Thanks to the previous patch, it is now easy for tcg_out_qemu_ld and
      tcg_out_qemu_st to use a 32-bit zero extended offset.  However, the
      guest base register x28 must be the base and addr_reg must be the
      index.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1436974021-28978-3-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 6c0f0c0f124718650a8d682ba275044fc02f6fe2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jul 15 17:27:00 2015 +0200

      tcg/aarch64: add ext argument to tcg_out_insn_3310

      The new argument lets you pick uxtw or uxtx mode for the offset
      register.  For now, all callers pass TCG_TYPE_I64 so that uxtx
      is generated.  The bits for uxtx are removed from I3312_TO_I3310.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1436974021-28978-2-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ee8ba9e4d8458b8bba5455a7ae704620c4f2ef4b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 16 22:25:49 2015 +0100

      tcg/i386: Extend addresses for 32-bit guests

      Removing the ??? comment explaining why it (mostly) worked.

      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Message-Id: <1437081950-7206-2-git-send-email-rth@twiddle.net>

  commit 12e21eb088a51161c78ee39ed54ac56ebcff4243
  Merge: b69b305 6b26996
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 23 12:54:53 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-22

      # gpg: Signature made Wed Jul 22 19:11:04 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4bf1cb03fbc43b0055af60d4ff093d6894aa4338
  Author: Nils Carlson <pyssling@ludd.ltu.se>
  Date:   Sun Jul 19 20:39:56 2015 +0000

      qemu-char: Fix missed data on unix socket

      Commit 812c1057 introduced HUP detection on unix and tcp sockets prior
      to a read in tcp_chr_read. This unfortunately broke CloudStack 4.2
      which relied on the old behaviour where data on a socket was readable
      even if a HUP was present.

      A working solution is to properly check the return values from recv,
      handling a closed socket once there is no more data to read.

      Also enable polling for G_IO_NVAL to ensure the callback is called
      for all possible events as these should now be possible to handle
      with the improved error detection.

      Signed-off-by: Nils Carlson <pyssling@ludd.ltu.se>
      Message-Id: <1437338396-22336-1-git-send-email-pyssling@ludd.ltu.se>
      [Do not handle EINTR; use socket_error(). - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9172f428afc1461b1d9b33ebca3a679b9adf7c3a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 09:25:54 2015 +0200

      qemu-char: handle EINTR for TCP character devices

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0b8e2c1002afddc8ef3d52fa6fc29e4768429f98
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 12:27:16 2015 +0100

      exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()

      When accessing the dispatch pointer in an AddressSpace within an RCU
      critical section we should always use atomic_rcu_read(). Fix an
      access within memory_region_section_get_iotlb() which was incorrectly
      doing a direct pointer access.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1437391637-31576-1-git-send-email-peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 759b484c5d7f92bd01f98797c07e8543ee187888
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Jul 22 14:56:01 2015 -0600

      vfio/pci: Fix bootindex

      bootindex was incorrectly changed to a device Property during the
      platform code split, resulting in it no longer working.  Remove it.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Cc: qemu-stable@nongnu.org # v2.3+

  commit 69970fcef937bddd7f745efe39501c7716fdfe56
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Jul 22 14:56:01 2015 -0600

      vfio/pci: Fix RTL8168 NIC quirks

      The RTL8168 quirk correctly describes using bit 31 as a signal to
      mark a latch/completion, but the code mistakenly uses bit 28.  This
      causes the Realtek driver to spin on this register for quite a while,
      20k cycles on Windows 7 v7.092 driver.  Then it gets frustrated and
      tries to set the bit itself and spins for another 20k cycles.  For
      some this still results in a working driver, for others not.  About
      the only thing the code really does in its current form is protect
      the guest from sneaking in writes to the real hardware MSI-X table.
      The fix is obviously to use bit 31 as we document that we should.

      The other problem doesn't seem to affect current drivers as nobody
      seems to use these window registers for writes to the MSI-X table, but
      we need to use the stored data when a write is triggered, not the
      value of the current write, which only provides the offset.

      Note that only the Windows drivers from Realtek seem to use these
      registers, the Microsoft drivers provided with Windows 8.1 do not
      access them, nor do Linux in-kernel drivers.

      Link: https://bugs.launchpad.net/qemu/+bug/1384892
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Cc: qemu-stable@nongnu.org # v2.1+

  commit 6b2699672d5b56f8c2902fb9db9879e8cafb2afe
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jul 16 17:29:12 2015 -0300

      hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init()

      This fixes the following crash, introduced by commit
      49d2e648e8087d154d8bf8b91f27c8e05e79d5a6:

        $ gdb --args qemu-system-x86_64 -machine pc,mem-merge=off -object memory-backend-ram,id=ram-node0,size=1024
        [...]
        Program received signal SIGABRT, Aborted.
        (gdb) bt
        #0  0x00007ffff253b8c7 in raise () at /lib64/libc.so.6
        #1  0x00007ffff253d52a in abort () at /lib64/libc.so.6
        #2  0x00007ffff253446d in __assert_fail_base () at /lib64/libc.so.6
        #3  0x00007ffff2534522 in  () at /lib64/libc.so.6
        #4  0x00005555558bb80a in qemu_opt_get_bool_helper (opts=0x55555621b650, name=name@entry=0x5555558ec922 "mem-merge", defval=defval@entry=true, del=del@entry=false) at qemu/util/qemu-option.c:388
        #5  0x00005555558bbb5a in qemu_opt_get_bool (opts=<optimized out>, name=name@entry=0x5555558ec922 "mem-merge", defval=defval@entry=true) at qemu/util/qemu-option.c:398
        #6  0x0000555555720a24 in host_memory_backend_init (obj=0x5555562ac970) at qemu/backends/hostmem.c:226

      Instead of using qemu_opt_get_bool(), that didn't work with
      qemu_machine_opts for a long time, we can use the corresponding
      MachineState fields.

      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b69b30532e0a80e25449244c01b0cbed000c99a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 18:17:19 2015 +0100

      Update version for v2.4.0-rc2 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3edf6b3f1e68104dba692337fdcecdba39e73c59
  Merge: dc94bd9 a52b2cb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 16:22:49 2015 +0100

      Merge remote-tracking branch 'remotes/elmarco/tags/for-upstream' into staging

      qxl: build fix for 2.4

      # gpg: Signature made Wed Jul 22 15:55:00 2015 BST using DSA key ID F43F0992
      # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>"
      # gpg:                 aka "Marc-Andre Lureau <marcandre.lureau@gmail.com>"
      # gpg:                 aka "Marc-Andre Lureau <marc-andre.lureau@nokia.com>"
      # gpg:                 aka "Marc-André Lureau <marc-andre.lureau@nokia.com>"
      # gpg:                 aka "Marc-André Lureau (elmarco) <marcandre.lureau@gmail.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7346 2483 9404 4E20 ABFF  7D48 D864 9487 F43F 0992

      * remotes/elmarco/tags/for-upstream:
        qxl: Fix new function name for spice-server library

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a52b2cbf218d52f9e357961acb271a98a2bdff71
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Mon Jul 20 09:43:23 2015 +0100

      qxl: Fix new function name for spice-server library

      The new spice-server function to limit the number of monitors (0.12.6)
      changed while development from spice_qxl_set_monitors_config_limit to
      spice_qxl_max_monitors (accepted upstream).
      By mistake I post patch with former name.
      This patch fix the function name.

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Acked-by: Christophe Fergeau <cfergeau@redhat.com>
      Acked-by: Martin Kletzander <mkletzan@redhat.com>
      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

  commit dc94bd9166af5236a56bd5bb06845911915a925c
  Merge: b9c4630 05e514b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 22 12:52:34 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Wed Jul 22 12:43:35 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        AioContext: optimize clearing the EventNotifier
        AioContext: fix broken placement of event_notifier_test_and_clear
        AioContext: fix broken ctx->dispatching optimization
        aio-win32: reorganize polling loop
        tests: remove irrelevant assertions from test-aio
        qemu-timer: initialize "timers_done_ev" to set
        mirror: Speed up bitmap initial scanning

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 05e514b1d4d5bd4209e2c8bbc76ff05c85a235f3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:53 2015 +0200

      AioContext: optimize clearing the EventNotifier

      It is pretty rare for aio_notify to actually set the EventNotifier.  It
      can happen with worker threads such as thread-pool.c's, but otherwise it
      should never be set thanks to the ctx->notify_me optimization.  The
      previous patch, unfortunately, added an unconditional call to
      event_notifier_test_and_clear; now add a userspace fast path that
      avoids the call.

      Note that it is not possible to do the same with event_notifier_set;
      it would break, as proved (again) by the included formal model.

      This patch survived over 3000 reboots on aarch64 KVM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 21a03d17f2edb1e63f7137d97ba355cc6f19d79f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:52 2015 +0200

      AioContext: fix broken placement of event_notifier_test_and_clear

      event_notifier_test_and_clear must be called before processing events.
      Otherwise, an aio_poll could "eat" the notification before the main
      I/O thread invokes ppoll().  The main I/O thread then never wakes up.
      This is an example of what could happen:

         i/o thread       vcpu thread                     worker thread
         ---------------------------------------------------------------------
         lock_iothread
         notify_me = 1
         ...
         unlock_iothread
                                                           bh->scheduled = 1
                                                           event_notifier_set
                          lock_iothread
                          notify_me = 3
                          ppoll
                          notify_me = 1
                          aio_dispatch
                           aio_bh_poll
                            thread_pool_completion_bh
                                                           bh->scheduled = 1
                                                           event_notifier_set
                           node->io_read(node->opaque)
                            event_notifier_test_and_clear
         ppoll
         *** hang ***

      "Tracing" with qemu_clock_get_ns shows pretty much the same behavior as
      in the previous bug, so there are no new tricks here---just stare more
      at the code until it is apparent.

      One could also use a formal model, of course.  The included one shows
      this with three processes: notifier corresponds to a QEMU thread pool
      worker, temporary_waiter to a VCPU thread that invokes aio_poll(),
      waiter to the main I/O thread.  I would be happy to say that the
      formal model found the bug for me, but actually I wrote it after the
      fact.

      This patch is a bit of a big hammer.  The next one optimizes it,
      with help (this time for real rather than a posteriori :)) from
      another, similar formal model.

      Reported-by: Richard W. M. Jones <rjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit eabc977973103527bbb8fed69c91cfaa6691f8ab
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:51 2015 +0200

      AioContext: fix broken ctx->dispatching optimization

      This patch rewrites the ctx->dispatching optimization, which was the cause
      of some mysterious hangs that could be reproduced on aarch64 KVM only.
      The hangs were indirectly caused by aio_poll() and in particular by
      flash memory updates's call to blk_write(), which invokes aio_poll().
      Fun stuff: they had an extremely short race window, so much that
      adding all kind of tracing to either the kernel or QEMU made it
      go away (a single printf made it half as reproducible).

      On the plus side, the failure mode (a hang until the next keypress)
      made it very easy to examine the state of the process with a debugger.
      And there was a very nice reproducer from Laszlo, which failed pretty
      often (more than half of the time) on any version of QEMU with a non-debug
      kernel; it also failed fast, while still in the firmware.  So, it could
      have been worse.

      For some unknown reason they happened only with virtio-scsi, but
      that's not important.  It's more interesting that they disappeared with
      io=native, making thread-pool.c a likely suspect for where the bug arose.
      thread-pool.c is also one of the few places which use bottom halves
      across threads, by the way.

      I hope that no other similar bugs exist, but just in case :) I am
      going to describe how the successful debugging went...  Since the
      likely culprit was the ctx->dispatching optimization, which mostly
      affects bottom halves, the first observation was that there are two
      qemu_bh_schedule() invocations in the thread pool: the one in the aio
      worker and the one in thread_pool_completion_bh.  The latter always
      causes the optimization to trigger, the former may or may not.  In
      order to restrict the possibilities, I introduced new functions
      qemu_bh_schedule_slow() and qemu_bh_schedule_fast():

           /* qemu_bh_schedule_slow: */
           ctx = bh->ctx;
           bh->idle = 0;
           if (atomic_xchg(&bh->scheduled, 1) == 0) {
               event_notifier_set(&ctx->notifier);
           }

           /* qemu_bh_schedule_fast: */
           ctx = bh->ctx;
           bh->idle = 0;
           assert(ctx->dispatching);
           atomic_xchg(&bh->scheduled, 1);

      Notice how the atomic_xchg is still in qemu_bh_schedule_slow().  This
      was already debated a few months ago, so I assumed it to be correct.
      In retrospect this was a very good idea, as you'll see later.

      Changing thread_pool_completion_bh() to qemu_bh_schedule_fast() didn't
      trigger the assertion (as expected).  Changing the worker's invocation
      to qemu_bh_schedule_slow() didn't hide the bug (another assumption
      which luckily held).  This already limited heavily the amount of
      interaction between the threads, hinting that the problematic events
      must have triggered around thread_pool_completion_bh().

      As mentioned early, invoking a debugger to examine the state of a
      hung process was pretty easy; the iothread was always waiting on a
      poll(..., -1) system call.  Infinite timeouts are much rarer on x86,
      and this could be the reason why the bug was never observed there.
      With the buggy sequence more or less resolved to an interaction between
      thread_pool_completion_bh() and poll(..., -1), my "tracing" strategy was
      to just add a few qemu_clock_get_ns(QEMU_CLOCK_REALTIME) calls, hoping
      that the ordering of aio_ctx_prepare(), aio_ctx_dispatch, poll() and
      qemu_bh_schedule_fast() would provide some hint.  The output was:

          (gdb) p last_prepare
          $3 = 103885451
          (gdb) p last_dispatch
          $4 = 103876492
          (gdb) p last_poll
          $5 = 115909333
          (gdb) p last_schedule
          $6 = 115925212

      Notice how the last call to qemu_poll_ns() came after aio_ctx_dispatch().
      This makes little sense unless there is an aio_poll() call involved,
      and indeed with a slightly different instrumentation you can see that
      there is one:

          (gdb) p last_prepare
          $3 = 107569679
          (gdb) p last_dispatch
          $4 = 107561600
          (gdb) p last_aio_poll
          $5 = 110671400
          (gdb) p last_schedule
          $6 = 110698917

      So the scenario becomes clearer:

         iothread                   VCPU thread
      --------------------------------------------------------------------------
         aio_ctx_prepare
         aio_ctx_check
         qemu_poll_ns(timeout=-1)
                                    aio_poll
                                      aio_dispatch
                                        thread_pool_completion_bh
                                          qemu_bh_schedule()

      At this point bh->scheduled = 1 and the iothread has not been woken up.
      The solution must be close, but this alone should not be a problem,
      because the bottom half is only rescheduled to account for rare situations
      (see commit 3c80ca1, thread-pool: avoid deadlock in nested aio_poll()
      calls, 2014-07-15).

      Introducing a third thread---a thread pool worker thread, which
      also does qemu_bh_schedule()---does bring out the problematic case.
      The third thread must be awakened *after* the callback is complete and
      thread_pool_completion_bh has redone the whole loop, explaining the
      short race window.  And then this is what happens:

                                                            thread pool worker
      --------------------------------------------------------------------------
                                                            <I/O completes>
                                                            qemu_bh_schedule()

      Tada, bh->scheduled is already 1, so qemu_bh_schedule() does nothing
      and the iothread is never woken up.  This is where the bh->scheduled
      optimization comes into play---it is correct, but removing it would
      have masked the bug.

      So, what is the bug?

      Well, the question asked by the ctx->dispatching optimization ("is any
      active aio_poll dispatching?") was wrong.  The right question to ask
      instead is "is any active aio_poll *not* dispatching", i.e. in the prepare
      or poll phases?  In that case, the aio_poll is sleeping or might go to
      sleep anytime soon, and the EventNotifier must be invoked to wake
      it up.

      In any other case (including if there is *no* active aio_poll at all!)
      we can just wait for the next prepare phase to pick up the event (e.g. a
      bottom half); the prepare phase will avoid the blocking and service the
      bottom half.

      Expressing the invariant with a logic formula, the broken one looked like:

         !(exists(thread): in_dispatching(thread)) => !optimize

      or equivalently:

         !(exists(thread):
                in_aio_poll(thread) && in_dispatching(thread)) => !optimize

      In the correct one, the negation is in a slightly different place:

         (exists(thread):
               in_aio_poll(thread) && !in_dispatching(thread)) => !optimize

      or equivalently:

         (exists(thread): in_prepare_or_poll(thread)) => !optimize

      Even if the difference boils down to moving an exclamation mark :)
      the implementation is quite different.  However, I think the new
      one is simpler to understand.

      In the old implementation, the "exists" was implemented with a boolean
      value.  This didn't really support well the case of multiple concurrent
      event loops, but I thought that this was okay: aio_poll holds the
      AioContext lock so there cannot be concurrent aio_poll invocations, and
      I was just considering nested event loops.  However, aio_poll _could_
      indeed be concurrent with the GSource.  This is why I came up with the
      wrong invariant.

      In the new implementation, "exists" is computed simply by counting how many
      threads are in the prepare or poll phases.  There are some interesting
      points to consider, but the gist of the idea remains:

      1) AioContext can be used through GSource as well; as mentioned in the
      patch, bit 0 of the counter is reserved for the GSource.

      2) the counter need not be updated for a non-blocking aio_poll, because
      it won't sleep forever anyway.  This is just a matter of checking
      the "blocking" variable.  This requires some changes to the win32
      implementation, but is otherwise not too complicated.

      3) as mentioned above, the new implementation will not call aio_notify
      when there is *no* active aio_poll at all.  The tests have to be
      adjusted for this change.  The calls to aio_notify in async.c are fine;
      they only want to kick aio_poll out of a blocking wait, but need not
      do anything if aio_poll is not running.

      4) nested aio_poll: these just work with the new implementation; when
      a nested event loop is invoked, the outer event loop is never in the
      prepare or poll phases.  The outer event loop thus has already decremented
      the counter.

      Reported-by: Richard W. M. Jones <rjones@redhat.com>
      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6493c975af75be5b8d9ade954239bdf5492b7911
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:50 2015 +0200

      aio-win32: reorganize polling loop

      Preparatory bugfixes and tweaks to the loop before the next patch:

      - disable dispatch optimization during aio_prepare.  This fixes a bug.

      - do not modify "blocking" until after the first WaitForMultipleObjects
      call.  This is needed in the next patch.

      - change the loop to do...while.  This makes it obvious that the loop
      is always entered at least once.  In the next patch this is important
      because the first iteration undoes the ctx->notify_me increment that
      happened before entering the loop.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 12d69ac03b45156356b240424623719f15d8143e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:49 2015 +0200

      tests: remove irrelevant assertions from test-aio

      In these tests, the purpose of the initial calls to aio_poll and
      g_main_context_iteration is simply to put the AioContext in a
      known state; the return value of the function does not really
      matter.  The next patch will change those return values; change
      the assertions to a while loop which expresses the intention
      better.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4efd8a488d0a68b0af34d8ee245463df7c8bdf4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 21 16:07:48 2015 +0200

      qemu-timer: initialize "timers_done_ev" to set

      The normal value for the event is to be set.  If we do not do
      this, pause_all_vcpus (through qemu_clock_enable) hangs unless
      timerlist_run_timers has been run at least once for the timerlist.
      This can happen with the following patches, that make aio_notify do
      nothing most of the time.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Message-id: 1437487673-23740-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 999006975840f8cdf2038a587d852a6cbfe58e3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jul 9 11:47:58 2015 +0800

      mirror: Speed up bitmap initial scanning

      Limiting to sectors_per_chunk for each bdrv_is_allocated_above is slow,
      because the underlying protocol driver would issue much more queries
      than necessary. We should coalesce the query.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: <1436413678-7114-4-git-send-email-famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b9c46307996856d03ddc1527468ff5401ac03a79
  Merge: 774ee47 5f8343d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 20:56:20 2015 +0100

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-07-21-tag' into staging

      tag for qga-pull-2015-07-21

      Small fix to correct schema versioning annotations for recently-added
      GuestDiskBusType enum values. Not the end of the world, but ideally
      this inconsistency would be corrected prior to 2.4 release.

      # gpg: Signature made Tue Jul 21 20:43:24 2015 BST using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-07-21-tag:
        qga: fixed versions for guest bus types in qapi-schema

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f8343d0670e91adadb7898304c8ed4355af05a2
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Tue Jul 21 15:25:08 2015 +0300

      qga: fixed versions for guest bus types in qapi-schema

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      *added semi-colon to better delineate 2.2 vs. 2.4 versioning
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 774ee4772b6838b78741ea52d4bf26b8922244c5
  Merge: a1bc040 57b7309
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 12:21:08 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150721' into staging

      target-arm queue:
       * don't sync CNTVCT with kernel all the time (fixes VM time weirdnesses)
       * fix a warning compiling disas/arm-a64 with -Wextra

      # gpg: Signature made Tue Jul 21 12:15:33 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150721:
        disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR
        target-arm: kvm: Differentiate registers based on write-back levels

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57b73090e041ece40cc619a3c43a6fafcb3dd647
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Tue Jul 21 11:18:45 2015 +0100

      disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR

      Type fprintf_function which fits here was defined with this attribute.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1437208027-14584-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b7a6bf402bd064605c287eecadc493ccf2d4897
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jul 21 11:18:45 2015 +0100

      target-arm: kvm: Differentiate registers based on write-back levels

      Some registers like the CNTVCT register should only be written to the
      kernel as part of machine initialization or on vmload operations, but
      never during runtime, as this can potentially make time go backwards or
      create inconsistent time observations between VCPUs.

      Introduce a list of registers that should not be written back at runtime
      and check this list on syncing the register state to the KVM state.

      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1437046488-10773-1-git-send-email-christoffer.dall@linaro.org
      [PMM: tweaked a few comments, added the new argument to the stub
       write_list_to_kvmstate() in target-arm/kvm-stub.c]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1bc040dabc12039944e22d9529f20d6132400dd
  Merge: bd03a38 47c7199
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 21 10:04:32 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Mon Jul 20 19:27:04 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        tests: Fix broken targets check-report-qtest-*
        ahci: Force ICC bits in PxCMD to zero
        qtest/ide: add another short PRDT test flavor

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 47c719964a8240c99d4b7a2b4695ae026c619b83
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      tests: Fix broken targets check-report-qtest-*

      They need QTEST_QEMU_IMG. Without it, the tests raise an assertion:

      $ make -C bin check-report-qtest-i386.xml
      make: Entering directory 'bin'
      GTESTER check-report-qtest-i386.xml
      blkdebug: Suspended request 'A'
      blkdebug: Resuming request 'A'
      ahci-test: tests/libqos/libqos.c:162:
       mkimg: Assertion `qemu_img_path' failed.
      main-loop: WARNING: I/O thread spun for 1000 iterations

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1437231284-17455-1-git-send-email-sw@weilnetz.de
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit bd03a38fdf85fb1d4f0c9f59bbc154b516f66360
  Merge: 13566fe 625de44
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 18:26:53 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon Jul 20 18:25:14 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net: Flush queued packets when guest resumes
        lan9118: Drop lan9118_can_receive
        etraxfs_eth: Drop eth_can_receive
        musicpal: Drop eth_can_receive
        net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets
        net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'
        socket: pass correct size in net_socket_send()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 625de449fc5597f2e1aff9cb586e249e198f03c9
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jul 7 09:21:07 2015 +0800

      net: Flush queued packets when guest resumes

      Since commit 6e99c63 "net/socket: Drop net_socket_can_send" and friends,
      net queues need to be explicitly flushed after qemu_can_send_packet()
      returns false, because the netdev side will disable the polling of fd.

      This fixes the case of "cont" after "stop" (or migration).

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436232067-29144-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b49b8c572f885ea2b16fc744e8837e974df34401
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:47 2015 +0800

      lan9118: Drop lan9118_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da69028261abd12dbf974754e69d017f6e8710b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:46 2015 +0800

      etraxfs_eth: Drop eth_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f63eab8becf92b18c18b6c31950f99f764848902
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 1 15:10:45 2015 +0800

      musicpal: Drop eth_can_receive

      True is the default.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1435734647-8371-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80da311d81c389860bc387fbe6677c71f7a3c596
  Author: Dana Rubin <dana.rubin@ravellosystems.com>
  Date:   Tue Jul 14 11:55:16 2015 +0300

      net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets

      Convert partially summed packets to be fully checksummed.

      In case csum offloaded packet, vmxnet3 implementation always passes an
      RxCompDesc with the "Checksum calculated and found correct" notification
      to the OS. This emulates the observed ESXi behavior.

      Therefore, if packet has the NEEDS_CSUM bit set, we must calculate and
      place a fully computed checksum into the tcp/udp header. Otherwise, the
      OS driver will receive a checksum-correct indication but with the actual
      tcp/udp checksum field having just the pseudo header csum value.

      If host OS performs forwarding, it will forward an incorrectly
      checksummed packet.

      Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Message-id: 1436864116-19154-3-git-send-email-shmulik.ladkani@ravellosystems.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fcf0cdc362dd96cb8d2935b892d3dd9ab73ad393
  Author: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
  Date:   Tue Jul 14 11:55:15 2015 +0300

      net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'

      Separate RX packet protocol parsing out of 'vmxnet_rx_pkt_attach_data'.

      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Message-id: 1436864116-19154-2-git-send-email-shmulik.ladkani@ravellosystems.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 091f1f52963d7093ea578e4a05e67bc015b21192
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Tue Jul 7 17:00:56 2015 +0800

      socket: pass correct size in net_socket_send()

      We should pass the size of packet instead of the remaining to
      qemu_send_packet_async().

      Fixes: 6e99c631f116221d169ea53953d91b8aa74d297a
             ("net/socket: Drop net_socket_can_send")

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436259656-24263-1-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 09b61db7c140c5a71bfde36614c5a1f4f0d382a6
  Author: Stefan Fritsch <sf@sfritsch.de>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      ahci: Force ICC bits in PxCMD to zero

      The AHCI spec requires that the HBA sets the ICC bits to zero after the
      ICC change is done. Since we don't do any ICC change, force the bits to
      zero all the time.

      This fixes delays with some OSs (e.g. OpenBSD) waiting for the ICC bits
      to change to 0.

      Signed-off-by: Stefan Fritsch <sf@sfritsch.de>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: E1ZFpg7-00027N-HW@eru.sfritsch.de
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 58732810230719765a6618004be8f0070c9f3d31
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jul 20 12:21:18 2015 -0400

      qtest/ide: add another short PRDT test flavor

      The existing short PRDT test case does not transfer any data because the
      first PRD is less than 1 sector.

      This patch adds another short PRDT test case where the first sector can
      be read but the PRDT is still smaller than the requested number of
      sectors.  This exercises a different code path in ide_dma_cb().

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1435770571-9906-1-git-send-email-stefanha@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 13566fe3e584e7b14a6f45246976b91677dc2a77
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jul 8 15:10:09 2015 +0100

      timer: rename NSEC_PER_SEC due to Mac OS X header clash

      Commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9 ("timer: Use a single
      definition of NSEC_PER_SEC for the whole codebase") renamed
      NANOSECONDS_PER_SECOND to NSEC_PER_SEC.

      On Mac OS X there is a <dispatch/time.h> system header which also
      defines NSEC_PER_SEC.  This causes compiler warnings.

      Let's use the old name instead.  It's longer but it doesn't clash.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1436364609-7929-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dcc8a3ab632d0f11a1bf3b08381cf0f93e616b9f
  Merge: f73ca73 bd09594
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 16:01:31 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc2

      # gpg: Signature made Mon Jul 20 15:48:56 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        crypto: Fix aes_decrypt_wrapper()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f73ca7363440240b7ee5ee7f7ddb1c64751efb54
  Merge: 7135847 f9d6dbf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 20 13:25:28 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, vhost, pc fixes for 2.4

      The only notable thing here is vhost-user multiqueue
      revert. We'll work on making it stable in 2.5,
      reverting now means we won't have to maintain
      bug for bug compability forever.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 20 12:24:00 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio-net: remove virtio queues if the guest doesn't support multiqueue
        virtio-net: Flush incoming queues when DRIVER_OK is being set
        pci_add_capability: remove duplicate comments
        virtio-net: unbreak any layout
        Revert "vhost-user: add multi queue support"
        ich9: fix skipped vmstate_memhp_state subsection

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bd09594603f1498e7623f0030988b62e2052f7da
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jul 17 19:44:10 2015 +0200

      crypto: Fix aes_decrypt_wrapper()

      Commit d3462e3 broke qcow2's encryption functionality by using encrypt
      instead of decrypt in the wrapper function it introduces. This was found
      by qemu-iotests case 134.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>

  commit f9d6dbf0bf6e91b8ed896369ab1b7e91e5a1a4df
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Jul 15 17:20:59 2015 +0800

      virtio-net: remove virtio queues if the guest doesn't support multiqueue

      commit da51a335 adds all queues in .realize(). But if the
      guest doesn't support multiqueue, we forget to remove them. And
      we cannot handle the ctrl vq corretly. The guest will hang.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Jason Wang <jasowang@redhat.com>

  commit 38705bb57bf1cd9e3f837cf11bcdee3876786c07
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jul 15 11:02:27 2015 +0800

      virtio-net: Flush incoming queues when DRIVER_OK is being set

      This patch fixes network hang after "stop" then "cont", while network
      packets keep arriving.

      Tested both manually (tap, host pinging guest) and with Jason's qtest
      series (plus his "[PATCH 2.4] socket: pass correct size in
      net_socket_send()" fix).

      As virtio_net_set_status is called when guest driver is setting status
      byte and when vm state is changing, it is a good opportunity to flush
      queued packets.

      This is necessary because during vm stop the backend (e.g. tap) would
      stop rx processing after .can_receive returns false, until the queue is
      explicitly flushed or purged.

      The other interesting condition in .can_receive, virtio_queue_ready(),
      is handled by virtio_net_handle_rx() when guest kicks; the 3rd condition
      is invalid queue index which doesn't need flushing.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9a2a66238e3bf2b681d6321c4667a2d589c8ebed
  Author: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
  Date:   Tue Jul 14 16:16:11 2015 +0800

      pci_add_capability: remove duplicate comments

      Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit feb93f361739071778ca2d23df3876db399548f7
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Jul 17 15:19:18 2015 +0800

      virtio-net: unbreak any layout

      Commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
      ("virtio-net: byteswap virtio-net header") breaks any layout by
      requiring out_sg[0].iov_len >= n->guest_hdr_len. Fixing this by
      copying header to temporary buffer if swap is needed, and then use
      this buffer as part of out_sg.

      Fixes 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
      ("virtio-net: byteswap virtio-net header")
      Cc: qemu-stable@nongnu.org
      Cc: clg@fr.ibm.com
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d345ed2da3279b015605823397235b8c5ca5251f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 15 13:47:31 2015 +0300

      Revert "vhost-user: add multi queue support"

      This reverts commit 830d70db692e374b55555f4407f96a1ceefdcc97.

      The interface isn't fully backwards-compatible, which is bad.
      Let's redo this properly after 2.4.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 75d663611e81c748522d9cdcb5230bd02db86d05
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Mon Jul 13 17:45:42 2015 -0300

      ich9: fix skipped vmstate_memhp_state subsection

      By declaring another .subsections array for vmstate_tco_io_state made
      vmstate_memhp_state not registered anymore. There must be only one
      .subsections array for all subsections.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reported-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>

  commit 71358470eec668f5dc53def25e585ce250cea9bf
  Merge: 5b5e8cd 621a20e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 15:22:45 2015 +0100

      Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/vrng-2.4' into staging

      Fire timer only when required.  Brings down wakeups by a big number.

      # gpg: Signature made Fri Jul 17 14:41:40 2015 BST using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-virtio-rng/tags/vrng-2.4:
        virtio-rng: trigger timer only when guest requests for entropy

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 621a20e08155179b1902c428361e80f41429f50d
  Author: Pankaj Gupta <pagupta@redhat.com>
  Date:   Wed Jul 15 17:46:47 2015 +0530

      virtio-rng: trigger timer only when guest requests for entropy

      This patch triggers timer only when guest requests for
      entropy. As soon as first request from guest for entropy
      comes we set the timer. Timer bumps up the quota value
      when it gets triggered.

      Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Message-Id: <1436962608-9961-2-git-send-email-pagupta@redhat.com>

      [Re-worded patch subject, removed extra whitespace -- Amit]

      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 5b5e8cdd7da7a2214dd062afff5b866234aab228
  Merge: fd1a9ef 92fdfa4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 12:39:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150717-1' into staging

      usb: fixes for 2.4 (ccid, xhci and usb-host)

      # gpg: Signature made Fri Jul 17 12:21:42 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150717-1:
        Revert "xhci: set timer to retry xfers"
        usb-ccid: add missing wakeup calls
        usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb
        Re-attach usb device to kernel while usb_host_open fails

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 92fdfa4bef9c92addcc009dd3e0131172b4fdc78
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jul 17 10:12:55 2015 +0200

      Revert "xhci: set timer to retry xfers"

      This reverts commit 4e8cfbe1143d8384387595b500212d7a7f11aeae.

      We should not poll via timer, and with ccid being fixed
      to properly notify us about pending transfers we don't have to.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 86d7e214c224f939c897cfa3b6d597f7af4b5bba
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jul 16 16:33:07 2015 +0200

      usb-ccid: add missing wakeup calls

      Properly notify the host adapter that we have
      data pending, so it doesn't has to poll us.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cfda2cef3d0320d7a133600ffdb6e33547aaba8f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jul 17 11:34:11 2015 +0200

      usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb

      QOMification dropped the parent device lookup, fix it.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fd1a9ef9c2493b5bc98e8e041333a57b635c5d71
  Merge: b4329bf 562f937
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 17 10:52:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150717-1' into staging

      input: fixes for 2.4

      # gpg: Signature made Fri Jul 17 07:45:17 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150717-1:
        hid: clarify hid_keyboard_process_keycode
        virtio-input: move sys/ioctl.h include
        virtio-input: fix segfault in virtio_input_hid_properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 562f93754b95fd6dc65ad9a2aa15a90b2da7e8a4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 11:18:06 2015 +0200

      hid: clarify hid_keyboard_process_keycode

      Coverity thinks the fallthroughs are smelly.  They are correct, but
      everything else in this function is like "wut?".

      Refer explicitly to bits 8 and 9 of hs->kbd.modifiers instead of
      shifting right first and using (1 << 7).  Document what the scancode
      is when hid_code is 0xe0.  And add plenty of comments.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b4329bf41c86bac8b56cadb097081960cc4839a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 20:32:20 2015 +0100

      Update version for v2.4.0-rc1 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b92304ee814f0fe8109c8946dfb4dd4b63e89871
  Merge: 67ff64e d3462e3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 19:18:15 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * MIPS-KVM fixes.
      * Coverity fixes.
      * Nettle function prototype fixes.
      * Memory API refcount fix.

      # gpg: Signature made Thu Jul 16 19:01:27 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        crypto: avoid undefined behavior in nettle calls
        crypto: fix build with nettle >= 3.0.0
        memory: fix refcount leak in memory_region_present
        RDMA: Fix error exits
        arm/xlnx-zynqmp: fix memory leak
        ppc/spapr_drc: fix memory leak
        mips/kvm: Sign extend registers written to KVM
        mips/kvm: Fix Big endian 32-bit register access

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d3462e378f40ba6838b6c42584c30769ca633e6f
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Jul 10 19:18:01 2015 +0200

      crypto: avoid undefined behavior in nettle calls

      Calling a function pointer that was cast from an incompatible function
      results in undefined behavior.  'void *' isn't compatible with 'struct
      XXX *', so we can't cast to nettle_cipher_func, but have to provide a
      wrapper.  (Conversion from 'void *' to 'struct XXX *' might require
      computation, which won't be done if we drop argument's true type, and
      pointers can have different sizes so passing arguments on stack would
      bug.)

      Having two different prototypes based on nettle version doesn't make
      this solution any nicer.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Message-Id: <1437062641-12684-3-git-send-email-rkrcmar@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit becaeb726ae7da4212a788773ebdfe87b4833f5c
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Jul 10 19:18:00 2015 +0200

      crypto: fix build with nettle >= 3.0.0

      In nettle 3, cbc_encrypt() accepts 'nettle_cipher_func' instead of
      'nettle_crypt_func' and these two differ in 'const' qualifier of the
      first argument.  The build fails with:

        In file included from crypto/cipher.c:71:0:
        ./crypto/cipher-nettle.c: In function ‘qcrypto_cipher_encrypt’:
        ./crypto/cipher-nettle.c:154:38: error: passing argument 2 of
        ‘nettle_cbc_encrypt’ from incompatible pointer type
                 cbc_encrypt(ctx->ctx_encrypt, ctx->alg_encrypt,
                                                     ^
        In file included from ./crypto/cipher-nettle.c:24:0,
                         from crypto/cipher.c:71:
        /usr/include/nettle/cbc.h:48:1: note: expected
        ‘void (*)(const void *, size_t, uint8_t *, const uint8_t *)
        but argument is of type
        ‘void (*)(      void *, size_t, uint8_t *, const uint8_t *)

      To allow both versions, we switch to the new definition and #if typedef
      it for old versions.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Message-Id: <1436548682-9315-2-git-send-email-rkrcmar@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c6742b14fe7352059cd4954a356a8105757af31b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jul 14 13:45:34 2015 +0200

      memory: fix refcount leak in memory_region_present

      memory_region_present() leaks a reference to a MemoryRegion in the
      case "mr == container".  While fixing it, avoid reference counting
      altogether for memory_region_present(), by using RCU only.

      The return value could in principle be already invalid immediately
      after memory_region_present returns, but presumably the caller knows
      that and it's using memory_region_present to probe for devices that
      are unpluggable, or something like that.  The RCU critical section
      is needed anyway, because it protects as->current_map.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 24b41d66c8ad8f77839fca777b92e365dad0cf5c
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Jul 10 20:08:52 2015 +0100

      RDMA: Fix error exits

      The error checks I added used 'break' after the error, but I'm
      in a switch inside the while loop, so they need to be 'goto out'.

      Spotted by coverity; entries 1311368 and 1311369

      Fixes: afcddefd

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Message-Id: <1436555332-19076-1-git-send-email-dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5348c62cab309b68ecd13a33c9f21e8d6071af72
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 10 08:51:29 2015 +0800

      arm/xlnx-zynqmp: fix memory leak

      fix CID 1311372.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1436489490-236-4-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 586d2142a9f1aa5a1dceb0941e7b3f0953974a8b
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jul 10 08:51:28 2015 +0800

      ppc/spapr_drc: fix memory leak

      fix CID 1311373.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1436489490-236-3-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 02dae26ac4ceb1e82c432cfca4d9b65ae82343c6
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Fri Apr 24 11:26:53 2015 +0100

      mips/kvm: Sign extend registers written to KVM

      In case we're running on a 64-bit host, be sure to sign extend the
      general purpose registers and hi/lo/pc before writing them to KVM, so as
      to take advantage of MIPS32/MIPS64 compatibility.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Cc: qemu-stable@nongnu.org
      Message-Id: <1429871214-23514-3-git-send-email-james.hogan@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8b3e48b2d269551cd40f94770dc20da2f402325
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Fri Apr 24 11:26:52 2015 +0100

      mips/kvm: Fix Big endian 32-bit register access

      Fix access to 32-bit registers on big endian targets. The pointer passed
      to the kernel must be for the actual 32-bit value, not a temporary
      64-bit value, otherwise on big endian systems the kernel will only
      interpret the upper half.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Cc: qemu-stable@nongnu.org
      Message-Id: <1429871214-23514-2-git-send-email-james.hogan@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 67ff64e08245a5b8de98d9b2acefb840a1fae340
  Merge: 2d5ee9e 567161f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 16:55:00 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150716-1' into staging

      qxl: allow to specify head limit to qxl driver

      # gpg: Signature made Thu Jul 16 16:31:40 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150716-1:
        qxl: allow to specify head limit to qxl driver

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6110ce59af199194ef63cb31ec722487df3f42fe
  Author: Lin Ma <lma@suse.com>
  Date:   Wed Jun 24 13:40:11 2015 +0800

      Re-attach usb device to kernel while usb_host_open fails

      Signed-off-by: Lin Ma <lma@suse.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e2f6bac3010419426b636d2b307f66deecd60813
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 14 13:44:12 2015 +0200

      virtio-input: move sys/ioctl.h include

      Drop from include/standard-headers/linux/input.h
      Add to hw/input/virtio-input-host.c instead.

      That allows to build virtio-input (except pass-through) on windows.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2a19b229f6c2f7288bb8c2498bffb01d67810dee
  Author: Lin Ma <lma@suse.com>
  Date:   Tue Jul 14 19:27:30 2015 +0800

      virtio-input: fix segfault in virtio_input_hid_properties

      commit 5cce173 introduced virtio-input segfault, This patch fixes it.

      Signed-off-by: Lin Ma <lma@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 567161fdd47aeb6987e700702f6bbfef04ae0236
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Mon Jul 6 07:56:38 2015 +0100

      qxl: allow to specify head limit to qxl driver

      This patch allow to limit number of heads using qxl driver. By default
      qxl driver is not limited on any kind on head use so can decide to use
      as much heads.

      libvirt has this as a video card parameter (actually set to 1 but not
      used). This parameter will allow to limit setting a use can do (which
      could be confusing).

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2d5ee9e7a7dd495d233cf9613a865f63f88e3375
  Merge: 3749c11 908680c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 16 10:40:22 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150716' into staging

      MIPS patches 2015-07-16

      Changes:
      * bug fixes

      # gpg: Signature made Thu Jul 16 09:04:56 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150716:
        target-mips: fix page fault address for LWL/LWR/LDL/LDR
        linux-user: Fix MIPS N64 trap and break instruction bug
        target-mips: fix resource leak reported by Coverity
        target-mips: fix logically dead code reported by Coverity
        target-mips: correct DERET instruction
        target-mips: fix ASID synchronisation for MIPS MT
        disas/mips: fix disassembling R6 instructions
        target-mips: fix to clear MSACSR.Cause
        target-mips: fix MIPS64R6-generic configuration

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3749c11a720689694101dcf2ebc43217a02f960f
  Merge: be0df8c 3046bb5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 22:05:13 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-07-15

      Two bug fixes:
      * Memory leak due to extra g_strdup() when registering X86CPU alias properties
      * Fix CPUID levels so that W10 insider can run as guest OS

      # gpg: Signature made Wed Jul 15 21:26:59 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: emulate CPUID level of real hardware
        target-i386: Don't strdup() alias property name

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be0df8cd1eb8e182a9b61a2b4d1c57824cffadc4
  Merge: 7692401 672558d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 21:06:54 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-15

      # gpg: Signature made Wed Jul 15 21:01:37 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        numa: Fix memory leak in numa_set_mem_node_id()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3046bb5debc8153a542acb1df93b2a1a85527a15
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Thu Jul 9 21:07:39 2015 +0200

      target-i386: emulate CPUID level of real hardware

      W10 insider has a bug where it ignores CPUID level and interprets
      CPUID.(EAX=07H, ECX=0H) incorrectly, because CPUID in fact returned
      CPUID.(EAX=04H, ECX=0H);  this resulted in execution of unsupported
      instructions.

      While it's a Windows bug, there is no reason to emulate incorrect level.

      I used http://instlatx64.atw.hu/ as a source of CPUID and checked that
      it matches Penryn Xeon X5472, Westmere Xeon W3520, SandyBridge i5-2540M,
      and Haswell i5-4670T.

      kvm64 and qemu64 were bumped to 0xD to allow all available features for
      them (and to avoid the same Windows bug).

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d461a44ca4b164549fe19b14d2cdf0524f778ce1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jul 9 12:24:43 2015 -0300

      target-i386: Don't strdup() alias property name

      Now object_property_add_alias() calls g_strdup() on the target property
      name, so we don't need to call g_strdup() ourselves.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 672558d2ea8dd782d1d2adc6e16af3bc34029a36
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 9 20:57:36 2015 +0530

      numa: Fix memory leak in numa_set_mem_node_id()

      Fix a memory leak in numa_set_mem_node_id().

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7692401a0826803522cfde533bdcc149932ddc6a
  Merge: 711dc6f 76e2aef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 17:28:59 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150715' into staging

      target arm queue:
       * handle broken AArch64 kernels which assume DTB won't cross a 2MB boundary
       * correct broken SCTLR_EL3 reset value

      # gpg: Signature made Wed Jul 15 17:24:24 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150715:
        hw/arm/boot: Increase fdt alignment
        target-arm: Fix broken SCTLR_EL3 reset

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 76e2aef392629f2b2a468f5158d5c397cc5beed2
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Jul 15 17:16:26 2015 +0100

      hw/arm/boot: Increase fdt alignment

      The Linux kernel on aarch64 creates a page table entry at early bootup
      that spans the 2MB range on memory spanning the fdt start address:

        [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ]

      This means that when our current 4k alignment happens to fall at the end
      of the aligned region, Linux tries to access memory that is not mapped.

      The easy fix is to instead increase the alignment to 2MB, making Linux's
      logic always succeed.

      We leave the existing 4k alignment for 32bit kernels to not cause any
      regressions due to space constraints.

      Reported-by: Andreas Schwab <schwab@suse.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e46e1a74ef482f1ef773e750df9654ef4442ca29
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 17:16:26 2015 +0100

      target-arm: Fix broken SCTLR_EL3 reset

      The SCTLR_EL3 cpreg definition was implicitly resetting the
      register state to 0, which is both wrong and clashes with
      the reset done via the SCTLR definition (since sctlr[3]
      is unioned with sctlr_s). This went unnoticed until recently,
      when an unrelated change (commit a903c449b41f105aa) happened to
      perturb the order of enumeration through the cpregs hashtable for
      reset such that the erroneous reset happened after the correct one
      rather than before it. Fix this by marking SCTLR_EL3 as an alias,
      so its reset is left up to the AArch32 view.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 711dc6f36b74fe65a6e5a1847f1152717d887f8a
  Merge: f5dec79 796a060
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 14:23:58 2015 +0100

      Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

      # gpg: Signature made Wed Jul 15 03:25:16 2015 BST using RSA key ID C0DE3057
      # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
      # gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
      # gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

      * remotes/cody/tags/jtc-for-upstream-pull-request:
        block/curl: Don't lose original error when a connection fails.
        mirror: correct buf_size
        block: keep bitmap if incremental backup job is cancelled
        blockdev: no need to drain in qmp_block_commit
        block/mirror: Sleep periodically during bitmap scanning

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 908680c6441ac468f4871d513f42be396ea0d264
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jul 14 17:45:16 2015 +0200

      target-mips: fix page fault address for LWL/LWR/LDL/LDR

      When a LWL, LWR, LDL or LDR instruction triggers a page fault, QEMU
      currently reports the aligned address in CP0 BadVAddr, while the Windows
      NT kernel expects the unaligned address.

      This patch adds a byte access with the unaligned address at the
      beginning of the LWL/LWR/LDL/LDR instructions to possibly trigger a page
      fault and fill the QEMU TLB.

      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reported-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f01a361bfcce4bd0c439b0e051ef2a1e56727a44
  Author: Andrew Bennett <andrew.bennett@imgtec.com>
  Date:   Mon Jun 29 10:20:07 2015 +0000

      linux-user: Fix MIPS N64 trap and break instruction bug

      For the MIPS N64 ABI when QEMU reads the break/trap instruction so that
      it can inspect the break/trap code it reads 8 rather than 4 bytes
      which means it finds the code field from the instruction after the
      break/trap instruction.  This then causes the break/trap handling
      code to fail because it does not understand the code number.

      The fix forces QEMU to always read 4 bytes of instruction data rather
      than deciding how much to read based on the ABI.

      Signed-off-by: Andrew Bennett <andrew.bennett@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 26e7e982b267e71d40cd20e9e234fedef6770a90
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:15 2015 +0100

      target-mips: fix resource leak reported by Coverity

      UHI assert and link operations call lock_user_string() twice to obtain two
      strings pointed by gpr[4] and gpr[5]. If the second lock_user_string()
      fails, then the first one won't get freed. Fix this by introducing another
      macro responsible for obtaining two strings and handling allocation
      failure.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 47ada0ad3431b39863918dc80386634693d317b5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:14 2015 +0100

      target-mips: fix logically dead code reported by Coverity

      Make use of CMPOP in floating-point compare instructions.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit fe87c2b36ae9c1c9a5279f3891f3bce1b573baa0
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jul 14 11:08:13 2015 +0100

      target-mips: correct DERET instruction

      Fix Debug Mode flag clearing, and when DERET is placed between LL and SC
      do not make SC fail.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 6a973e6b6584221bed89a01e755b88e58b496652
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jul 1 15:59:13 2015 +0200

      target-mips: fix ASID synchronisation for MIPS MT

      When syncing the task ASID with EntryHi, correctly or the value instead
      of assigning it.

      Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6b9c26fb5eed2345398daca4eef601da2f3d7867
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Tue Jun 30 16:33:15 2015 +0100

      disas/mips: fix disassembling R6 instructions

      In the Release 6 of the MIPS Architecture, LL, SC, LLD, SCD, PREF
      and CACHE instructions have 9 bits offsets.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d4f4f0d5d9e74c19614479592c8bc865d92773d0
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Tue Jun 30 15:44:28 2015 +0100

      target-mips: fix to clear MSACSR.Cause

      MSACSR.Cause bits are needed to be cleared before a vector floating-point
      instructions.
      FEXDO.df, FEXUPL.df and FEXUPR.df were missed out.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4dc89b782095d7a0b919fafd7b1322b3cb1279f1
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 29 10:11:23 2015 +0100

      target-mips: fix MIPS64R6-generic configuration

      Fix core configuration for MIPS64R6-generic to make it as close as
      I6400.
      I6400 core has 48-bit of Virtual Address available (SEGBITS).
      MIPS SIMD Architecture is available.
      Rearrange order of bits to match the specification.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f5dec79ee88034b2da52463145a2056500db9ff2
  Merge: 661725d 560d027
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 15 12:22:31 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150715-1' into staging

      migration/next for 20150715

      # gpg: Signature made Wed Jul 15 11:23:33 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150715-1:
        migration: We also want to store the global state for savevm
        migration: reduce the count of strlen call
        migration: Register global state section before loadvm
        migration: Write documetation for events capabilites
        migration: Trace event and migration event are different things
        migration: Only change state after migration has finished

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 560d027b54067ffa4e79c6f7c0a499abb0d749a3
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 15 09:53:46 2015 +0200

      migration: We also want to store the global state for savevm

      Commit df4b1024526cae3479da3492d6371fd4a7324a03 introduced global_state
      section.  But it only filled the state while doing migration.  While
      doing a savevm, we stored an empty string as state.  So when we did a
      loadvm, it complained that state was invalid.

      Fedora 21, 4.1.1, qemu 2.4.0-rc0
      > ../../configure --target-list="x86_64-softmmu"

      068 2s ... - output mismatch (see 068.out.bad)
      --- /home/bos/jhuston/src/qemu/tests/qemu-iotests/068.out	2015-07-08
      17:56:18.588164979 -0400
      +++ 068.out.bad	2015-07-09 17:39:58.636651317 -0400
      @@ -6,6 +6,8 @@
       QEMU X.Y.Z monitor - type 'help' for more information
       (qemu) savevm 0
       (qemu) quit
      +qemu-system-x86_64: Unknown savevm section or instance 'globalstate' 0
      +qemu-system-x86_64: Error -22 while loading VM state
       QEMU X.Y.Z monitor - type 'help' for more information
       (qemu) quit
       *** done
      Failures: 068
      Failed 1 of 1 tests

      Actually, there were two problems here:
      - we registered global_state too late for load_vm (fixed on another
        patch on the list)
      - we didn't store a valid state for savevm (fixed by this patch).

      Reported-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Tested-by:  Christian Borntraeger <borntraeger@de.ibm.com>

  commit 9f5f380b54d6ad80cf35d93c8cd71c8d7a1b52b7
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Jul 13 17:34:10 2015 +0800

      migration: reduce the count of strlen call

      'strlen' is called three times in 'save_page_header', it's
      inefficient.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 48212d87d6655b029231d830a77983c21552fe49
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri Jul 10 14:51:58 2015 +0200

      migration: Register global state section before loadvm

      Otherwise, it is not found

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 72e72e1a71e5e67a11204606a5c09f6cc3089a53
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 14:13:10 2015 +0200

      migration: Write documetation for events capabilites

      Reported-by: Jiri Denemark <jdenemar@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4ba4bc5e9bfab457a96ac56dc470730a330aded8
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 13:58:27 2015 +0200

      migration: Trace event and migration event are different things

      We can want the trace event even without migration events enabled.

      Reported-by:  Wen Congyang <ghostwcy@gmail.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 172c4356f38fbf91675256447a3bedd08220214f
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 8 13:56:26 2015 +0200

      migration: Only change state after migration has finished

      On previous change, we changed state at post load time if it was not
      running, special casing the "running" change.  Now, we change any states
      at the end of the migration.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 796a060bc0fab40953997976a2e30d9d6235bc7b
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 8 14:37:48 2015 +0100

      block/curl: Don't lose original error when a connection fails.

      Currently if qemu is connected to a curl source (eg. web server), and
      the web server fails / times out / dies, you always see a bogus EIO
      "Input/output error".

      For example, choose a large file located on any local webserver which
      you control:

        $ qemu-img convert -p http://example.com/large.iso /tmp/test

      Once it starts copying the file, stop the webserver and you will see
      qemu-img fail with:

        qemu-img: error while reading sector 61440: Input/output error

      This patch does two things: Firstly print the actual error from curl
      so it doesn't get lost.  Secondly, change EIO to EPROTO.  EPROTO is a
      POSIX.1 compatible errno which more accurately reflects that there was
      a protocol error, rather than some kind of hardware failure.

      After this patch is applied, the error changes to:

        $ qemu-img convert -p http://example.com/large.iso /tmp/test
        qemu-img: curl: transfer closed with 469989 bytes remaining to read
        qemu-img: error while reading sector 16384: Protocol error

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 48ac0a4df84662f23da25262443e1810b70c2228
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Fri May 15 15:51:36 2015 +0800

      mirror: correct buf_size

      If bus_size is less than 0, the command fails.
      If buf_size is 0, use DEFAULT_MIRROR_BUF_SIZE.
      If buf_size % granularity is not 0, mirror_free_init() will
      do dangerous things.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 5555A588.3080907@cn.fujitsu.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 17d9716d7b5381c4b6566bb1a06267d2bfcd1821
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jun 15 16:02:14 2015 +0100

      block: keep bitmap if incremental backup job is cancelled

      Reclaim the dirty bitmap if an incremental backup block job is
      cancelled.  The ret variable may be 0 when the job is cancelled so it's
      not enough to check ret < 0.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1434380534-7680-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 299bf097375f9d148cda579ad85477304e38856b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 28 16:21:43 2015 +0200

      blockdev: no need to drain in qmp_block_commit

      Draining is not necessary, I/O can happen as soon as the
      commit coroutine yields.  Draining can be necessary before
      reopening the file for read/write, or while modifying the
      backing file chain, but that is done separately in
      bdrv_reopen_multiple or bdrv_close; this particular
      bdrv_drain_all does nothing for that.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432822903-25821-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 4c0cbd6fec7db182a6deb52d5a8a8e7b0c5cbe64
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 11:11:13 2015 +0800

      block/mirror: Sleep periodically during bitmap scanning

      Before, we only yield after initializing dirty bitmap, where the QMP
      command would return. That may take very long, and guest IO will be
      blocked.

      Add sleep points like the later mirror iterations.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Wen Congyang <wency@cn.fujitsu.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1431486673-19280-1-git-send-email-famz@redhat.com
      Signed-off-by: Jeff Cody <jcody@redhat.com>

  commit 661725da09f47eb92d356fac10a4cf3b7ad1f61d
  Merge: f394798 2af9170
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 18:50:16 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150714' into staging

      s390x fixes for 2.4:
      - virtio migration regression
      - missing diag288 watchdog resets

      # gpg: Signature made Tue Jul 14 18:17:54 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150714:
        s390/virtio-ccw: Fix migration
        watchdog/diag288: correctly register for system reset requests

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2af9170c8c269c4fba73e5271453ca15a57f5844
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Jul 7 13:47:23 2015 +0200

      s390/virtio-ccw: Fix migration

      commit 213941d73b ("virtio-ccw: migrate ->revision") broke
      migration:
      2015-07-07T11:22:55.570968Z qemu-system-s390x: VQ 39 address 0x0 inconsistent with Host index 0x100
      2015-07-07T11:22:55.571008Z qemu-system-s390x: error while loading state for instance 0x0 of

      If thinint support is active, the config_load function returns early.
      Make sure to load the revision all the time.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Fixes: 213941d73b ("virtio-ccw: migrate ->revision")
      Message-Id: <1436269643-66303-1-git-send-email-borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 0c7322cfd3fd382c0096c2a9f00775818a878e13
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Mon Jun 29 08:21:10 2015 +0200

      watchdog/diag288: correctly register for system reset requests

      The diag288 watchdog is no sysbus device, therefore it doesn't get
      triggered on resets automatically using dc->reset.

      Let's register the reset handler manually, so we get correctly notified
      again when a system reset was requested. Also reset the watchdog on
      subsystem resets that don't trigger a full system reset.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit f3947986d9bbbae1087c4c33880d3f8dbf1f1384
  Merge: 0030ff4 e34d8f2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 16:51:44 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer patches for 2.4.0-rc1

      # gpg: Signature made Tue Jul 14 16:15:35 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        rbd: fix ceph settings precedence
        rbd: make qemu's cache setting override any ceph setting
        MAINTAINERS: update email address
        rbd: remove unused constants and fields
        block: Fix backing file child when modifying graph
        block: Reorder cleanups in bdrv_close()
        block: Introduce bdrv_unref_child()
        block: Introduce bdrv_open_child()
        block: Move bdrv_attach_child() calls up the call chain
        nvme: properly report volatile write caches
        nvme: implement the Flush command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e34d8f297d51b7ffa5dce72df1e45fa94cff989c
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:46 2015 -0700

      rbd: fix ceph settings precedence

      Apply the ceph settings from a config file before any ceph settings
      from the command line. Since the ceph config file location may be
      specified on the command line, parse it once to read the config file,
      and do a second pass to apply the rest of the command line ceph
      options.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 99a3c89d5d538dc6c360e35dffb797cfe06e9cda
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:45 2015 -0700

      rbd: make qemu's cache setting override any ceph setting

      To be safe, when cache=none is used ceph settings should not be able
      to override it to turn on caching. This was previously possible with
      rbd_cache=true in the rbd device configuration or a ceph configuration
      file. Similarly, rbd settings could have turned off caching when qemu
      requested it, although this would just be a performance problem.

      Fix this by changing rbd's cache setting to match qemu after all other
      ceph settings have been applied.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5a8ac6d9d70e1a078d04ad75a5c055b00a041d70
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:44 2015 -0700

      MAINTAINERS: update email address

      The old one still works for now, but will not work indefinitely.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3dbf00e058e450173c6f892bb572df871eb4ea58
  Author: Josh Durgin <jdurgin@redhat.com>
  Date:   Wed Jun 10 20:28:43 2015 -0700

      rbd: remove unused constants and fields

      RBDAIOCB.status was only used for cancel, which was removed in
      7691e24dbebb46658e89b3f950fda6ec78bbb823.

      RBDAIOCB.sector_num was never used.

      RADOSCB.done and rcbid were never used.

      RBD_FD* are obsolete since the pipe was removed in
      e04fb07fd1676e9facd7f3f878c1bbe03bccd26b.

      Signed-off-by: Josh Durgin <jdurgin@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 80a1e130917e0745625129553c943743eb663727
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 17 15:52:09 2015 +0200

      block: Fix backing file child when modifying graph

      This patch moves bdrv_attach_child() from the individual places that add
      a backing file to a BDS to bdrv_set_backing_hd(), which is called by all
      of them. It also adds bdrv_detach_child() there.

      For normal operation (starting with one backing file chain and not
      changing it until the topmost image is closed) and live snapshots, this
      constitutes no change in behaviour.

      For all other cases, this is a fix for the bug that the old backing file
      was still referenced as a child, and the new one wasn't referenced.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 9a7dedbc43c7c400663d2876a8ccb6d942a1429a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 16 10:58:20 2015 +0200

      block: Reorder cleanups in bdrv_close()

      Block drivers may still want to access their child nodes in their
      .bdrv_close handler. If they unref and/or detach a child by themselves,
      this should not result in a double free.

      There is additional code for backing files, which are just a special
      case of child nodes. The same applies for them.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 33a604075c51e5528eed970eeaeefe609ea2337d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 13:51:04 2015 +0200

      block: Introduce bdrv_unref_child()

      This is the counterpart for bdrv_open_child(). It decreases the
      reference count of the child BDS and removes it from the list of
      children of the given parent BDS.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit b4b059f628173dd1d722ee8a9c592a80aec1fc2f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 13:24:19 2015 +0200

      block: Introduce bdrv_open_child()

      It is the same as bdrv_open_image(), except that it doesn't only return
      success or failure, but the newly created BdrvChild object for the new
      child node.

      As the BdrvChild object already contains a BlockDriverState pointer (and
      this is supposed to become the only pointer so that bdrv_append() and
      friends can just change a single pointer in BdrvChild), the pbs
      parameter is removed for bdrv_open_child().

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit df5817926790f6e84d1936eab523556f96fa577a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jun 15 11:53:47 2015 +0200

      block: Move bdrv_attach_child() calls up the call chain

      Let the callers of bdrv_open_inherit() call bdrv_attach_child(). It
      needs to be called in all cases where bdrv_open_inherit() succeeds (i.e.
      returns 0) and a child_role is given.

      bdrv_attach_child() is moved upwards to avoid a forward declaration.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 30349fd038ffb26528fad21abe1e264031364449
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Jun 11 12:01:39 2015 +0200

      nvme: properly report volatile write caches

      Implement support in Identify and Get/Set Features to properly report
      and allow to change the Volatile Write Cache status reported by the
      virtual NVMe device.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8b9d74e0eebb2106b767d66355d38086be72ad2b
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Jun 11 12:01:38 2015 +0200

      nvme: implement the Flush command

      Implement a real flush instead of faking it.  This is especially important
      as Qemu assume Write back cashing by default and thus requires a working
      cache flush operation for data integrity.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0030ff40472b9ebf0e0595afbc8d7e428218c5d7
  Merge: f3a1b50 a169513
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 14 14:52:45 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150714-1' into staging

      vnc: fix vnc client authentication

      # gpg: Signature made Tue Jul 14 14:38:48 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150714-1:
        vnc: fix vnc client authentication

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a16951375f7669b7faf27f72ca753e25325c5179
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Tue Jul 14 14:51:40 2015 +0200

      vnc: fix vnc client authentication

      Commit 800567a61 updated the code to the generic crypto API
      and mixed up encrypt and decrypt functions in
      procotol_client_auth_vnc.
      (Used to be: deskey(key, EN0) which encrypts, and was
      changed to qcrypto_cipher_decrypt in 800567a61.)
      Changed it to qcrypto_cipher_encrypt now.

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f3a1b5068cea303a55e2a21a97e66d057eaae638
  Merge: 6e3c0c6 4421c6a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 13 13:35:51 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc,virtio: fixes for 2.4

      pc and virtio changes, bugfixes only.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jul 13 13:03:38 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3
        Revert "virtio-net: enable virtio 1.0"
        virtio-pci: don't crash on illegal length
        qdev: fix 64 bit properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4421c6a38a37d558b8e6f82d2d54aee30350f57f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Jun 23 14:00:51 2015 -0300

      pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3

      commit fddd179ab962f6f78a8493742e1068d6a620e059,
          "pc: Convert *_MACHINE_OPTIONS macros into functions"
      broke the chaining of *_machine_options() functions on
      pc-i440fx-2.3, at:

        -#define PC_I440FX_2_3_MACHINE_OPTIONS \
        -    PC_I440FX_2_4_MACHINE_OPTIONS, \
        -    .alias = NULL, \
        -    .is_default = 0
        +static void pc_i440fx_2_3_machine_options(QEMUMachine *m)
        +{
        +    pc_i440fx_machine_options(m);
        +    m->alias = NULL;
        +    m->is_default = 0;
        +}

      I have replaced PC_I440FX_2_4_MACHINE_OPTIONS with a
      pc_i440fx_machine_options() call, instead of calling
      pc_i440fx_2_4_machine_options(). This broke the setting of default_machine_opts
      and default_display on pc-i440fx-{2.0,2,1,2.2,2.3}.

      Fix this by making pc_i440fx_2_3_machine_options() reuse
      pc_i440fx_2_4_machine_options().

      Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>

  commit 06c4670ff6d4acdc5a24e3d25748ee4a489d5869
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Jul 13 13:46:50 2015 +0800

      Revert "virtio-net: enable virtio 1.0"

      This reverts commit df91055db5c9cee93d70ca8c08d72119a240b987.

      This is because:
      - vhost support virtio 1.0 now
      - transport code (e.g virtio-pci) set this feature when modern is
        enabled, setting this unconditionally will break disable-modern=on.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2a6391232fa58f32469fb61d55343eff32a91083
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jul 13 10:32:50 2015 +0300

      virtio-pci: don't crash on illegal length

      Some guests seem to access cfg with an illegal length value.
      It's worth fixing them but debugging is easier if
      qemu does not crash.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8aedc369c6ae4fb4c4c6920f703b000015df3d8d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jul 9 13:01:14 2015 +0200

      qdev: fix 64 bit properties

      64 bit props used 32 bit callbacks in two places, leading to broken
      feature bits on virtio (example: got 0x31000000000006d4 which is
      obviously bogus). Fix this.

      Fixes: fdba6d96 ("qdev: add 64bit properties")
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6e3c0c6edbdddb8dd676bec1ac51b5faffc19a77
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Jul 10 21:22:39 2015 +0200

      tci: Fix regression with INDEX_op_qemu_st_i32, INDEX_op_qemu_st_i64

      Commit 59227d5d45bb3c31dc2118011691c35b3c00879c did not update the
      code in tcg/tci/tcg-target.c for those two cases.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1436556159-3002-1-git-send-email-sw@weilnetz.de
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6169b60285fe1ff730d840a49527e721bfb30899
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 17:56:56 2015 +0100

      Update version for v2.4.0-rc0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 16c1321bd78ad79a7252b714184ee2a0b5944c56
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 17:46:24 2015 +0100

      tci: Fix compile failure by including qemu-common.h

      Compilation of TCI was accidentally broken by the recent disassembler
      changes:

        CC    x86_64-softmmu/arch_init.o
      In file included from target-i386/cpu-qom.h:23:0,
                       from target-i386/cpu.h:986,
                       from include/qemu-common.h:122,
                       from include/disas/bfd.h:12,
                       from disas/tci.c:20:
      include/qom/cpu.h:178:43: error: unknown type name ‘disassemble_info’
           void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
                                                 ^
      include/qom/cpu.h:179:1: error:
      no semicolon at end of struct or union [-Werror]
       } CPUClass;
       ^
      cc1: all warnings being treated as errors

      The underlying cause of this is an include loop:
       bfd.h -> qemu-common.h -> target-arm/cpu.h ->  target-arm/cpu-qom.h
        -> qom/cpu.h -> bfd.h

      which means that if bfd.h is included first then qom/cpu.h doesn't
      get the definition of the disassemble_info type that it wanted.
      The easiest fix for this is to include qemu-common.h from tci.c
      before including disas/bfd.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9dc4cf94c182f03c0061483891f53d1d21e5e68
  Merge: 0326248 4f4f697
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 16:22:37 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Fixes for two bad bugs.  For 2.4-rc0.

      # gpg: Signature made Thu Jul  9 15:54:19 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        crypto: fix builtin qcrypto_cipher_free
        migration: fix RCU deadlock

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4f4f6976d80614e2d81cea4385885876f24bb257
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 16:52:48 2015 +0200

      crypto: fix builtin qcrypto_cipher_free

      This was dereferencing a pointer before checking if it was NULL.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reported-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 032624868df264d395ee9900331f08bad1431022
  Merge: 5a2db89 6b625fd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 9 15:00:37 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * Further QOM'ification of CPU initialization
      * Propagation of CPUState arguments and elimination of ENV_GET_CPU() usage
      * cpu_set_pc() abstraction
      * CPUClass::disas_set_info() hook

      # gpg: Signature made Thu Jul  9 14:23:12 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter: (22 commits)
        disas: cris: QOMify target specific disas setup
        disas: cris: Fix 0 buffer length case
        disas: microblaze: QOMify target specific disas setup
        disas: arm: QOMify target specific disas setup
        disas: arm-a64: Make printfer and stream variable
        disas: QOMify target specific setup
        disas: Add print_insn to disassemble info
        microblaze: boot: Use cpu_set_pc()
        hw/arm/boot: Use cpu_set_pc()
        gdbstub: Use cpu_set_pc() helper
        cpu: Add wrapper for the set_pc() hook
        cpu-exec: Purge all uses of ENV_GET_CPU()
        cpu: Change cpu_exec_init() arg to cpu, not env
        cpu: Change tcg_cpu_exec() arg to cpu, not env
        gdbstub: Change gdbserver_fork() to accept cpu instead of env
        translate-all: Change tb_flush() env argument to cpu
        target-ppc: Move cpu_exec_init() call to realize function
        cpu: Convert cpu_index into a bitmap
        cpu: Add Error argument to cpu_exec_init()
        cpu: Reorder cpu->as, cpu->thread_id, cpu->memory_dispatch init
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6b625fde5eb8d1c969969392f1c92b58beed2183
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:38 2015 -0700

      disas: cris: QOMify target specific disas setup

      Move the target_disas() cris specifics to the QOM disas_set_info() hook
      and delete the cris specific code in disas.c.

      This also now adds support for monitor_disas() to cris.

      E.g.
      (qemu) xp 0x40004000
      0000000040004000: 0x1e6f25f0

      And before this patch:
      (qemu) xp/i 0x40004000
      0x40004000: Asm output not supported on this arch

      After:
      (qemu) xp/i 0x40004000
      0x40004000:  di
      (qemu) xp/i 0x40004002
      0x40004002:  move.d 0xb003c004,$r1

      Note: second example is 6-byte misaligned instruction!

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 51d373cf5f5a39fa315342d12ec910fe59d87090
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:37 2015 -0700

      disas: cris: Fix 0 buffer length case

      Cris has the complication of variable length instructions and has
      a check in place to clamp memory reads in case the disas request
      doesn't have enough bytes for the instruction being disas'd. This
      breaks down in the case where disassembling for the monitor where
      the buffer length is defaulted to 0.

      The buffer length should never be zero for a regular target_disas,
      so we can safely assume the 0 case is for the monitor in which case
      consider the buffer length to be the max for cris instructions.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit efc6674be845e40d443b62e80eb9ea9a9adfee3c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:36 2015 -0700

      disas: microblaze: QOMify target specific disas setup

      Move the target_disas() MB specifics to the QOM disas_set_info hook
      and delete the MB specific code in disas.c.

      This also now adds support for monitor_disas() to Microblaze.

      E.g.
      (qemu) xp 0x90000000
      0000000090000000: 0x94208001

      And before this patch:
      (qemu) xp/i 0x90000000
      0x90000000: Asm output not supported on this arch

      After:
      (qemu) xp/i 0x90000000
      0x90000000:  mfs    r1, rmsr

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 484406200e51eac023b346fdf987f86af1f6fe75
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:35 2015 -0700

      disas: arm: QOMify target specific disas setup

      Move the target_disas() ARM specifics to the QOM disas_set_info hook
      and delete the ARM specific code in disas.c.

      This has the extra advantage of the more fully featured target_disas()
      implementation now applying to monitor_disas().

      Currently, target_disas() has multi-endian, thumb and AArch64
      support whereas the existing monitor_disas() support only has vanilla
      AA32 support.

      E.G. Running an AA64 linux kernel the following -d in_asm disas happens
      (taget_disas()):

      IN:
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)
      0x0000000040000004:  aa1f03e1      mov x1, xzr

      However before this patch, disasing the same from the monitor:

      (qemu) xp/i 0x40000000
      0x0000000040000000:  580000c0      stmdapl  r0, {r6, r7}

      After this patch:
      (qemu) xp/i 0x40000000
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit fb200d5f003118f63205f34bbe553efcf3a66a81
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:34 2015 -0700

      disas: arm-a64: Make printfer and stream variable

      In a normal disassembly flow, the printf() and stream being used varies
      from disas job to job. In particular it varies if mixing monitor_disas
      and target_disas.

      Make both the printf() function and target stream settable in the
      QEMUDisassmbler class.

      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 37b9de463bff4fc786bb5f0778829e68d2c97bd0
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:33 2015 -0700

      disas: QOMify target specific setup

      Add a QOM function hook for target-specific disassembly setup. This
      allows removal of the #ifdeffery currently implementing target specific
      disas setup from disas.c.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2de295c544dda8680a82fe465c92d236d49c4d4f
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:57:32 2015 -0700

      disas: Add print_insn to disassemble info

      Add the print_insn pointer to the disassemble info structure. This is
      to prepare for QOMification support, where a QOM CPU hook function will
      be responsible for setting the print_insn() function. Add this function
      to the existing struct to consolidate such that only the one struct
      needs to be passed to the new QOM API.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 691b9572e337f2d74b4b527c3dc76f542c6a5734
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:23 2015 -0700

      microblaze: boot: Use cpu_set_pc()

      Use cpu_set_pc() for setting program counters when bootloading. This
      removes an instance of system level code having to reach into the CPU
      env.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Avoid duplicated CPU() casts through local variable]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4df81c6ed1eddcbbb920a977e76f599e05b39b77
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:22 2015 -0700

      hw/arm/boot: Use cpu_set_pc()

      Use cpu_set_pc() across the board for setting program counters. This
      removes instances of system level code having to reach into the CPU
      env.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Avoid repeated casts with local variables]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4a2b24edb73f98fa58fd8965db5b312617de7a02
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:21 2015 -0700

      gdbstub: Use cpu_set_pc() helper

      Use the cpu_set_pc() helper which will take care of CPUClass retrieval
      for us.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2991b8904730d663f12ad42e35798ecc22fe151c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 20:19:20 2015 -0700

      cpu: Add wrapper for the set_pc() hook

      Add a wrapper around the CPUClass::set_pc() hook.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit ea3e9847408131abc840240bd61e892d28459452
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu Jun 18 10:24:55 2015 -0700

      cpu-exec: Purge all uses of ENV_GET_CPU()

      Remove un-needed usages of ENV_GET_CPU() by converting the APIs to use
      CPUState pointers and retrieving the env_ptr as minimally needed.

      Scripted conversion for target-* change:

      for I in target-*/cpu.h; do
          sed -i \
          's/\(^int cpu_[^_]*_exec(\)[^ ][^ ]* \*s);$/\1CPUState *cpu);/' \
          $I;
      done

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 4bad9e392e788a218967167a38ce2ae7a32a6231
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:18 2015 -0700

      cpu: Change cpu_exec_init() arg to cpu, not env

      The callers (most of them in target-foo/cpu.c) to this function all
      have the cpu pointer handy. Just pass it to avoid an ENV_GET_CPU() from
      core code (in exec.c).

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 3d57f7893c90d911d786cb2c622b0926fc808b57
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:17 2015 -0700

      cpu: Change tcg_cpu_exec() arg to cpu, not env

      The sole caller of this function navigates the cpu->env_ptr only for
      this function to take it back the cpu pointer straight away. Pass in
      cpu pointer instead and grab the env pointer locally in the function.
      Removes a core code usage of ENV_GET_CPU().

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f7ec7f7b269813603b1d64bb9833f9e711f0115c
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:16 2015 -0700

      gdbstub: Change gdbserver_fork() to accept cpu instead of env

      All callsites to this function navigate the cpu->env_ptr only for the
      function to take the env ptr back to the original cpu ptr. Change the
      function to just pass in the CPU pointer instead. Removes a core code
      usage of ENV_GET_CPU() (in gdbstub.c).

      Cc: Riku Voipio <riku.voipio@iki.fi>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit bbd77c180d7ff1b04a7661bb878939b2e1d23798
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Tue Jun 23 19:31:15 2015 -0700

      translate-all: Change tb_flush() env argument to cpu

      All of the core-code usages of this API have the cpu pointer handy so
      pass it in. There are only 3 architecture specific usages (2 of which
      are commented out) which can just use ENV_GET_CPU() locally to get the
      cpu pointer. The reduces core code usage of the CPU env, which brings
      us closer to common-obj'ing these core files.

      Cc: Riku Voipio <riku.voipio@iki.fi>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6dd0f8342ddfbd8db3e3de1a17686cedbc14e9f1
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:14 2015 -0700

      target-ppc: Move cpu_exec_init() call to realize function

      Move cpu_exec_init() call from instance_init to realize. This allows
      any failures from cpu_exec_init() to be handled appropriately.
      Also add corresponding cpu_exec_exit() call from unrealize.

      cpu_dt_id assignment from instance_init is no longer needed since
      correct assignment for cpu_dt_id is already present in realizefn.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: Keep calling cpu_exec_init() for CONFIG_USER_ONLY]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b7bca7333411bd19c449147e8202ae6b0e4a8e09
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:13 2015 -0700

      cpu: Convert cpu_index into a bitmap

      Currently CPUState::cpu_index is monotonically increasing and a newly
      created CPU always gets the next higher index. The next available
      index is calculated by counting the existing number of CPUs. This is
      fine as long as we only add CPUs, but there are architectures which
      are starting to support CPU removal, too. For an architecture like PowerPC
      which derives its CPU identifier (device tree ID) from cpu_index, the
      existing logic of generating cpu_index values causes problems.

      With the currently proposed method of handling vCPU removal by parking
      the vCPU fd in QEMU
      (Ref: http://lists.gnu.org/archive/html/qemu-devel/2015-02/msg02604.html),
      generating cpu_index this way will not work for PowerPC.

      This patch changes the way cpu_index is handed out by maintaining
      a bit map of the CPUs that tracks both addition and removal of CPUs.

      The CPU bitmap allocation logic is part of cpu_exec_init(), which is
      called by instance_init routines of various CPU targets. Newly added
      cpu_exec_exit() API handles the deallocation part and this routine is
      called from generic CPU instance_finalize.

      Note: This new CPU enumeration is for !CONFIG_USER_ONLY only.
      CONFIG_USER_ONLY continues to have the old enumeration logic.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      [AF: max_cpus -> MAX_CPUMASK_BITS]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a790cc4b942e651fec7edc597c19b637fad5a76
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jun 23 19:31:12 2015 -0700

      cpu: Add Error argument to cpu_exec_init()

      Add an Error argument to cpu_exec_init() to let users collect the
      error. This is in preparation to change the CPU enumeration logic
      in cpu_exec_init(). With the new enumeration logic, cpu_exec_init()
      can fail if cpu_index values corresponding to max_cpus have already
      been handed out.

      Since all current callers of cpu_exec_init() are from instance_init,
      use error_abort Error argument to abort in case of an error.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 291135b5da228e58900c120e12354cc0a23608e3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:33 2015 -0300

      cpu: Reorder cpu->as, cpu->thread_id, cpu->memory_dispatch init

      Instead of initializing cpu->as, cpu->thread_id, and reloading memory
      map while holding cpu_list_lock(), do it earlier, before locking the CPU
      list and initializing cpu_index.

      This allows the code handling cpu_index and global CPU list to be
      isolated from the rest.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7c39163e389e6e6e16965606fb5a26abcdb6ad73
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:32 2015 -0300

      cpu: Initialize breakpoint/watchpoint lists in cpu_common_initfn()

      One small step in the simplification of cpu_exec_init().

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 199fc85acd0571902eeefef6ea861b8ba4c8201f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Apr 27 17:00:31 2015 -0300

      cpu: No need to zero-initialize CPUState::numa_node

      QOM objects are already zero-filled when instantiated, there's no need
      to explicitly set numa_node to 0.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a2db89615c8efabbeca74fe5e0f14f312d3bbe3
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Thu Jul 9 10:17:15 2015 +0100

      mips/kvm: Sync with newer MIPS KVM headers

      The KVM_REG_MIPS_COUNT_* definitions are now included in
      linux-headers/asm-mips/kvm.h since commit b061808d39fa ("linux-headers:
      update linux headers to kvm/next"), therefore the duplicate definitions
      in target-mips/kvm.c can now be dropped (the definitions were tweaked
      slightly in commit 7a52ce8a1607 ("linux-headers: update") which
      triggered the following build warnings turned errors):

      target-mips/kvm.c:232:0: error: "KVM_REG_MIPS_COUNT_CTL" redefined [-Werror]
      linux-headers/asm/kvm.h:129:0: note: this is the location of the previous definition
      target-mips/kvm.c:236:0: error: "KVM_REG_MIPS_COUNT_RESUME" redefined [-Werror]
      linux-headers/asm/kvm.h:141:0: note: this is the location of the previous definition
      target-mips/kvm.c:239:0: error: "KVM_REG_MIPS_COUNT_HZ" redefined [-Werror]
      linux-headers/asm/kvm.h:147:0: note: this is the location of the previous definition

      Also update the MIPS_C0_{32,64} macros to utilise definitions more
      recently added to the asm-mips/kvm.h header.

      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1436433435-24898-3-git-send-email-james.hogan@imgtec.com
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: kvm@vger.kernel.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8f13961fdcff3a5969b9884368e875aa068f1c9
  Author: James Hogan <james.hogan@imgtec.com>
  Date:   Thu Jul 9 10:17:14 2015 +0100

      tcg/mips: Fix build error from merged memop+mmu_idx parameter

      Commit 3972ef6f830d ("tcg: Push merged memop+mmu_idx parameter to
      softmmu routines") caused the following build errors when building TCG
      for MIPS:

      In file included from tcg/tcg.c:258:0:
      tcg/mips/tcg-target.c In function ‘tcg_out_qemu_ld_slow_path’:
      tcg/mips/tcg-target.c:1015:22: error: ‘lb’ undeclared (first use in this function)
      tcg/mips/tcg-target.c In function ‘tcg_out_qemu_st_slow_path’:
      tcg/mips/tcg-target.c:1058:22: error: ‘lb’ undeclared (first use in this function)

      It looks like lb was meant to refer to the TCGLabelQemuLdst *l
      parameter, so fix both references to lb to refer to just l.

      Fixes: 3972ef6f830d ("tcg: Push merged memop+mmu_idx parameter to softmmu routines")
      Signed-off-by: James Hogan <james.hogan@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1436433435-24898-2-git-send-email-james.hogan@imgtec.com
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d09a6fde1590ca3a45b608b6873a680f208dfeb5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jul 9 08:47:58 2015 +0200

      migration: fix RCU deadlock

      migration_end calls synchronize_rcu() within a critical section.
      That causes a deadlock; move the call after rcu_read_unlock().

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit acf7b7fdf31fa76b53803790917c8acf23a2badb
  Merge: c8e8428 2828a30
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 20:46:35 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Bugfixes and Daniel Berrange's crypto library.

      # gpg: Signature made Wed Jul  8 12:12:29 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        ossaudio: fix memory leak
        ui: convert VNC to use generic cipher API
        block: convert qcow/qcow2 to use generic cipher API
        ui: convert VNC websockets to use crypto APIs
        block: convert quorum blockdrv to use crypto APIs
        crypto: add a nettle cipher implementation
        crypto: add a gcrypt cipher implementation
        crypto: introduce generic cipher API & built-in implementation
        crypto: move built-in D3DES implementation into crypto/
        crypto: move built-in AES implementation into crypto/
        crypto: introduce new module for computing hash digests
        vl: move rom_load_all after machine init done

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8e84287da7dd6a46c0bb0e53190e79ba4eedf24
  Merge: d09952e 702c8c8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 19:44:28 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Wed Jul  8 19:08:28 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: Fix CD-ROM signature
        libqos/ahci: fix ahci_write_fis for ncq on ppc64

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 702c8c8be2f3317c81fff83f82d8a5f1d50d41b8
  Author: Hannes Reinecke <hare@suse.de>
  Date:   Mon Jul 6 17:49:51 2015 -0400

      ahci: Fix CD-ROM signature

      The CD-ROM signature is 0xeb140101, not 0xeb140000.
      Without this change OVMF/Duet runs into a timeout trying
      to detect a SATA cdrom.

      Signed-off-by: Hannes Reinecke <hare@suse.de>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1436219392-31915-2-git-send-email-jsnow@redhat.com

  commit 9ab9993f71b7eac6788deae2fbb7ec659ceb4a1e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jul 6 15:17:09 2015 -0400

      libqos/ahci: fix ahci_write_fis for ncq on ppc64

      Don't try to correct the endianness of NCQ commands, which do not
      use any fields wider than a single byte.

      This corrects the /x86_64/ahci/io/ncq/simple test (and others)
      for ppc64 BE hosts.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Tested-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1436210229-4118-2-git-send-email-jsnow@redhat.com

  commit d09952ee8caeea928695d5a3dc3ec50d8afb98c6
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jul 7 14:32:38 2015 +0100

      Fix the compatibility typedef of ioservid_t to match the Xen headers

      There is a mismatch between the definition of ioservid_t in
      xen_common.h and the definition in the Xen public headers. This patch
      corrects the definition in xen_common.h.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Tested-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1436275958-25174-1-git-send-email-paul.durrant@citrix.com
      Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8232b39bb18a91cde39b8e0b60e731a4ce782b1
  Merge: 62a3864 c4fc82b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 13:36:19 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc,virtio,pci: fixes and updates

      Most notably, this includes the TCO support for ICH: the last feature for 2.4
      as we are entering the hard freeze.

      Bugfixes only from now on.

      virtio pci also gained cfg access capability - arguably a bugfix
      since virtio spec makes it mandatory, but it's a big patch.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Jul  8 10:40:07 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        tco-test: fix up config accesses and re-enable
        virtio fix cfg endian-ness for BE targets
        virtio-pci: implement cfg capability
        virtio: define virtio_pci_cfg_cap in header.
        pcie: Set the "link active" in the link status register
        pci_regs.h: import from linux
        virtio_net: reuse constants from linux
        hw/i386/pc: don't carry FDC from pc_basic_device_init() to pc_cmos_init()
        hw/i386/pc: reflect any FDC @ ioport 0x3f0 in the CMOS
        hw/i386/pc: factor out pc_cmos_init_floppy()
        ich9: implement strap SPKR pin logic
        tests: add testcase for TCO watchdog emulation
        ich9: add TCO interface emulation
        acpi: split out ICH ACPI support
        Revert "dataplane: allow virtio-1 devices"
        dataplane: fix cross-endian issues

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 62a3864eb09414d3cee94a2a592ecd414200912f
  Merge: 59dc0a1 c54e1eb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jul 8 12:35:14 2015 +0100

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-07-06-v3-tag' into staging

      tag for qga-pull-2015-07-06-v3

      v3:
        - fix missing <windows.h> in configure test program.

      v2:
        - added configure check for guest-get-fs-info to avoid breakage on older
          MinGWs
        - removed extraneous include of ws2ipdef.h in w32
          guest-network-get-interfaces. ws2tcpip.h already provides those
          definitions, and older MinGWs don't have it.
        - rebased on latest master

      # gpg: Signature made Wed Jul  8 03:01:18 2015 BST using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-07-06-v3-tag:
        qga: added GuestPCIAddress information
        qga: added bus type and disk location path
        configure: add configure check for ntdddisk.h
        qga: added mountpoint and filesystem type for single volume
        qga: added empty qmp_quest_get_fsinfo functionality.
        qga: fail early for invalid time
        qga: win32 qmp_guest_network_get_interfaces implementation
        qga: add win32 library iphlpapi
        Revert "guest agent: remove g_strcmp0 usage"
        qga/qmp_guest_fstrim: Return per path fstrim result
        qga/commands-posix: Fix bug in guest-fstrim

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2828a307232ffceeddec9feb6a87ac660b68b693
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:01:10 2015 +0800

      ossaudio: fix memory leak

      Variable "conf" going out of scope leaks the storage
      it points to in line 856.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1435021270-7768-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 800567a613510c77a55decac4d25fea154d1ee22
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:38 2015 +0100

      ui: convert VNC to use generic cipher API

      Switch the VNC server over to use the generic cipher API, this
      allows it to use the pluggable DES implementations, instead of
      being hardcoded to use QEMU's built-in impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-11-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f6fa64f6d22b0ed53fb3be5883cd9719d17cb4f0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:37 2015 +0100

      block: convert qcow/qcow2 to use generic cipher API

      Switch the qcow/qcow2 block driver over to use the generic cipher
      API, this allows it to use the pluggable AES implementations,
      instead of being hardcoded to use QEMU's built-in impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-10-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8e9b0d24fb986d4241ae3b77752eca5dab4cb486
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:36 2015 +0100

      ui: convert VNC websockets to use crypto APIs

      Remove the direct use of gnutls for hash processing in the
      websockets code, in favour of using the crypto APIs. This
      allows the websockets code to be built unconditionally
      removing countless conditional checks from the VNC code.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-9-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 488981a4af396551a3178d032cc2b41d9553ada2
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:35 2015 +0100

      block: convert quorum blockdrv to use crypto APIs

      Get rid of direct use of gnutls APIs in quorum blockdrv in
      favour of using the crypto APIs. This avoids the need to
      do conditional compilation of the quorum driver. It can
      simply report an error at file open file instead if the
      required hash algorithm isn't supported by QEMU.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-8-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ed754746fea55df726f4de3dadb5bea0b6aa7409
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:34 2015 +0100

      crypto: add a nettle cipher implementation

      If we are linking to gnutls already and gnutls is built against
      nettle, then we should use nettle as a cipher backend in
      preference to our built-in backend.

      This will be used when linking against some GNUTLS 2.x versions
      and all GNUTLS 3.x versions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-7-git-send-email-berrange@redhat.com>
      [Change "#elif" to "#elif defined". - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62893b67cd82bbd48b013c1cec25f0d863612c80
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:33 2015 +0100

      crypto: add a gcrypt cipher implementation

      If we are linking to gnutls already and gnutls is built against
      gcrypt, then we should use gcrypt as a cipher backend in
      preference to our built-in backend.

      This will be used when linking against GNUTLS 1.x and many
      GNUTLS 2.x versions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-6-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ca38a4cc9e36647437b837b346a41981fb8880cd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:32 2015 +0100

      crypto: introduce generic cipher API & built-in implementation

      Introduce a generic cipher API and an implementation of it that
      supports only the built-in AES and DES-RFB algorithms.

      The test suite checks the supported algorithms + modes to
      validate that every backend implementation is actually correctly
      complying with the specs.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-5-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c4fc82bf1ad088a84ccedf779f6aa928e4fadb5f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 8 10:06:15 2015 +0300

      tco-test: fix up config accesses and re-enable

      The mistake that made the test fail was that it tried to
      use a BAR address as an offset for config accesses to LPC.

      Config accesses don't need a BAR, and LPC does not have one. Don't
      attempt to map it.

      With this change applied, TCO test passes, so re-enable it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1e40356ce5f6ccfa0bb57104a533c62952c560ce
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Jul 5 15:08:09 2015 +0200

      virtio fix cfg endian-ness for BE targets

      address_space_rw assumes data is in target format
      and byte-swaps it if target is BE and device is LE.
      Use fixed-endian LE APIs instead.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ada434cd0b44ce984318621e4bb79e067360d737
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 2 14:59:49 2015 +0200

      virtio-pci: implement cfg capability

      spec says we must, so let's do it!

      Note: the implementation is incorrect for BE targets.
      Will fix with a patch on top, not a big deal now as
      the only user is seabios, used on x86 only.

      Tested-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c36f24a2045d7a002b767ce023acfd9be63df692
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jul 2 12:52:44 2015 +0200

      virtio: define virtio_pci_cfg_cap in header.

      Update virtio pci header from linux-next virtio maintainer tree.
      We already have VIRTIO_PCI_CAP_PCI_CFG, let's define the structure
      that goes with it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b2101eae63ea57b571cee4a9075a4287d24ba4a4
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Sun Jul 5 09:26:03 2015 +1000

      pcie: Set the "link active" in the link status register

      Some firmwares can test that and assume the device hasn't come
      up if that bit isn't set

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 412a82457ef54821362ba27804e24a92fce09761
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 1 11:42:18 2015 +0200

      pci_regs.h: import from linux

      It seems to make sense to import pci_regs.h from linux:
      why maintain our own?
      As a first step, move the header to standard-headers,
      and add it to the update script.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f56fc2d319b18d5e510988374929188867a5f930
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jul 1 11:36:57 2015 +0200

      virtio_net: reuse constants from linux

      VIRTIO_NET_F_CTRL_GUEST_OFFLOADS now appears in the
      linux header, let's reuse it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 220a8846429ac954932e16010efb07af0aba4529
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:07 2015 +0200

      hw/i386/pc: don't carry FDC from pc_basic_device_init() to pc_cmos_init()

      Thanks to the last patch, pc_cmos_init() doesn't need the (optional)
      board-default FDC any longer as an input parameter. Update
      pc_basic_device_init() not to hand it back to pc_init1() / pc_q35_init(),
      and update the latter not to carry the FDC to pc_cmos_init(). This
      simplifies the code.

      pc_init1() | pc_q35_init()
        pc_basic_device_init()
        pc_cmos_init()

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b86f46132cd86b03f9e4a1cf6295f8b416e16afa
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:06 2015 +0200

      hw/i386/pc: reflect any FDC @ ioport 0x3f0 in the CMOS

      With the pc-q35-2.4 machine type, if the user creates an ISA FDC manually:

        -device isa-fdc,driveA=drive-fdc0-0-0 \
        -drive file=...,if=none,id=drive-fdc0-0-0,format=raw

      then the board-default FDC will be skipped, and only the explicitly
      requested FDC will exist. qtree-wise, this is correct; however such an FDC
      is currently not registered in the CMOS, because that code is only reached
      for the board-default FDC.

      The pc_cmos_init_late() one-shot reset handler -- one-shot because the
      CMOS is not reprogrammed during warm reset -- should search for any ISA
      FDC devices, created implicitly (by board code) or explicitly, and set the
      CMOS accordingly to the ISA FDC(s) with iobase=0x3f0:

      - if there is no such FDC, report both drives absent,
      - if there is exactly one such FDC, report its drives in the CMOS,
      - if there are more than one such FDCs, then pick one (it is not specified
        which one), and print a warning about the ambiguity.

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Reported-by: Jan Tomko <jtomko@redhat.com>
      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7444ca4ee2382170774ae201c473270d65620d75
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 25 15:35:05 2015 +0200

      hw/i386/pc: factor out pc_cmos_init_floppy()

      Extract the pc_cmos_init_floppy() function from pc_cmos_init(). The
      function sets two RTC registers: floppy drive types (0x10), overwriting
      the earlier value in there), and REG_EQUIPMENT_BYTE (0x14), setting bits
      in the prior value.

      Cc: Jan Tomko <jtomko@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5add35bec1e249bb5345a47008c8f298d4760be4
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:58 2015 -0300

      ich9: implement strap SPKR pin logic

      If the signal is sampled high, this indicates that the system is
      strapped to the "No Reboot" mode (ICH9 will disable the TCO Timer system
      reboot feature). The status of this strap is readable via the NO_REBOOT
      bit (CC: offset 0x3410:bit 5).

      The NO_REBOOT bit is set when SPKR pin on ICH9 is sampled high. This bit
      may be set or cleared by software if the strap is sampled low but may
      not override the strap when it indicates "No Reboot".

      This patch implements the logic where hardware has ability to set SPKR
      pin through a property named "noreboot" and it's sampled high by
      default.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 45dcdb9da632b5a5e7639707e12b1b17029c5a1e
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:57 2015 -0300

      tests: add testcase for TCO watchdog emulation

      This patch adds a testcase that covers the following:
        1) TCO default values
        2) first and second TCO timeout
        3) watch and validate ticks counter through TCO_RLD register
        4) maximum supported TCO timeout (0x3ff)
        5) watchdog actions (pause/reset/shutdown/none) upon second TCO
           timeout
        6) set and get of TCO control and status bits

      MST: The test does not pass yet, so it's disabled by default.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c54e1eb4928d4e6762c7100d1d1ef5f08ddf922b
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Jul 7 19:12:18 2015 -0500

      qga: added GuestPCIAddress information

      PCIAddress inforfation is obtained via SetupApi, which provides the
      information about address, bus, etc. We look throught entire device tree
      in the system and try to find device object for given volume. For this PDO
      SetupDiGetDeviceRegistryProperty is called, which reads PCI configuration
      for a given devicei if it is possible.

      This is the most convinient way for a userspace service. The lookup is
      performed for every volume available. However, this information is
      not mandatory for vss-provider.

      In order to use SetupApi we need to notify linker about it. We do not need
      to install additional libs, so we do not make separate configuration
      option to use libsetupapi.su

      SetupApi gives as the same information as kernel driver
      with IRP_MN_QUERY_INTERFACE.
      https://support.microsoft.com/en-us/kb/253232

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      * stub out get_pci_info if !CONFIG_QGA_NTDDSCSI
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a3ef3b2272d8349c932f8c440bcaa31d8518b1c0
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:22 2015 +0300

      qga: added bus type and disk location path

      According to Microsoft disk location path can be obtained via
      IOCTL_SCSI_GET_ADDRESS. Unfortunately this ioctl can not be used for all
      devices. There are certain bus types which could be obtained with this
      API. Please, refer to the following link for more details
      https://technet.microsoft.com/en-us/library/ee851589(v=ws.10).aspx

      Bus type could be obtained using IOCTL_STORAGE_QUERY_PROPERTY. Enum
      STORAGE_BUS_TYPE describes all buses supported by OS.

      Windows defines more bus types than Linux. Thus some values have been added
      to GuestDiskBusType.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      * fixed warning in CreateFile due to use of NULL instead of 0
      * only provide disk info when CONFIG_QGA_NTDDSCSI=y
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 50cbebb9a339f43cda2005785010361497151882
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Tue Jul 7 18:10:09 2015 -0500

      configure: add configure check for ntdddisk.h

      This header file provides w32 ioctl definitions for working with disk
      devices. Older versions of mingw do not expose this in a useable way,
      so add a configure check and report it via CONFIG_QGA_NTDDSCSI.

      Subsequent patches will use this macro to stub out functionality that
      relies on this in cases where it's not available.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d2b3f390d4e4b5d9dd74ae703d365a7b75a234ea
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:21 2015 +0300

      qga: added mountpoint and filesystem type for single volume

      We should use GetVolumeXXX api to work with volumes. This will help us to
      resolve the situation with volumes without drive letter, i.e. when the
      volume is mounted as a folder. Such volume is called mounted folder.
      This volume is a regular mounted volume from all other points of view.
      The information about non mounted volume is reported as System Reserved.
      This volume is not mounted and thus it is not writable.

      GuestDiskAddressList API is not used because operations are performed with
      volumes but no with disks. This means that spanned disk will
      be counted and handled as a single volume. It is worth mentioning
      that the information about every disk in the volume can be queried
      via IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit ef0a03f23061b9994fe5b2c3a208bc9fcba0099d
  Author: Olga Krishtal <okrishtal@virtuozzo.com>
  Date:   Tue Jun 30 13:25:20 2015 +0300

      qga: added empty qmp_quest_get_fsinfo functionality.

      We need qmp_quest_get_fsinfo togather with vss-provider, which works with
      volumes. The call to this function is implemented via
      FindFirst/NextVolumes. Moreover, volumes in Windows OS are filesystem unit,
      so it will be more effective to work with them rather with devices.

      Signed-off-by: Olga Krishtal <okrishtal@virtuozzo.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 00d2f3707a63881a0cec8d00cbd467f9b2d8af41
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Sun Jul 5 16:28:58 2015 +0200

      qga: fail early for invalid time

      It's possible to set system time with dates after 2070, however, it's
      not possible to set the RTC. It has limitation to up to year
      2070 (1970+100). In order to keep both clock in sync and before the
      kernel complains on invalid values, bail out early.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit d6c5528b0ce91667714b8c7dabaf4fbf8a898a9c
  Author: Kirk Allan <kallan@suse.com>
  Date:   Tue Jun 2 11:41:07 2015 -0600

      qga: win32 qmp_guest_network_get_interfaces implementation

      By default, IPv4 prefixes will be derived by matching the address
      to those returned by GetAdaptersInfo.  IPv6 prefixes can not be
      matched this way due to the unpredictable order of entries.

      In Windows Vista/2008 guests and newer, both IPv4 and IPv6 prefixes
      can be retrieved from OnLinkPrefixLength.  Setting --extra-cflags
      in the build configuration to "-D_WIN32_WINNT=0x600"
      or greater makes OnLinkPrefixLength available.  Setting --extra-cflags
      is not required and if not set, the default approach to get the prefix
      will be taken.

      Signed-off-by: Kirk Allan <kallan@suse.com>
      * drop ws2ipdef.h, it's missing on old mingw, and ws2tcpip.h already
        includes it automatically on new builds
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 601e5a0618ef3238e18fc38ece55ea4260910d5f
  Author: Kirk Allan <kallan@suse.com>
  Date:   Tue Jun 2 11:41:06 2015 -0600

      qga: add win32 library iphlpapi

      Add the iphlpapi library to use APIs such as GetAdaptersInfo and
      GetAdaptersAddresses.

      Signed-off-by: Kirk Allan <kallan@suse.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit f300414cfe9bb9e7b86411a670b68c1aa8edbd35
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 27 19:53:49 2015 +0200

      Revert "guest agent: remove g_strcmp0 usage"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_strcmp0() anymore.

      This reverts commit 8f4774789947bc4bc4c8d026a289fe980d3d2ee1.

      Conflicts:
      	qemu-ga.c

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit e82855d9aa4580620773b1b145ecab6ca1f2578c
  Author: Justin Ossevoort <justin@quarantainenet.nl>
  Date:   Mon May 11 08:58:45 2015 +0200

      qga/qmp_guest_fstrim: Return per path fstrim result

      The current guest-fstrim support only returns an error if some
      mountpoint was unable to be trimmed, skipping any possible additional
      mountpoints. The result of the TRIM operation itself is also discarded.

      This change returns a per mountpoint result of the TRIM operation. If an
      error occurs on some mountpoints that error is returned and the
      guest-fstrim continue with any additional mountpoints.

      The returned values for errors, minimum and trimmed are dependant on the
      filesystem, storage stacks and kernel version.

      Signed-off-by: Justin Ossevoort <justin@quarantainenet.nl>
      * s/type/struct/ in schema type definitions
      * moved version annotation for new guest-fstrim return field to
        the field itself rather than applying to the entire command
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 73a652a1b08445e8d91e50cdbb2da50e571c61b3
  Author: Justin Ossevoort <justin@quarantainenet.nl>
  Date:   Mon May 11 08:58:44 2015 +0200

      qga/commands-posix: Fix bug in guest-fstrim

      The FITRIM ioctl updates the fstrim_range structure it receives. This
      way the caller can determine how many bytes were trimmed. The
      guest-fstrim logic reuses the same fstrim_range for each filesystem,
      effectively limiting each filesystem to trim at most as much as the
      previous was able to trim.

      If a previous filesystem would have trimmed 0 bytes, than the next
      filesystem would report an error 'Invalid argument' because a FITRIM
      request with length 0 is not valid.

      This change resets the fstrim_range structure for each filesystem.

      Signed-off-by: Justin Ossevoort <justin@quarantainenet.nl>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 59dc0a1e9b4ccd9d8d7366fdc31acd5c1fbb240a
  Merge: 7ce0f7d cd3b29b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 23:16:42 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-07-07

      A few last minute fixes for 2.4. All of them are s390 TCG bug fixes.

      # gpg: Signature made Tue Jul  7 16:52:22 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream:
        tcg/s390: fix branch target change during code retranslation
        target-s390x: fix CONVERT TO BINARY (CVD, CVDY)
        target-s390x: fix EXECUTE instruction executing TRT
        target-s390x: fix MOVE LONG instruction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ce0f7dc87e50ebf58ac756ff6be17ec97d3ba4e
  Merge: 1a63203 6319b1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 21:16:06 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-07-07

      A few last minute PPC changes for 2.4:

        - spapr: Update SLOF
        - spapr: Fix a few bugs
        - spapr: Preparation for hotplug
        - spapr: Minor code cleanups
        - linux-user: Add mftb handling
        - kvm: Enable hugepage support with memory-backend-file
        - mac99: Remove nonexistent interrupt pin (Mac OS 9 fix)

      # gpg: Signature made Tue Jul  7 16:48:41 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (30 commits)
        sPAPR: Clear stale MSIx table during EEH reset
        sPAPR: Reenable EEH functionality on reboot
        sPAPR: Don't enable EEH on emulated PCI devices
        spapr-vty: Use TYPE_ definition instead of hardcoding
        spapr_vty: lookup should only return valid VTY objects
        spapr_pci: drop redundant args in spapr_[populate, create]_pci_child_dt
        spapr_pci: populate ibm,loc-code
        spapr_pci: enumerate and add PCI device tree
        xics_kvm: Don't enable KVM_CAP_IRQ_XICS if already enabled
        ppc: Update cpu_model in MachineState
        spapr: Consolidate cpu init code into a routine
        spapr: Reorganize CPU dt generation code
        cpus: Add a macro to walk CPUs in reverse
        spapr: Support ibm, lrdr-capacity device tree property
        spapr: Consider max_cpus during xics initialization
        Revert "hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*)"
        spapr_iommu: translate sPAPRTCEAccess to IOMMUAccessFlags
        spapr_iommu: drop erroneous check in h_put_tce_indirect()
        spapr_pci: set device node unit address as hex
        spapr_pci: encode class code including Prog IF register
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a632032d1ea09a09dc424ac2b10a4a11cd52ab9
  Merge: 30c6672 06ef227
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 20:12:55 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-07-07

      Patch "target-i386: emulate CPUID level of real hardware" was removed after the
      2015-07-03 pull request.

      # gpg: Signature made Tue Jul  7 15:46:23 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: avoid overflow in the tsc-frequency property
        i386: Introduce ARAT CPU feature

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 30c6672aa4b4bc9bdba3a7e46c49bba191660143
  Merge: 9861b71 9703116
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 19:12:45 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      v2:
       * Drop block/nfs patch since it exposes an unfinished QAPI interface [kwolf]

      # gpg: Signature made Tue Jul  7 14:29:47 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        blockjob: add block_job_release function
        block/raw-posix: Don't think /dev/fd/<NN> is a floppy drive.
        block: Use bdrv_drain to replace uncessary bdrv_drain_all
        block: Initialize local_err in bdrv_append_temp_snapshot
        block: update bdrv_drain_all()/bdrv_drain() comments
        qcow2: remove unnecessary check

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9861b71fd63f04175fddd1e93a417bae4a7808d7
  Merge: f2562fb dd63169
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 17:19:59 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150707' into staging

      migration/next for 20150707

      # gpg: Signature made Tue Jul  7 13:56:30 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150707: (28 commits)
        migration: extend migration_bitmap
        migration: protect migration_bitmap
        check_section_footers: Check the correct section_id
        migration: Add migration events on target side
        migration: Make events a capability
        migration: create migration event
        migration: No need to call trace_migrate_set_state()
        migration: Use always helper to set state
        migration: ensure we start in NONE state
        migration: Use cmpxchg correctly
        migration: Add configuration section
        vmstate: Create optional sections
        global_state: Make section optional
        migration: create new section to store global state
        runstate: migration allows more transitions now
        runstate: Add runstate store
        Fix older machine type compatibility on power with section footers
        Fail more cleanly in mismatched RAM cases
        Sanity check RDMA remote data
        Sort destination RAMBlocks to be the same as the source
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cd3b29b745b0ff393b2d37317837bc726b8dacc8
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jun 16 07:11:41 2015 +0200

      tcg/s390: fix branch target change during code retranslation

      Make sure to not modify the branch target. This ensure that the
      branch target is not corrupted during partial retranslation.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Tested-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 92f2b4e71e988ad2751c71717e9fe3387753442a
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 25 21:16:58 2015 +0200

      target-s390x: fix CONVERT TO BINARY (CVD, CVDY)

      current_number being shift left by more than 32 bits, we can't use a
      simple int. Similarly use an int64_t type for the input binary value,
      to not get the -2^31 case wrong. Finally don't initialize shift to 4,
      it's already done in the for loop.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c9c19b493286db7358f9ee26401b927bbbd21604
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun Jun 21 18:51:08 2015 +0200

      target-s390x: fix EXECUTE instruction executing TRT

      A break is missing in the EXECUTE instruction, when executing the
      TRANSLATE AND TEST instruction.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-By: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b5edcddda31b464e73cc0a79e88457e603c3b247
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue Jun 16 22:57:47 2015 +0200

      target-s390x: fix MOVE LONG instruction

      The MOVE LONG instruction should pad the destination operand with the
      byte from bit positions 32-39 of the source length (r2 + 1), not with
      the same byte in the source address.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6319b1dad04e66f450fb3ac6c31d2bf3940068b8
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:28 2015 +1000

      sPAPR: Clear stale MSIx table during EEH reset

      The PCI device MSIx table is cleaned out in hardware after EEH PE
      reset. However, we still hold the stale MSIx entries in QEMU, which
      should be cleared accordingly. Otherwise, we will run into another
      (recursive) EEH error and the PCI devices contained in the PE have
      to be offlined exceptionally.

      The patch introduces function spapr_phb_vfio_eeh_pre_reset(), which
      is called by sPAPR when asserting hot or fundamental reset, to clear
      stale MSIx table for VFIO PCI devices before EEH PE reset so that
      MSIx table could be restored properly after EEH PE reset.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aef87d1b879416909a4ac73e6fe2cea4a5630f40
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:27 2015 +1000

      sPAPR: Reenable EEH functionality on reboot

      When rebooting the guest, some PEs might be in frozen state. The
      contained PCI devices won't work properly if their frozen states
      aren't cleared in time. One case running into this situation would
      be maximal EEH error times encountered in the guest.

      The patch reenables the EEH functinality on PEs on PHB's reset
      callback, which will clear their frozen states if needed.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7cb180079e245024cf92ca218ca58858b679a7d6
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:26 2015 +1000

      sPAPR: Don't enable EEH on emulated PCI devices

      There might have emulated PCI devices, together with VFIO PCI
      devices under one PHB. The EEH capability shouldn't enabled
      on emulated PCI devices.

      The patch returns error when enabling EEH capability on emulated
      PCI devices by RTAS call "ibm,set-eeh-option".

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e275934d2dd44e38e0c6d53f9c22383d2ba57c17
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:25 2015 +1000

      spapr-vty: Use TYPE_ definition instead of hardcoding

      There's a call to object_dynamic_cast() in spapr_vty which uses the type
      name "spapr-vty" directly, instead of the usual idiom of using the #defined
      TYPE_VIO_SPAPR_VTY_DEVICE.  Fix it.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0f888bfaddfc5f55b0d82cde2e1164658a672375
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:24 2015 +1000

      spapr_vty: lookup should only return valid VTY objects

      If a guest passes the reg property of a valid VIO object that is not a VTY
      to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
      assertion and aborts.

      PAPR+ says "Hypervisor checks the termno parameter for validity against the
      Vterm IOA unit addresses assigned to the partition, else return H_Parameter."

      This patch adds a type check to ensure vty_lookup() either returns a pointer
      to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
      now return H_PARAMETER to the guest instead of crashing.

      The patch has no effect on the reg == 0 hack used to implement the RTAS call
      display-character.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e634b89c6ed2309814de7a89bd7c5ced96f59291
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:23 2015 +1000

      spapr_pci: drop redundant args in spapr_[populate, create]_pci_child_dt

      * phb_index is not being used and if required can be obtained from sphb
      * use helper to get drc_index in spapr_populate_pci_child_dt()
      * Check if drc_index is zero

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 16b0ea1d852873cf17630133d86df6a68e23f38c
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:22 2015 +1000

      spapr_pci: populate ibm,loc-code

      Each hardware instance has a platform unique location code.  The OF
      device tree that describes a part of a hardware entity must include
      the “ibm,loc-code” property with a value that represents the location
      code for that hardware entity.

      Populate ibm,loc-code.

      1) PCI passthru devices need to identify with its own ibm,loc-code
         available on the host. In failure cases use:
         vfio_<name>:<phb-index>:<bus>:<slot>.<fn>

      2) Emulated devices encode as following:
         qemu_<name>:<phb-index>:<bus>:<slot>.<fn>

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1d2d974244c6f1629ca83f1de293eaa557634627
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:21 2015 +1000

      spapr_pci: enumerate and add PCI device tree

      All the PCI enumeration and device node creation was off-loaded to
      SLOF. With PCI hotplug support, code needed to be added to add device
      node. This creates multiple copy of the code one in SLOF and other in
      hotplug code. To unify this, the patch adds the pci device node
      creation in Qemu. For backward compatibility, a flag
      "qemu,phb-enumerated" is added to the phb, suggesting to SLOF to not
      do device node creation.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      [ Squashed Michael's drc_index changes ]
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a45863bda90daa8ec39e5a312b9734fd4665b016
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:20 2015 +1000

      xics_kvm: Don't enable KVM_CAP_IRQ_XICS if already enabled

      When supporting CPU hot removal by parking the vCPU fd and reusing
      it during hotplug again, there can be cases where we try to reenable
      KVM_CAP_IRQ_XICS CAP for the vCPU for which it was already enabled.
      Introduce a boolean member in ICPState to track this and don't
      reenable the CAP if it was already enabled earlier.

      Re-enabling this CAP should ideally work, but currently it results in
      kernel trying to create and associate ICP with this vCPU and that
      fails since there is already an ICP associated with it. Hence this
      patch is needed to work around this problem in the kernel.

      This change allows CPU hot removal to work for sPAPR.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 19fb2c36e2475a2c68e7287e0e089d858dd7cc50
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:19 2015 +1000

      ppc: Update cpu_model in MachineState

      Keep cpu_model field in MachineState uptodate so that it can be used
      from the CPU hotplug path.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bab99ea09897fb65255cc4e147d87c077fafcfe6
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:18 2015 +1000

      spapr: Consolidate cpu init code into a routine

      Factor out bits of sPAPR specific CPU initialization code into
      a separate routine so that it can be called from CPU hotplug
      path too.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0da6f3fef9ae52127c14dfad1fdf1781e33ec5ec
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:17 2015 +1000

      spapr: Reorganize CPU dt generation code

      Reorganize CPU device tree generation code so that it be reused from
      hotplug path. CPU dt entries are now generated from spapr_finalize_fdt()
      instead of spapr_create_fdt_skel().

      Note: This is how the split-up looks like now:

      Boot path
      ---------
      spapr_finalize_fdt
       spapr_populate_cpus_dt_node
        spapr_populate_cpu_dt
         spapr_fixup_cpu_numa_dt
         spapr_fixup_cpu_smt_dt

      ibm,cas path
      ------------
      spapr_h_cas_compose_response
       spapr_fixup_cpu_dt
        spapr_fixup_cpu_numa_dt
        spapr_fixup_cpu_smt_dt

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8487d1231830917099c801e4f2f0e698e8535063
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:16 2015 +1000

      cpus: Add a macro to walk CPUs in reverse

      Add CPU_FOREACH_REVERSE that walks CPUs in reverse.

      Needed for PowerPC CPU device tree reorganization.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit db4ef288f4a6d285b39dc8ac477092d76971a300
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:15 2015 +1000

      spapr: Support ibm, lrdr-capacity device tree property

      Add support for ibm,lrdr-capacity since this is needed by the guest
      kernel to know about the possible hot-pluggable CPUs and Memory. With
      this, pseries kernels will start reporting correct maxcpus in
      /sys/devices/system/cpu/possible.

      Also define the minimum hotpluggable memory size as 256MB.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      [agraf: Fix compile error on 32bit hosts]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9e734e3deefd460188ea9bd107b65a528ccb7255
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:14 2015 +1000

      spapr: Consider max_cpus during xics initialization

      Use max_cpus instead of smp_cpus when intializating xics system. Also
      report max_cpus in ibm,interrupt-server-ranges device tree property of
      interrupt controller node.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 708414f03c3bebbd7ba8e4e98fb92602d2af8d0c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jul 2 16:23:13 2015 +1000

      Revert "hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*)"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_hash_table_iter_init() & friends anymore.

      This reverts commit f8833a37c0c6b22ddd57b45e48cfb0f97dbd5af4.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5709af3b9520c6912fc909128ae284512b127600
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:12 2015 +1000

      spapr_iommu: translate sPAPRTCEAccess to IOMMUAccessFlags

      The fact that these enums have matching values is pure coincidence. We
      actually need to translate from the PAPR definition to the QEMU one.

      This patch doesn't fix any bug, it is only code cleanup.

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4d9ab7d4ed46c63d047862d11946996005742a09
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:11 2015 +1000

      spapr_iommu: drop erroneous check in h_put_tce_indirect()

      The tce_list variable is not a TCE but the address to a TCE: we shouldn't
      clear permission bits as we do now. And this is dead code anyway since we
      check tce_list is 4K aligned a few lines above.

      This patch doesn't fix any bug, it is only code cleanup.

      Suggested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9b7d9284c3b114112a7759ce0a885df0767fe8d9
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:10 2015 +1000

      spapr_pci: set device node unit address as hex

      Device node names should encode the unit address as hex, while the
      code was encodind it as integers.

      Also, use FDT_NAME_MAX macro for allocating and composing the name.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4a7c34741584e91aa838a9e45b8ec5cdc65a343b
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:09 2015 +1000

      spapr_pci: encode class code including Prog IF register

      Current code missed the Prog IF register. All Class Code, Subclass,
      and Prog IF registers are needed to identify the accurate device type.

      For example: USB controllers use the PROG IF for denoting: USB
      FullSpeed, HighSpeed or SuperSpeed.

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 72187935b475454792512d44782a33f112b120e6
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:08 2015 +1000

      spapr_pci: encode missing 64-bit memory address space

      The properties reg/assigned-resources need to encode 64-bit memory
      address space as part of phys.hi dword.

        00 if configuration space
        01 if IO region,
        10 if 32-bit MEM region
        11 if 64-bit MEM region

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 183930c0d753e53d22c27d573b1803b04f8d68ac
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:07 2015 +1000

      spapr: Add sPAPRMachineClass

      Currently although we have an sPAPRMachineState descended from MachineState
      we don't have an sPAPRMAchineClass descended from MachineClass.  So far it
      hasn't been needed, but several upcoming features are going to want it,
      so this patch creates a stub implementation.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1b71890729953825c57d52ace48a7671c295e899
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:06 2015 +1000

      spapr: Remove obsolete entry_point field from sPAPRMachineState

      The sPAPRMachineState structure includes an entry_point field containing
      the initial PC value for starting the machine, even though this always has
      the value 0x100.

      I think this is a hangover from very early versions which bypassed the
      firmware when using -kernel.  In any case it has no function now, so remove
      it.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fb16499418aa7d71d2a4f2e3d79de444c4d054c0
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:05 2015 +1000

      spapr: Remove obsolete ram_limit field from sPAPRMachineState

      The ram_limit field was imported from sPAPREnvironment where it predates
      the machine's ram size being available generically from machine->ram_size.

      Worse, the existing code was inconsistent about where it got the ram size
      from.  Sometimes it used spapr->ram_limit, sometimes the global 'ram_size'
      and sometimes a local 'ram_size' masking the global.

      This cleans up the code to consistently use machine->ram_size, eliminating
      spapr->ram_limit in the process.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28e0204254c3f03e77106056a3a5730c4b8a2ac6
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Jul 2 16:23:04 2015 +1000

      spapr: Merge sPAPREnvironment into sPAPRMachineState

      The code for -machine pseries maintains a global sPAPREnvironment structure
      which keeps track of general state information about the guest platform.
      This predates the existence of the MachineState structure, but performs
      basically the same function.

      Now that we have the generic MachineState, fold sPAPREnvironment into
      sPAPRMachineState, the pseries specific subclass of MachineState.

      This is mostly a matter of search and replace, although a few places which
      relied on the global spapr variable are changed to find the structure via
      qdev_get_machine().

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 780184aae65d72378737e9cdb8fb61b0121e1e21
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu Jul 2 16:23:03 2015 +1000

      pseries: Update SLOF firmware image to qemu-slof-20150429

      The changelog is:
        > version: update to 20150429
        > pci: Use QEMU created PCI device nodes
        > usb: support 64-bit pci bars
        > pci: Support 64-bit address translation
        > pci: program correct bridge limit registers during probe
        > scsi: handle report-luns failure
        > Fix "key?" Forth word when using USB keyboards
        > Remove bulk.fs package
        > Include make.rules in the library Makefiles

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f303f117fec32c0705f88860e3eadf94135211c9
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Jul 2 16:23:02 2015 +1000

      spapr: ensure we have at least one XICS server

      XICS needs to know the upper value for cpu_index as it is used to compute
      the number of servers:

          smp_cpus * kvmppc_smt_threads() / smp_threads

      When passing -smp cpus=1,threads=9 on a POWER8 host, we end up with:

          1 * 8 / 9 = 0

      ... which leads to an assertion in both emulated:

      Number of servers needs to be greater 0
      Aborted (core dumped)

      ... and in-kernel XICS:

      xics_kvm_realize: Assertion `icp->nr_servers' failed.
      Aborted (core dumped)

      With this patch, we are sure that nr_servers > 0. Passing the same bogus
      -smp option then leads to:

      qemu-system-ppc64: Cannot support more than 8 threads on PPC with KVM

      ... which is a lot more explicit than the XICS errors.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2d103aae876518a91636ad6f4a4d866269c0d953
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu Jul 2 15:46:14 2015 -0500

      target-ppc: fix hugepage support when using memory-backend-file

      Current PPC code relies on -mem-path being used in order for
      hugepage support to be detected. With the introduction of
      MemoryBackendFile we can now handle this via:
        -object memory-file-backend,mem-path=...,id=hugemem0 \
        -numa node,id=mem0,memdev=hugemem0

      Management tools like libvirt treat the 2 approaches as
      interchangeable in some cases, which can lead to user-visible
      regressions even for previously supported guest configurations.

      Fix these by also iterating through any configured memory
      backends that may be backed by hugepages.

      Since the old code assumed hugepages always backed the entirety
      of guest memory, play it safe an pick the minimum across the
      max pages sizes for all backends, even ones that aren't backed
      by hugepages.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5c464f66f5696724c892339de242fac41f4d57a6
  Author: Cormac O'Brien <i.am.cormac.obrien@gmail.com>
  Date:   Wed Jun 17 17:04:11 2015 -0500

      macio: remove nonexistent interrupt on pin 1

      The current macio implementation declares an interrupt that doesn't appear to
      exist in the hardware or any other emulator implementation. OpenBIOS detects
      this interrupt and generates an 'interrupts' property in the macio device tree
      entry. Mac OS 9 halts boot when it detects this interrupt, so it has been
      removed to permit further progress in the boot process.

      Signed-off-by: Cormac O'Brien <i.am.cormac.obrien@gmail.com>
      Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7d6b1daedd00b35e50ce87ea835f662b36a23160
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Tue Jun 30 11:49:54 2015 +0200

      linux-user, ppc: mftbl can be used by user application

      In qemu-linux-user, when calling gethostbyname2(),
      it was hanging in .__res_nmkquery.

      (gdb) bt
      0 in .__res_nmkquery () from /lib64/libresolv.so.2
      1 in .__libc_res_nquery () from /lib64/libresolv.so.2
      2 in .__libc_res_nsearch () from /lib64/libresolv.so.2
      3 in ._nss_dns_gethostbyname3_r () from /lib64/libnss_dns.so.2
      4 in ._nss_dns_gethostbyname2_r () from /lib64/libnss_dns.so.2
      5 in .gethostbyname2_r () from /lib64/libc.so.6
      6 in .gethostbyname2 () from /lib64/libc.so.6

      .__res_nmkquery() is:

      ...
      do { RANDOM_BITS (randombits); } while ((randombits & 0xffff) == 0);
      ...

      <.__res_nmkquery+112>:	mftbl   r11
      <.__res_nmkquery+116>:	clrlwi  r10,r11,16
      <.__res_nmkquery+120>:	cmpwi   cr7,r10,0
      <.__res_nmkquery+124>:	beq     cr7,<.__res_nmkquery+112>

      but as mftbl (Move From Time Base Lower) is not implemented,
      r11 is always 0, so we have an infinite loop.

      This patch fills the Time Base register with cpu_get_real_ticks().

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f2562fbb7ac54d597cfe05f613d30296d1850d1b
  Merge: aeb7218 849729b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 15:48:49 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Tue Jul  7 13:38:13 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        rocker: tests: don't need to specify master/self when setting vlans
        rocker: mark copy-to-cpu pkts as forwarding offloaded
        rocker: return -1 when dropping packet on ingress
        rocker: fix missing break statements
        rocker: fix misplaced break statement
        rocker: don't queue receive pkts when port is disabled
        vmxnet3: Fix incorrect small packet padding
        e1000: flush packets when link comes up
        rocker: fix memory leak

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06ef227e5158cca6710e6c268d6a7f65a5e2811b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 24 14:11:27 2015 +0200

      target-i386: avoid overflow in the tsc-frequency property

      The TSC frequency fits comfortably in an int when expressed in kHz,
      but it may overflow when converted to Hz.  In this case,
      tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
      does a 32-bit multiplication before assigning to int64_t.

      For simplicity just make tsc_khz a 64-bit value.

      Spotted by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 28b8e4d0bf93ba176b4b7be819d537383c5a9060
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Jun 7 11:15:08 2015 +0200

      i386: Introduce ARAT CPU feature

      ARAT signals that the APIC timer does not stop in power saving states.
      As our APICs are emulated, it's fine to expose this feature to guests,
      at least when asking for KVM host features or with CPU types that
      include the flag. The exact model number that introduced the feature is
      not known, but reports can be found that it's at least available since
      Sandy Bridge.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit aeb72188e073d515e1f5a80f6b603692a396477b
  Merge: 1452673 501eea4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 14:44:19 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150707-1' into staging

      virtio-gpu property fixes, add testcase

      # gpg: Signature made Tue Jul  7 10:24:16 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150707-1:
        virtio-gpu: add to display-vga test
        virtio-gpu: use virtio_instance_init_common, fixup properties
        virtio-gpu: update console device property.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 970311646a701eecb103eb28093e8924d2fa6861
  Author: Ting Wang <kathy.wangting@huawei.com>
  Date:   Fri Jun 26 17:37:35 2015 +0800

      blockjob: add block_job_release function

      There is job resource leak in function mirror_start_job,
      although bdrv_create_dirty_bitmap is unlikely failed.
      Add block_job_release for each release when needed.

      Signed-off-by: Ting Wang <kathy.wangting@huawei.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1435311455-56048-1-git-send-email-kathy.wangting@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 25d9747b6427de8253221d544b45e50888d4cef7
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Wed Jul 1 15:40:14 2015 +0100

      block/raw-posix: Don't think /dev/fd/<NN> is a floppy drive.

      In libguestfs we use /dev/fd/<NN> to pass pre-opened file descriptors
      to qemu-img.  Lately I've discovered that although this works, qemu
      believes that these are floppy disk images.  That in itself isn't much
      of a problem, but now qemu prints a warning about host floppy
      pass-thru being deprecated.

      Extend the existing test so that it ignores /dev/fd/ as well as
      /dev/fdset/

      A simple test of this, if you are using the bash shell, is:

        qemu-img info <( cat /dev/null )

      without this patch:

        $ qemu-img info <( cat /dev/null )
        qemu-img: Host floppy pass-through is deprecated
        Support for it will be removed in a future release.
        qemu-img: Could not open '/dev/fd/63': Could not refresh total sector count: Illegal seek

      with this patch:

        $ qemu-img info <( cat /dev/null )
        qemu-img: Could not open '/dev/fd/63': Could not refresh total sector count: Illegal seek

      Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1435761614-31358-1-git-send-email-rjones@redhat.com
      Fixes: https://bugs.launchpad.net/qemu/+bug/1470536
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 53ec73e264f481b79b52efcadc9ceb8f8996975c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 29 18:53:14 2015 +0800

      block: Use bdrv_drain to replace uncessary bdrv_drain_all

      There callers work on a single BlockDriverState subtree, where using
      bdrv_drain() is more accurate.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c2e0dbbfd7265eb9a7170ab195d8f9f8a1cbd1af
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jul 6 12:24:44 2015 +0800

      block: Initialize local_err in bdrv_append_temp_snapshot

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1436156684-16526-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd63169766abd2b8dc33f4451dac5e778458a47c
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   Thu Jul 2 20:18:06 2015 +0800

      migration: extend migration_bitmap

      Prevously, if we hotplug a device(e.g. device_add e1000) during
      migration is processing in source side, qemu will add a new ram
      block but migration_bitmap is not extended.
      In this case, migration_bitmap will overflow and lead qemu abort
      unexpectedly.

      Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 2ff64038a59e8de2baa485806be0838f49f70b79
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   Thu Jul 2 20:18:05 2015 +0800

      migration: protect migration_bitmap

      Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 59f39a47411ab6007a592555dc639aa9753f8d23
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jul 2 09:22:03 2015 +0100

      check_section_footers: Check the correct section_id

      The section footers check was incorrectly checking the section_id
      in the SaveStateEntry not the LoadStateEntry.  These can validly be different
      if the two QEMU instances have instantiated their devices in a
      different order.  The test only cares that we're finishing the same
      section we started, and hence it's the LoadStateEntry that we care about.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7cf1fe6d68eb2ad3b77e2a89f097354db5d627e2
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 17:15:42 2015 +0200

      migration: Add migration events on target side

      We reuse the migration events from the source side, sending them on the
      appropiate place.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit b05dc72342b27585909d9e99d95d17fd3dfbb269
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Jul 7 14:44:05 2015 +0200

      migration: Make events a capability

      Make check fails with events.  THis is due to the parser/lexer that it
      uses.  Just in case that they are more broken parsers, just only send
      events when there are capabilities.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 598cd2bda0845096d2f06500e45b4d0d399b384a
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 12:16:15 2015 +0200

      migration: create migration event

      We have one argument that tells us what event has happened.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f2bb932491185a39922dff0514c4b08c092f3c35
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 01:38:25 2015 +0200

      migration: No need to call trace_migrate_set_state()

      We now use the helper everywhere, so no need to call this on this two
      places.  See on previous commit that there were a place where we missed
      to mark the trace.  Now all tracing is done in migrate_set_state().

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 7844337d1efb2c47dc3f306d7621e1cafca8ba67
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 01:36:40 2015 +0200

      migration: Use always helper to set state

      There were three places that were not using the migrate_set_state()
      helper, just fix that.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 656a233440e552230f9d1da016b94a81b86658dc
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jul 1 09:32:29 2015 +0200

      migration: ensure we start in NONE state

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit a5c17b5f68ff7e37ce6e6e1f5457307fe07629e7
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Jun 17 02:06:20 2015 +0200

      migration: Use cmpxchg correctly

      cmpxchg returns the old value

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 61964c23e5ddd5a33f15699e45ce126f879e3e33
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 13 18:17:43 2015 +0200

      migration: Add configuration section

      It needs to be the first one and it is not optional, that is the reason
      why it is opencoded.  For new machine types, it is required that machine
      type name is the same in both sides.

      It is just done right now for pc's.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit df8961522a3d6bc7bb60c2830ef59e7c6c67a928
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 15 09:39:14 2014 +0200

      vmstate: Create optional sections

      To make sections optional, we need to do it at the beggining of the code.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 13d16814d2058f10461e6987c8216950389c1310
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 13:58:24 2014 +0200

      global_state: Make section optional

      This section would be sent:

      a- for all new machine types
      b- for old machine types if section state is different form {running,paused}
         that were the only giving us troubles.

      So, in new qemus: it is alwasy there.  In old qemus: they are only
      there if it an error has happened, basically stoping on target.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit df4b1024526cae3479da3492d6371fd4a7324a03
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 10:58:10 2014 +0200

      migration: create new section to store global state

      This includes a new section that for now just stores the current qemu state.

      Right now, there are only one way to control what is the state of the
      target after migration.

      - If you run the target qemu with -S, it would start stopped.
      - If you run the target qemu without -S, it would run just after migration finishes.

      The problem here is what happens if we start the target without -S and
      there happens one error during migration that puts current state as
      -EIO.  Migration would ends (notice that the error happend doing block
      IO, network IO, i.e. nothing related with migration), and when
      migration finish, we would just "continue" running on destination,
      probably hanging the guest/corruption data, whatever.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit ca3fc39ea9045188e37b84c4f92ee79c7ed4b1c3
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 12:47:08 2014 +0200

      runstate: migration allows more transitions now

      Next commit would allow to move from incoming migration to error happening on source.

      Should we add more states to this transition?  Luiz?

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 5e0f1940caf49f56e3bee123aa92e42a3f7fad20
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed Oct 8 11:53:22 2014 +0200

      runstate: Add runstate store

      This allows us to store the current state to send it through migration.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit ff14e817f6c5f110b77e22185b256a17a96aa881
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Jun 12 18:37:52 2015 +0100

      Fix older machine type compatibility on power with section footers

      I forgot to add compatibility for Power when adding section footers.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

      Fixes: 37fb569c0198cba58e3e
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit ef4b722d19cab845eaa0d1f912018b09a9d8288b
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:28 2015 +0100

      Fail more cleanly in mismatched RAM cases

      If the number of RAMBlocks was different on the source from the
      destination, QEMU would hang waiting for a disconnect on the source
      and wouldn't release from that hang until the destination was manually
      killed.

      Mark the stream as being in error, this causes the destination to die
      and the source to carry on.

      (It still gets a whole bunch of warnings on the destination, and I've
      not managed to complete another migration after the 1st one, still
      progress).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit afcddefdbe75d0c20bf6e11b5512ba768ce0700c
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:27 2015 +0100

      Sanity check RDMA remote data

      Perform some basic (but probably not complete) sanity checking on
      requests from the RDMA source.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e4d633207c129dc5b7d145240ac4a1997ef3902f
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:26 2015 +0100

      Sort destination RAMBlocks to be the same as the source

      Use the order of incoming RAMBlocks from the source to record
      an index number; that then allows us to sort the destination
      local RAMBlock list to match the source.

      Now that the RAMBlocks are known to be in the same order, this
      simplifies the RDMA Registration step which previously tried to
      match RAMBlocks based on offset (which isn't guaranteed to match).

      Looking at the existing compress code, I think it was erroneously
      relying on an assumption of matching ordering, which this fixes.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 760ff4bebc86d08b252809e0da7261c986d022ff
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:25 2015 +0100

      Rework ram block hash

      RDMA uses a hash from block offset->RAM Block; this isn't needed
      on the destination, and it becomes harder to maintain after the next
      patch in the series that sorts the block list.

      Split the hash so that it's only generated on the source.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 03fcab38617ac9bcd6ed28cb1b6a0ecd8fb3bc82
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:24 2015 +0100

      Allow rdma_delete_block to work without the hash

      In the next patch we remove the hash on the destination,
      rdma_delete_block does two things with the hash which can be avoided:
        a) The caller passes the offset and rdma_delete_block looks it up
           in the hash; fixed by getting the caller to pass the block
        b) The hash gets recreated after deletion; fixed by making that
           conditional on the hash being initialised.

      While this function is currently only used during cleanup, Michael
      asked that we keep it general for future dynamic block registration
      work.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 632e3a5cd812d6bbd38fd2f3ffc189ff5ea51926
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:23 2015 +0100

      Rework ram_control_load_hook to hook during block load

      We need the names of RAMBlocks as they're loaded for RDMA,
      reuse a slightly modified ram_control_load_hook:
        a) Pass a 'data' parameter to use for the name in the block-reg
           case
        b) Only some hook types now require the presence of a hook function.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b12f7777981953b7d939496283014740bdd6de64
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:22 2015 +0100

      Translate offsets to destination address space

      The 'offset' field in RDMACompress and 'current_addr' field
      in RDMARegister are commented as being offsets within a particular
      RAMBlock, however they appear to actually be offsets within the
      ram_addr_t space.

      The code currently assumes that the offsets on the source/destination
      match, this change removes the need for the assumption for these
      structures by translating the addresses into the ram_addr_t space of
      the destination host.

      Note: An alternative would be to change the fields to actually
      take the data they're commented for; this would potentially be
      simpler but would break stream compatibility for those cases
      that currently work.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4fb5364b9096d6110c46604dbf1e19b7e766e757
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:21 2015 +0100

      Store block name in local blocks structure

      In a later patch the block name will be used to match up two views
      of the block list.  Keep a copy of the block name with the local block
      list.

      (At some point it could be argued that it would be best just to let
      migration see the innards of RAMBlock and avoid the need to use
      foreach).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 24ec68ef84fdacd5dddb83f3b341165c4815e6d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jun 11 18:17:20 2015 +0100

      rdma typos

      A couple of typo fixes.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1aca9a5f7d5a1ef9ee0233eac0fccc77ea6f0626
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Jun 23 17:34:35 2015 +0100

      Only try and read a VMDescription if it should be there

      The VMDescription section maybe after the EOF mark, the current code
      does a 'qemu_get_byte' and either gets the header byte identifying the
      description or an error (which it ignores).  Doing the 'get' upsets
      RDMA which hangs on old machine types without the VMDescription.

      Just avoid reading the VMDescription if we wouldn't send it.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 728470bea15b11ba7b3e3db54f0d9939908e0e65
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 15:56:38 2015 +0800

      rdma: fix memory leak

      Variable "r" going out of scope leaks the storage
      it points to in line 3268.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 849729bb796e0ecbb3f370f119682f2821dd1441
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:12 2015 -0700

      rocker: tests: don't need to specify master/self when setting vlans

      4.1 Linux kernel doesn't require specifying "master" or "self" when setting
      vlans on a port, so clean these up from the tests that use vlans.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-6-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d0d2555852c5e684a97dce787d3c2a65b9a6d64c
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:11 2015 -0700

      rocker: mark copy-to-cpu pkts as forwarding offloaded

      For pkts copied to the CPU (to be processed by guest driver), mark the Rx
      descriptor with flag "OFFLOAD_FWD" to indicate device has already forwarded
      pkt.  The guest driver will use this indicator to avoid duplicate
      forwarding in the guest OS.

      Examples include bcast/mcast/unknown ucast pkts flooded to bridged ports.
      We want to avoid both the device and the guest bridge driver flooding these
      pkts, which would result in duplicates pkts on the wire.  Packet sampling,
      such as sFlow, can also use this technique to mark pkts for the guest OS to
      record but otherwise drop.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 96497af0afd60e57749316f1bc196b417055c585
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:10 2015 -0700

      rocker: return -1 when dropping packet on ingress

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1435746792-41278-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f211fcd75fec96ec9850885622ed028c6f7ebdf4
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:09 2015 -0700

      rocker: fix missing break statements

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435746792-41278-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1a88c96b7f94c8e12c07518f55fce8873e814d0
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jul 1 03:33:08 2015 -0700

      rocker: fix misplaced break statement

      Premature break in switch case block.  This particular case (group L2 rewrite)
      will be used for L2 LAG and L3 ECMP support, neither of which are enabled in
      the guest driver at this time, but are under development.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435746792-41278-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 66851f640b73a5a84160ee6ab19ab429f68bbb9f
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Tue Jun 30 19:25:53 2015 -0700

      rocker: don't queue receive pkts when port is disabled

      Commit 6e99c63 ("net/socket: Drop net_socket_can_send") changed the
      semantics around .can_receive for sockets to now require the device to
      flush queued pkts when transitioning to a .can_receive=true state.  Rocker
      device was not flushing the queue on .can_receive=true transition, so the
      receiver was stuck.

      But, turns out we really don't want any queuing at all on the port when the
      port is disabled, otherwise when the port transitions to enabled, we'd
      receive and forward stale pkts that really should have been dropped.  So,
      let's remove .can_receive so avoid queuing and drop the pkt in .receive if
      the port is disabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435717553-36187-1-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b83b5f2ef9753713c2fb64ff4cae7cb1e080624e
  Author: Brian Kress <kressb@moose.net>
  Date:   Tue Jun 23 11:49:25 2015 -0400

      vmxnet3: Fix incorrect small packet padding

      When running ESXi under qemu there is an issue with the ESXi guest
      discarding packets that are too short.  The guest discards any packets
      under the normal minimum length for an ethernet packet (60).  This
      results in odd behaviour where other hosts or VMs on other hosts can
      communicate with the ESXi guest just fine (since there's a physical NIC
      somewhere doing padding), but VMs on the host and the host itself cannot
      because the ARP request packets are too small for the ESXi host to
      accept.

      Someone in the past thought this was worth fixing, and added code to the
      vmxnet3 qemu emulation such that if it is receiving packets smaller than
      60 bytes to pad the packet out to 60. Unfortunately this code is wrong
      (or at least in the wrong place). It does so BEFORE before taking into
      account the vnet_hdr at the front of the packet added by the tap device.
      As a result, it might add padding, but it never adds enough.
      Specifically it adds 10 less (the length of the vnet_hdr) than it needs
      to.

      The following (hopefully "obviously correct") patch simply swaps the
      order of processing the vnet header and the padding.  With this patch an
      ESXi guest is able to communicate with the host or other local VMs.

      Signed-off-by: Brian Kress <kressb@moose.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5df6a1855b62dc653515d919e48c5b6f00c48f32
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Jun 25 10:18:05 2015 +0100

      e1000: flush packets when link comes up

      e1000_can_receive() checks the link up status register bit.  If the bit
      is clear, packets will be queued and the peer may disable receive to
      avoid wasting CPU reading packets that cannot be delivered.  The queue
      must be flushed once the link comes back up again.

      This patch fixes broken e1000 receive with Mac OS X Snow Leopard guests
      and tap networking.  Flushing the queue invokes the async send callback,
      which re-enables tap fd read.

      Reported-by: Jonathan Liu <net147@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435223885-12745-1-git-send-email-stefanha@redhat.com

  commit ec50dd4634ae06091e61f42b7ba975f9ed510ad0
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jun 25 14:24:10 2015 +0800

      rocker: fix memory leak

      Meanwhile, using g_new0 instead of g_malloc0,
      refer to commit 5839e53.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-id: 1435213450-6700-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 920557971b60e53c2f3f22e5d6c620ab1ed411fd
  Author: Paulo Alcantara <pcacjr@gmail.com>
  Date:   Sun Jun 28 14:58:56 2015 -0300

      ich9: add TCO interface emulation

      This interface provides some registers within a 32-byte range and can be
      acessed through PCI-to-LPC bridge interface (PMBASE + 0x60).

      It's commonly used as a watchdog timer to detect system lockups through
      SMIs that are generated -- if TCO_EN bit is set -- on every timeout. If
      NO_REBOOT bit is not set in GCS (General Control and Status register),
      the system will be resetted upon second timeout if TCO_RLD register
      wasn't previously written to prevent timeout.

      This patch adds support to TCO watchdog logic and few other features
      like mapping NMIs to SMIs (NMI2SMI_EN bit), system intruder detection,
      etc. are not implemented yet.

      Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71ba2f0af398f616e154137d9fdda25c2da01324
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jul 7 13:00:56 2015 +0300

      acpi: split out ICH ACPI support

      MIPS doesn't need it, and including it creates problem as we are adding
      dependency on ISA LPC bridge.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fd72468dfe40532df7c64d35054994058106c42
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:31 2015 +0100

      crypto: move built-in D3DES implementation into crypto/

      To prepare for a generic internal cipher API, move the
      built-in D3DES implementation into the crypto/ directory.

      This is not in fact a normal D3DES implementation, it is
      D3DES with double & triple length modes removed, and the
      key bytes in reversed bit order. IOW it is crippled
      specifically for the "benefit" of RFB, so call the new
      files desrfb.c instead of d3des.c to make it clear that
      it isn't a generally useful impl.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-4-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f2945cde60545aae7f31ab9d5ef29531efbc94f
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:30 2015 +0100

      crypto: move built-in AES implementation into crypto/

      To prepare for a generic internal cipher API, move the
      built-in AES implementation into the crypto/ directory

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-3-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ddbb0d09661f5fce21b335ba9aea8202d189b98e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jul 1 18:10:29 2015 +0100

      crypto: introduce new module for computing hash digests

      Introduce a new crypto/ directory that will (eventually) contain
      all the cryptographic related code. This initially defines a
      wrapper for initializing gnutls and for computing hashes with
      gnutls. The former ensures that gnutls is guaranteed to be
      initialized exactly once in QEMU regardless of CLI args. The
      block quorum code currently fails to initialize gnutls so it
      only works by luck, if VNC server TLS is not requested. The
      hash APIs avoids the need to litter the rest of the code with
      preprocessor checks and simplifies callers by allocating the
      correct amount of memory for the requested hash.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Message-Id: <1435770638-25715-2-git-send-email-berrange@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7a63f3cdc44230109c91cdc0ee912c3cc7837141
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Jul 2 17:24:41 2015 +0100

      block: update bdrv_drain_all()/bdrv_drain() comments

      The doc comments for bdrv_drain_all() and bdrv_drain() are outdated:

       * The bdrv_drain() comment is a poor man's bdrv_lock()/bdrv_unlock()
         which Fam Zheng is currently developing.  Unfortunately this warning
         was never really enough because devices keep submitting I/O and op
         blockers don't prevent that.

       * The bdrv_drain_all() comment is still partially correct but reflects
         the nature of the implementation rather than API documentation.

      Do make it clear that bdrv_drain() is only appropriate within an
      AioContext.  For anything spanning AioContexts you need
      bdrv_drain_all().

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435854281-6078-1-git-send-email-stefanha@redhat.com

  commit 1bd84ee717bf146c19281cce48a36a2f4d71748d
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Jul 2 11:06:11 2015 +0300

      qcow2: remove unnecessary check

      The value of 'i' is guaranteed to be >= 0

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1435824371-2660-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 501eea4f4187b6c62b6cf348ab0b100d57d8c56b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Apr 28 11:10:12 2014 +0200

      virtio-gpu: add to display-vga test

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b3409a31001e86d48221ea967b1c696c6497f318
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 12:22:09 2015 +0200

      virtio-gpu: use virtio_instance_init_common, fixup properties

      Switch over to virtio_instance_init_common.  Drop duplicate properties
      in virtio-gpu-pci and virtio-vga as they are properly aliased now.  Also
      drop the indirection via DEFINE_VIRTIO_GPU_PROPERTIES, we don't need it
      any more as the properties are defined in a single place now.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e18882952e46634ab7f53ef018a5e2e980996d48
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 12:19:42 2015 +0200

      virtio-gpu: update console device property.

      Update the device link of the QemuConsole, so it points to the
      virtio-gpu-pci or virtio-vga device instead of virtio-gpu-device.

      This is needed because we want to find the device by id, for
      example for input routing, and the id specified on the command
      line is attached to the pci proxy, not the virtio device.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6b3f7f639ed8861cd034292f9bb85b00c73658a6
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 16 17:07:54 2015 +0100

      vl: move rom_load_all after machine init done

      On ARM, commit ac9d32e39664e060cd1b538ff190980d57ad69e4 postponed the
      memory preparation for boot until the machine init done notifier. This
      has for consequence to insert ROM at machine init done time.

      However the rom_load_all function stayed called before the ROM are
      inserted. As a consequence the rom_load_all function does not do
      everything it is expected to do, on ARM.

      It currently registers the ROM reset notifier but does not iterate through
      the registered ROM list. the isrom field is not set properly. This latter
      is used to report info in the monitor and also to decide whether the
      rom->data can be freed on ROM reset notifier.

      To fix that regression the patch moves the rom_load_all call after
      machine init done. We also take the opportunity to rename the rom_load_all
      function into rom_check_and_resgister_reset() and integrate the
      rom_load_done in it.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reported-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1434470874-22573-1-git-send-email-eric.auger@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1452673888f6d7f0454276d049846c9bec659233
  Merge: f6e3035 4330296
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jul 7 09:22:40 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150706.0' into staging

      VFIO updates for 2.4-rc0
      - "real" host page size API (Peter Crosthwaite)
      - platform device irqfd support (Eric Auger)
      - spapr container disconnect fix (Alexey Kardashevskiy)
      - quirk for broken Chelsio hardware (Gabriel Laupre)
      - coverity fix (Paolo Bonzini)

      # gpg: Signature made Mon Jul  6 19:23:49 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150706.0:
        vfio/pci : Add pba_offset PCI quirk for Chelsio T5 devices
        vfio: Unregister IOMMU notifiers when container is destroyed
        hw/vfio/platform: add irqfd support
        kvm: some fixes to kvm_resamplefds_allowed
        sysbus: add irq_routing_notifier
        intc: arm_gic_kvm: set the qemu_irq/gsi mapping
        kvm-all.c: add qemu_irq/gsi hash table and utility routines
        kvm: rename kvm_irqchip_[add,remove]_irqfd_notifier with gsi suffix
        vfio: cpu: Use "real" page size API
        cpu-all: complete "real" host page size API
        vfio: fix return type of pread

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

      Conflicts:
      	kvm-all.c

  commit f329c74c1e7f08399f0d237f78571eb0ca6a89dd
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Jun 23 15:52:56 2015 +0200

      Revert "dataplane: allow virtio-1 devices"

      This reverts commit f5a5628cf0b65b223fa0c9031714578dfac4cf04.

      This was an old patch that had been already superseded by b0e5d90eb
      ("dataplane: endianness-aware accesses").

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit be1e50a27d5b6845729ae0854f57f3816cf47edb
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Fri Jun 26 09:32:28 2015 +0200

      dataplane: fix cross-endian issues

      Accesses to vring_avail_event and vring_used_event must honor the queue
      endianness.

      This patch allows cross-endian setups to use dataplane (tested with ppc64
      on ppc64le, and vice-versa).

      Suggested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f6e3035f75e5c6a73485335765ae070304c7a110
  Merge: 7edd8e4 355023f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 23:37:53 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream-smm' into staging

      This series implements KVM support for SMM, and lets you enable/disable
      it through the "smm" property of x86 machine types.

      # gpg: Signature made Mon Jul  6 17:41:05 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream-smm:
        pc: add SMM property
        ich9: add smm_enabled field and arguments
        pc_piix: rename kvm_enabled to smm_enabled
        target-i386: register a separate KVM address space including SMRAM regions
        kvm-all: kvm_irqchip_create is not expected to fail
        kvm-all: add support for multiple address spaces
        kvm-all: make KVM's memory listener more generic
        kvm-all: move internal types to kvm_int.h
        kvm-all: remove useless typedef
        kvm-all: put kvm_mem_flags to more work
        target-i386: add support for SMBASE MSR and SMIs
        piix4/ich9: do not raise SMI on ACPI enable/disable commands
        linux-headers: Update to 4.2-rc1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43302969966bc3a95470bfc300289a83068ef5d9
  Author: Gabriel Laupre <glaupre@chelsio.com>
  Date:   Mon Jul 6 12:15:15 2015 -0600

      vfio/pci : Add pba_offset PCI quirk for Chelsio T5 devices

      Fix pba_offset initialization value for Chelsio T5 Virtual Function
      device. The T5 hardware has a bug in it where it reports a Pending Interrupt
      Bit Array Offset of 0x8000 for its SR-IOV Virtual Functions instead
      of the 0x1000 that the hardware actually uses internally. As the hardware
      doesn't return the correct pba_offset value, add a quirk to instead
      return a hardcoded value of 0x1000 when a Chelsio T5 VF device is
      detected.

      This bug has been fixed in the Chelsio's next chip series T6 but there are
      no plans to respin the T5 ASIC for this bug. It is just documented in the
      T5 Errata and left it at that.

      Signed-off-by: Gabriel Laupre <glaupre@chelsio.com>
      Reviewed-by: Bandan Das <bsd@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit f8d8a944009b7e836c718a05590ea6b36146978f
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Jul 6 12:15:15 2015 -0600

      vfio: Unregister IOMMU notifiers when container is destroyed

      On systems with guest visible IOMMU, adding a new memory region onto
      PCI bus calls vfio_listener_region_add() for every DMA window. This
      installs a notifier for IOMMU memory regions. The notifier is supposed
      to be removed vfio_listener_region_del(), however in the case of mixed
      PHB (emulated + VFIO devices) when last VFIO device is unplugged and
      container gets destroyed, all existing DMA windows stay alive altogether
      with the notifiers which are on the linked list which head was in
      the destroyed container.

      This unregisters IOMMU memory region notifier when a container is
      destroyed.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit fb5f816499a5184a1336d72db030b8419b523082
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      hw/vfio/platform: add irqfd support

      This patch aims at optimizing IRQ handling using irqfd framework.

      Instead of handling the eventfds on user-side they are handled on
      kernel side using
      - the KVM irqfd framework,
      - the VFIO driver virqfd framework.

      the virtual IRQ completion is trapped at interrupt controller
      This removes the need for fast/slow path swap.

      Overall this brings significant performance improvements.

      Signed-off-by: Alvise Rigo <a.rigo@virtualopensystems.com>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 879904e8635b316de18393222f02d46d2d1f7f4e
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      kvm: some fixes to kvm_resamplefds_allowed

      Commit f41389ae3c54b introduced kvm_resamplefds_enabled() and
      associated kvm_resamplefds_allowed boolean. This patch adds
      non-KVM version for kvm_resamplefds_enabled and also declares
      kvm_resamplefds_allowed in kvm-stub as it is done for fellow
      kvm_irqfds_allowed.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 715ca691daca081108b33306faa6fa102f0df8d8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:14 2015 -0600

      sysbus: add irq_routing_notifier

      Add a new connect_irq_notifier notifier in the SysBusDeviceClass. This
      notifier, if populated, is called after sysbus_connect_irq.

      This mechanism is used to setup VFIO signaling once VFIO platform
      devices get attached to their platform bus, on a machine init done
      notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6a1a9cfa1c4a3e5b521d82e6adb94311fc5b9f8b
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      intc: arm_gic_kvm: set the qemu_irq/gsi mapping

      The arm_gic_kvm now calls kvm_irqchip_set_qemuirq_gsi to build
      the hash table storing qemu_irq/gsi mappings. From that point on
      irqfd can be setup directly from the qemu_irq using
      kvm_irqchip_add_irqfd_notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 197e35249a7360534e1aea0f2268ad0e1aa27121
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      kvm-all.c: add qemu_irq/gsi hash table and utility routines

      VFIO platform device needs to setup irqfd but it does not know the
      gsi corresponding to the device qemu_irq. This patch proposes to
      store a hash table in kvm_state using the qemu_irq as key and the gsi
      as a value.

      kvm_irqchip_set_qemuirq_gsi allows to insert such a pair. The interrupt
      controller is supposed to use it.

      kvm_irqchip_[add, remove]_irqfd_notifier allows to setup/tear down
      irqfd directly from the qemu_irq.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 1c9b71a7311ed99635a2d007fc8a856879537a05
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jul 6 12:15:13 2015 -0600

      kvm: rename kvm_irqchip_[add,remove]_irqfd_notifier with gsi suffix

      Anticipating for the introduction of new add/remove functions taking
      a qemu_irq parameter, let's rename existing ones with a gsi suffix.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit f7ceed190d7dcd907afe4b46b23809aaad09a619
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      vfio: cpu: Use "real" page size API

      This is system level code, and should only depend on the host page
      size, not the target page size.

      Note that HOST_PAGE_SIZE is misleadingly lead and is really aligning
      to both host and target page size. Hence it's replacement with
      REAL_HOST_PAGE_SIZE.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 4e51361d79289aee2985dfed472f8d87bd53a8df
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      cpu-all: complete "real" host page size API

      Currently the "host" page size alignment API is really aligning to both
      host and target page sizes. There is the qemu_real_page_size which can
      be used for the actual host page size but it's missing a mask and ALIGN
      macro as provided for qemu_page_size. Complete the API. This allows
      system level code that cares about the host page size to use a
      consistent alignment interface without having to un-needingly align to
      the target page size. This also reduces system level code dependency
      on the cpu specific TARGET_PAGE_SIZE.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 7d489dcdf5fd71b5052ffd401b869a627e1c751f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jul 6 12:15:12 2015 -0600

      vfio: fix return type of pread

      size_t is an unsigned type, thus the error case is never reached in
      the below call to pread.  If bytes is negative, it will be seen as
      a very high positive value.

      Spotted by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 355023f2010c4df619d88a0dd7012b4b9c74c12c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:52 2015 +0200

      pc: add SMM property

      The property can take values on, off or auto.  The default is "off"
      for KVM and pre-2.4 machines, otherwise "auto" (which makes it
      available on TCG or on new-enough kernels).

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fba72476c6b7be60ac74c5bcdc06c61242d1fe4f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:51 2015 +0200

      ich9: add smm_enabled field and arguments

      Q35's ACPI device is hard-coding SMM availability to KVM.  Place the
      logic where the board is created instead, so that it will be possible
      to override it.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 61e66c6237a0ca3eac35cf3145ccbb3ab5b6354c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:17 2015 +0200

      pc_piix: rename kvm_enabled to smm_enabled

      We will enable SMM even if KVM is in use.  Rename the field and
      arguments.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6410848bec38089424d54a6a8f10d4cf77182b5d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:16 2015 +0200

      target-i386: register a separate KVM address space including SMRAM regions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8db4936bb648e15173d687bc162be14fd0d4260c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:15 2015 +0200

      kvm-all: kvm_irqchip_create is not expected to fail

      KVM_CREATE_IRQCHIP should never fail, and so should its userspace
      wrapper kvm_irqchip_create.  The function does not do anything
      if the irqchip capability is not available, as is the case for PPC.

      With this patch, kvm_arch_init can allocate memory and it will not
      be leaked.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 38bfe69180f99d05611a14bab4bb72c95e755b58
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:14 2015 +0200

      kvm-all: add support for multiple address spaces

      Make kvm_memory_listener_register public, and assign a kernel
      address space id to each KVMMemoryListener.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7bbda04c8d13d0a599b31ed1c10dc76a62f9d4dc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:30:13 2015 +0200

      kvm-all: make KVM's memory listener more generic

      No semantic change, but s->slots moves into a new struct
      KVMMemoryListener.  KVM's memory listener becomes a member of struct
      KVMState, and becomes of type KVMMemoryListener.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8571ed35cfa50ed6b2aaee484dfa4f58176ebe00
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:45 2015 +0200

      kvm-all: move internal types to kvm_int.h

      i386 code will have to define a different KVMMemoryListener.  Create
      an internal header so that KVMSlot is not exposed outside.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 714f78c587ba628169b8ae6f91866c52fe6a799f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:44 2015 +0200

      kvm-all: remove useless typedef

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d6ff5cbc1231a5aec997abf3a809c7013e60472f
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Thu Jun 18 18:28:43 2015 +0200

      kvm-all: put kvm_mem_flags to more work

      Currently kvm_mem_flags just translates bools to bits, let's
      make it also determine the bools first. This avoids its parameter
      list growing each time we add a flag.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc12d72e10828ca6ff75f2ad432b741f07a10cef
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:42 2015 +0200

      target-i386: add support for SMBASE MSR and SMIs

      Apart from the MSR, the smi field of struct kvm_vcpu_events has to be
      translated into the corresponding CPUX86State fields.  Also,
      memory transaction flags depend on SMM state, so pull it from struct
      kvm_run on every exit from KVM to userspace.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit afd6895b45f20eb43b7ff95f7a76cc5af8d36cd7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:28:41 2015 +0200

      piix4/ich9: do not raise SMI on ACPI enable/disable commands

      These commands are handled entirely by QEMU.  Do not raise an SMI
      when they happen, because Windows (at least 2008r2) expects these
      commands to work and (depending on the value of APMC_EN at
      startup) the firmware might not have installed an SMI handler.

      When this happens (e.g. the kernel supports SMIs, or you are using
      TCG, but you have used "-machine smm=off") RIP is moved to 0x38000
      where there is no code to execute.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 25b8b39b6d7de95d0dd5ae7b66b3ac4b9b83e060
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Jul 6 12:10:57 2015 +1000

      linux-headers: Update to 4.2-rc1

      This updates linux-headers against master 4.2-rc1 (commit
      d770e558e21961ad6cfdf0ff7df0eb5d7d4f0754). This is the result of
      ./scripts/update-linux-headers.sh work.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7edd8e4660beb301d527257f8e04ebec0f841cb0
  Merge: 3fa18bc b242e0e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 14:03:44 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * more of Peter Crosthwaite's multiarch preparation patches
      * unlocked MMIO support in KVM
      * support for compilation with ICC

      # gpg: Signature made Mon Jul  6 13:59:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
        Stop including qemu-common.h in memory.h
        kvm: Switch to unlocked MMIO
        acpi: mark PMTIMER as unlocked
        kvm: Switch to unlocked PIO
        kvm: First step to push iothread lock out of inner run loop
        memory: let address_space_rw/ld*/st* run outside the BQL
        exec: pull qemu_flush_coalesced_mmio_buffer() into address_space_rw/ld*/st*
        memory: Add global-locking property to memory regions
        main-loop: introduce qemu_mutex_iothread_locked
        main-loop: use qemu_mutex_lock_iothread consistently
        Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
        cpu-defs: Move out TB_JMP defines
        include/exec: Move tb hash functions out
        include/exec: Move standard exceptions to cpu-all.h
        cpu-defs: Move CPU_TEMP_BUF_NLONGS to tcg
        memory_mapping: Rework cpu related includes
        cutils: allow compilation with icc
        qemu-common: add VEC_OR macro

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b242e0e0e2969c044a318e56f7988bbd84de1f63
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Jul 4 00:24:51 2015 +0200

      exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal

      Loading the BIOS in the mac99 machine is interesting, because there is a
      PROM in the middle of the BIOS region (from 16K to 32K).  Before memory
      region accesses were clamped, when QEMU was asked to load a BIOS from
      0xfff00000 to 0xffffffff it would put even those 16K from the BIOS file
      into the region.  This is weird because those 16K were not actually
      visible between 0xfff04000 and 0xfff07fff.  However, it worked.

      After clamping was added, this also worked.  In this case, the
      cpu_physical_memory_write_rom_internal function split the write in
      three parts: the first 16K were copied, the PROM area (second 16K) were
      ignored, then the rest was copied.

      Problems then started with commit 965eb2f (exec: do not clamp accesses
      to MMIO regions, 2015-06-17).  Clamping accesses is not done for MMIO
      regions because they can overlap wildly, and MMIO registers can be
      expected to perform full-width accesses based only on their address
      (with no respect for adjacent registers that could decode to completely
      different MemoryRegions).  However, this lack of clamping also applied
      to the PROM area!  cpu_physical_memory_write_rom_internal thus failed
      to copy the third range above, i.e. only copied the first 16K of the BIOS.

      In effect, address_space_translate is expecting _something else_ to do
      the clamping for MMIO regions if the incoming length is large.  This
      "something else" is memory_access_size in the case of address_space_rw,
      so use the same logic in cpu_physical_memory_write_rom_internal.

      Reported-by: Alexander Graf <agraf@redhat.com>
      Reviewed-by: Laurent Vivier <lvivier@redhat.com>
      Tested-by: Laurent Vivier <lvivier@redhat.com>
      Fixes: 965eb2f
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fba0a593b2809ecdda68650952cf3d3332ac1990
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 3 15:18:24 2015 +0100

      Stop including qemu-common.h in memory.h

      Including qemu-common.h from other header files is generally a bad
      idea, because it means it's very easy to end up with a circular
      dependency. For instance, if we wanted to include memory.h from
      qom/cpu.h we'd end up with this loop:
       memory.h -> qemu-common.h -> cpu.h -> cpu-qom.h -> qom/cpu.h -> memory.h

      Remove the include from memory.h. This requires us to fix up a few
      other files which were inadvertently getting declarations indirectly
      through memory.h.

      The biggest change is splitting the fprintf_function typedef out
      into its own header so other headers can get at it without having
      to include qemu-common.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1435933104-15216-1-git-send-email-peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3fa18bc9a55e067ba3012ab1d394f5d5a7e51419
  Merge: 261ccf4 1479073
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 12:51:51 2015 +0100

      Merge remote-tracking branch 'remotes/xtensa/tags/20150706-xtensa' into staging

      Xtensa fixes:

      - add 64-bit floating point registers;
      - fix gdb register map construction.

      # gpg: Signature made Mon Jul  6 11:27:45 2015 BST using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20150706-xtensa:
        target-xtensa: fix gdb register map construction
        target-xtensa: add 64-bit floating point registers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1479073b7e849fa03e5892eea0e0b5dadde1a98a
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Wed Jul 1 13:00:29 2015 +0300

      target-xtensa: fix gdb register map construction

      Due to different gdb overlay organization between windowed/call0
      configurations core import script doesn't always work correctly.
      Simplify the script: always copy complete gdb register map from overlay,
      count registers at core registerstion time. Update existing cores.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit ddd44279fdbc545a9182cb642645af8a4672c267
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Jun 29 10:50:03 2015 +0300

      target-xtensa: add 64-bit floating point registers

      Xtensa ISA got specification for 64-bit floating point registers and
      opcodes, see ISA, 4.3.11 "Floating point coprocessor option".

      Add 64-bit FP registers.

      Although 64-bit floating point is currently not supported by xtensa
      translator, these registers need to be reported to gdb with proper size,
      otherwise it wouldn't find other registers.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 261ccf426a6df854ba398be92413476919dd67f9
  Merge: f50a164 257621a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 11:04:54 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150706' into staging

      target-arm queue:
       * TLBI ALLEI1IS should operate on all CPUs, not just this one
       * Fix interval interrupt of cadence ttc in decrement mode
       * Implement YIELD insn to yield in ARM and Thumb translators
       * ARM GIC: reset all registers
       * arm_mptimer: fix timer shutdown and mode change
       * arm_mptimer: respect IT bit state

      # gpg: Signature made Mon Jul  6 10:58:27 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150706:
        arm_mptimer: Respect IT bit state
        arm_mptimer: Fix timer shutdown and mode change
        hw/intc/arm_gic_common.c: Reset all registers
        target-arm: Implement YIELD insn to yield in ARM and Thumb translators
        target-arm: Split DISAS_YIELD from DISAS_WFE
        Fix interval interrupt of cadence ttc when timer is in decrement mode
        target-arm: fix write helper for TLBI ALLE1IS

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 257621a9566054472d1d55a819880d0f9da02bda
  Author: Dmitry Osipenko <digetx@gmail.com>
  Date:   Mon Jul 6 04:27:12 2015 +0300

      arm_mptimer: Respect IT bit state

      The timer should fire the interrupt only if the IT (interrupt enable) bit
      state of the control register is enabled.

      Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8a52340cbaf60d4dd0a78bbfe12632639fe3da6d
  Author: Dmitry Osipenko <digetx@gmail.com>
  Date:   Mon Jul 6 01:47:47 2015 +0300

      arm_mptimer: Fix timer shutdown and mode change

      The running timer can't be stopped because timer control code just
      doesn't handle disabling the timer. Fix it by deleting the timer if
      the enable bit is cleared.

      The timer won't start periodic ticking if a ONE-SHOT -> PERIODIC mode
      change happens after a one-shot tick was completed. Fix it by
      re-starting ticking if the timer isn't ticking right now.

      To avoid code churning, these two fixes are squashed in one commit.

      Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12dc273e98e4e111880b25c12bf671dc8951b8e6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 19:25:45 2015 +0100

      hw/intc/arm_gic_common.c: Reset all registers

      The arm_gic_common reset function was missing reset code for
      several of the GIC's state fields:
       * bpr[]
       * abpr[]
       * priority1[]
       * priority2[]
       * sgi_pending[]
       * irq_target[] (SMP configurations only)

      These probably went unnoticed because most guests will either
      never touch them, or will write to them in the process of
      configuring the GIC before enabling interrupts.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1435602345-32210-1-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit c87e5a61c2b3024116f52f7e68273f864ff7ab82
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      target-arm: Implement YIELD insn to yield in ARM and Thumb translators

      Implement the YIELD instruction in the ARM and Thumb translators to
      actually yield control back to the top level loop rather than being
      a simple no-op. (We already do this for A64.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1435672316-3311-3-git-send-email-peter.maydell@linaro.org

  commit 049e24a191c212d9468db84169197887f2c91586
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      target-arm: Split DISAS_YIELD from DISAS_WFE

      Currently we use DISAS_WFE for both WFE and YIELD instructions.
      This is functionally correct because at the moment both of them
      are implemented as "yield this CPU back to the top level loop so
      another CPU has a chance to run". However it's rather confusing
      that YIELD ends up calling HELPER(wfe), and if we ever want to
      implement real behaviour for WFE and SEV it's likely to trip us up.

      Split out the yield codepath to use DISAS_YIELD and a new
      HELPER(yield) function, and have HELPER(wfe) call HELPER(yield).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1435672316-3311-2-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>

  commit a7ffaf5c96e26820edffa94eeac766fe60bfdd31
  Author: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
  Date:   Mon Jul 6 10:05:44 2015 +0100

      Fix interval interrupt of cadence ttc when timer is in decrement mode

      The interval interrupt is not set if the timer is in decrement mode.
      This is because x >=0 and x < interval after leaving the while-loop.

      Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de>
      Message-id: 20150630135821.51f3b4fd@johanness-latitude
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a6332d968297266dbabf9d33f959e3a5efdd0f9
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jul 6 10:05:43 2015 +0100

      target-arm: fix write helper for TLBI ALLE1IS

      TLBI ALLE1IS is an operation that does invalidate TLB entries on all PEs
      in the same Inner Sharable domain, not just on the current CPU. So we
      must use tlbiall_is_write() here.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1435676538-31345-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f50a1640fb82708a5d528dee1ace42a224b95b15
  Merge: 63a9294 7c649ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 5 20:35:47 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Sat Jul  4 07:06:08 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request: (35 commits)
        ahci: fix sdb fis semantics
        qtest/ahci: halted ncq migration test
        ahci: Do not map cmd_fis to generate response
        ahci: ncq migration
        ahci: add get_cmd_header helper
        ahci: add cmd header to ncq transfer state
        qtest/ahci: halted NCQ test
        ahci: correct ncq sector count
        ahci: correct types in NCQTransferState
        ahci: add rwerror=stop support for ncq
        ahci: factor ncq_finish out of ncq_cb
        ahci: refactor process_ncq_command
        ahci: assert is_ncq for process_ncq
        ahci: stash ncq command
        ide: add limit to .prepare_buf()
        qtest/ahci: ncq migration test
        qtest/ahci: simple ncq data test
        libqos/ahci: Force all NCQ commands to be LBA48
        libqos/ahci: set the NCQ tag on command_commit
        libqos/ahci: adjust expected NCQ interrupts
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 63a9294ddc9cf4f2bdcd0179324fedcbb6fae59f
  Merge: 3536064 e75e2a1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Jul 5 19:33:51 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-07-03

      # gpg: Signature made Fri Jul  3 21:49:58 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        numa: API to lookup NUMA node by address
        numa: Store boot memory address range in node_info
        numa,pc-dimm: Store pc-dimm memory information in numa_info
        pc: Abort if HotplugHandlerClass::plug() fails
        pc,pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate routine
        pc,pc-dimm: Extract hotplug related fields in PCMachineState to a structure

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c649ac5b607e2339fb54fc0fc01311ba5eacadd
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: fix sdb fis semantics

      There are two things to fix here:

      The first one is subtle: the PxSACT register in the AHCI HBA has different
      semantics from the field it is shadowing, the ACT field in the
      Set Device Bits FIS.

      In the HBA register, PxSACT acts as a bitfield indicating outstanding
      NCQ commands where a set bit indicates a pending NCQ operation. The FIS
      field however operates as an RWC register update to PxSACT, where a set
      bit indicates a *successfully* completed command.

      Correct the FIS semantics. At the same time, move the "clear finished"
      action to the SDB FIS generation instead of the register read to mimick
      how the other shadow registers work, which always just report the last
      reported value from a FIS, and not the most current values which may
      not have been reported by a FIS yet.

      Lastly and more simply, SATA 3.2 section 13.6.4.2 (and later sections)
      all specify that the Interrupt bit for the SDB FIS should always be set
      to one for NCQ commands. That's currently the only time we generate this
      FIS, so set it on all the time.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-16-git-send-email-jsnow@redhat.com

  commit 8146d7dc2756138bd4011e8d882ead929f25f2d0
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      qtest/ahci: halted ncq migration test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-15-git-send-email-jsnow@redhat.com

  commit dd6282217d8fee36e3854eab2635bec9cc5d5236
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: Do not map cmd_fis to generate response

      The Register D2H FIS should copy the current values of
      the registers instead of just parroting back the same
      values the guest sent back to it.

      In this case, the SECTOR COUNT variables are actually
      not generally meaningful in terms of standard commands
      (See ATA8-AC3 Section 9.2 Normal Outputs), so it actually
      probably doesn't matter what we put in here.

      Meanwhile, we do need to use the Register update FIS from
      the NCQ pathways (in error cases), so getting rid of
      references to cur_cmd here is a win for AHCI concurrency.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-14-git-send-email-jsnow@redhat.com

  commit 684d50132fdd68f4c2cba9e65b50f9b8ef4c5164
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: ncq migration

      Migrate the NCQ queue. This is solely for the benefit of halted commands,
      since anything else should have completed and had any relevant status
      flushed to the HBA registers already.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-13-git-send-email-jsnow@redhat.com

  commit ee364416c1b5ed1adc779ca7197451a131666236
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: add get_cmd_header helper

      cur_cmd is an internal bookmark that points to the
      current AHCI Command Header being processed by the
      AHCI state machine. With NCQ needing to occasionally
      rely on some of the same AHCI helpers, we cannot use
      cur_cmd and will need to grab explicit pointers instead.

      In an attempt to begin relying on the cur_cmd pointer
      less, add a helper to let us specifically get the pointer
      to the command header of particular interest.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-12-git-send-email-jsnow@redhat.com

  commit c82bd3c893825fc76af3634f5461f5eabd94e9df
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: add cmd header to ncq transfer state

      While the rest of the AHCI device can rely on a single bookmarked
      pointer for the AHCI Command Header currently being processed, NCQ
      is asynchronous and may have many commands in flight simultaneously.

      Add a cmdh pointer to the ncq_tfs object and make the sglist prepare
      function take an AHCICmdHeader pointer so we can be explicit about
      where we'd like to build SGlists from.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-11-git-send-email-jsnow@redhat.com

  commit 7f6cf5ee1236d94fc25830a47438e57aa294d9fe
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      qtest/ahci: halted NCQ test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-10-git-send-email-jsnow@redhat.com

  commit e08a98357b5811e7933ff077f6da4b85175caf8a
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: correct ncq sector count

      uint16_t isn't enough to hold the real sector count, since a value of
      zero implies a full 64K sectors, so we need a uint32_t here.

      We *could* cheat and pretend that this value is 0-based and fit it in
      a uint16_t, but I'd rather waste 2 bytes instead of a future dev's
      10 minutes when they forget to +1/-1 accordingly somewhere.

      See SATA 3.2, section 13.6.4.1 "READ FPDMA QUEUED".

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-9-git-send-email-jsnow@redhat.com

  commit 9364384de0e3b8a5bdea67ba49bee9ea7f1b8f26
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:05 2015 -0400

      ahci: correct types in NCQTransferState

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-8-git-send-email-jsnow@redhat.com

  commit 7c03a691077e71a08bbca06568cd97f09537458c
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: add rwerror=stop support for ncq

      Handle NCQ failures for cases where we want to halt the VM on IO errors.
      Upon a VM state change, retry the halted NCQ commands.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-7-git-send-email-jsnow@redhat.com

  commit 54f3223730736fca1e6e89bb7f99c4f8432fdabb
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: factor ncq_finish out of ncq_cb

      When we add werror=stop or rerror=stop support to NCQ,
      we'll want to take a codepath where we don't actually
      complete the command, so factor that out into a new routine.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-6-git-send-email-jsnow@redhat.com

  commit 631ddc22cbb401f2777dc8b117196f0988df4eea
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: refactor process_ncq_command

      Split off execute_ncq_command so that we can call
      it separately later if we desire.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-5-git-send-email-jsnow@redhat.com

  commit 922f893e57da24bc80db3e79bea56485d1c111fa
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: assert is_ncq for process_ncq

      We already checked this in the handle_cmd phase, so just
      change this to an assertion and simplify the error logic.

      (Also, fix the switch indent, because checkpatch.pl yelled.)
      ((Sorry for churn.))

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-4-git-send-email-jsnow@redhat.com

  commit 4614619ee4ad96d2715dc41f9430fb43335c15d2
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ahci: stash ncq command

      For migration and werror=stop/rerror=stop resume purposes,
      it will be convenient to have the command handy inside of
      ncq_tfs.

      Eventually, we'd like to avoid reading from the FIS entirely
      after the initial read, so this is a byte (hah!) sized step
      in that direction.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-3-git-send-email-jsnow@redhat.com

  commit a718978ed58abc1ad92567a9c17525136be02a71
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      ide: add limit to .prepare_buf()

      prepare_buf should not always grab as many descriptors
      as it can, sometimes it should self-limit.

      For example, an NCQ transfer of 1 sector with a PRDT that
      describes 4GiB of data should not copy 4GiB of data, it
      should just transfer that first 512 bytes.

      PIO is not affected, because the dma_buf_rw dma helpers
      already have a byte limit built-in to them, but DMA/NCQ
      will exhaust the entire list regardless of requested size.

      AHCI 1.3 specifies in section 6.1.6 Command List Underflow that
      NCQ is not required to detect underflow conditions. Non-NCQ
      pathways signal underflow by writing to the PRDBC field, which
      will already occur by writing the actual transferred byte count
      to the PRDBC, signaling the underflow.

      Our NCQ pathways aren't required to detect underflow, but since our DMA
      backend uses the size of the PRDT to determine the size of the transer,
      if our PRDT is bigger than the transaction (the underflow condition) it
      doesn't cost us anything to detect it and truncate the PRDT.

      This is a recoverable error and is not signaled to the guest, in either
      NCQ or normal DMA cases.

      For BMDMA, the existing pathways should see no guest-visible difference,
      but any bytes described in the overage will no longer be transferred
      before indicating to the guest that there was an underflow.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435767578-32743-2-git-send-email-jsnow@redhat.com

  commit 07a1ee7958cc3433706ab0d3a07c42fdd9d98fe6
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      qtest/ahci: ncq migration test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-17-git-send-email-jsnow@redhat.com

  commit 26ad004585835e7c126bb94fd5161db1c60169f3
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      qtest/ahci: simple ncq data test

      Test the NCQ pathways for a simple IO RW test.
      Also, test that libqos doesn't explode when
      running NCQ commands :)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-16-git-send-email-jsnow@redhat.com

  commit e38cc93aca5d40a58e65bb0dfa23eaf3290bbf76
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: Force all NCQ commands to be LBA48

      NCQ commands are LBA48 by definition.

      See SATA 3.2 13.6.4.1 "READ FPDMA QUEUED", or
          SATA 3.2 13.6.5.1 "WRITE FPDMA QUEUED."

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-15-git-send-email-jsnow@redhat.com

  commit a8973ff50a04f96c3ce5c803c8fd3ec16ed8d6c5
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: set the NCQ tag on command_commit

      NCQ commands have the concept of a "TAG" that they need to set,
      but in the AHCI world, it is mandated that the TAG always match
      the command slot that you executed the NCQ from.

      See AHCI 9.3.1.1.5.2 "Native Queued Commands".

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-14-git-send-email-jsnow@redhat.com

  commit 359790c2542a8c4da3d4c8fb626ca2675a417d51
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:04 2015 -0400

      libqos/ahci: adjust expected NCQ interrupts

      NCQ commands will expect the SDBS interrupt,
      and in the normative case, do not expect to see
      a D2H Register FIS unless something went wrong.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-13-git-send-email-jsnow@redhat.com

  commit 4de484698bdda6c5e093dfbe4368cdb364fdf87f
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: edit wait to be ncq aware

      The wait command should check to make sure SACT is clear as well
      as the Command Issue register.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-12-git-send-email-jsnow@redhat.com

  commit cb45304108ab733aaf2e4351e77cb6d07ac88fd5
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: add NCQ frame support

      NCQ frames are generated a little differently than
      their non-NCQ cousins. Add support for them.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-11-git-send-email-jsnow@redhat.com

  commit 40d29928caa6db154182f5314f497020f81e640e
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      libqos/ahci: fix cmd_sanity for ncq

      NCQ commands should not / do not update the byte count
      in the command header post command, so this field is
      meaningless for NCQ tests.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-10-git-send-email-jsnow@redhat.com

  commit 34475239b8f1fff0b715cb20f8b534b9d07a897e
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci/qtest: Execute IDENTIFY prior to data commands

      If you try to execute an NCQ command before trying to engage with the
      device by issuing an IDENTIFY command, the error bits that are part of
      the signature will fool the test suite into thinking there was a failure.

      Issue IDENTIFY first on "boot", which will clear the signature out of
      the registers for us.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-9-git-send-email-jsnow@redhat.com

  commit 0437d32ae232af37d3b94064a563eb51d4eedd62
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: ncq sector count correction

      This value should not be size-corrected, 0 sectors does not imply
      1 sector(s). This is just debug information, but it's misleading!

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-8-git-send-email-jsnow@redhat.com

  commit 5d5f89212f19e3d7d3da1328137ca9e33eead7bf
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: add ncq debug checks

      Most of the time, these bits can be safely ignored. For the purposes
      of debugging however, it's nice to know that they're not being used.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-7-git-send-email-jsnow@redhat.com

  commit d56f4d6965ebcf8f3c496845c286e3a66496fdff
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: separate prdtl from opts

      There's no real reason to have it bundled together, and this way
      is a little nicer to follow if you have the AHCI spec pulled up.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-6-git-send-email-jsnow@redhat.com

  commit 3bcbe4aa803c1a41e5392ecac7b4fc3c99a42f89
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: check for ncq prdtl overflow

      Don't attempt the NCQ transfer if the PRDT we were given is not big
      enough to perform the entire transfer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-5-git-send-email-jsnow@redhat.com

  commit a55c8231d04e3023bc5c3da9290f01e7d6989a94
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: add ncq_err helper

      Set some appropriate error bits for NCQ for us.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-4-git-send-email-jsnow@redhat.com

  commit b6fe41fa6dbdf7b92b76cd4848ef442de18e03d3
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: use shorter variables

      Trivial cleanup that I didn't want to tack-on to anything else.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-3-git-send-email-jsnow@redhat.com

  commit 7763ed1506a9ffe74a80332182cc4f229251f998
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:03 2015 -0400

      ahci: Rename NCQFIS structure fields

      Several fields of the NCQFIS structure are ambiguously named. This patch
      clarifies the intended (if unsupported) usage of the NCQ fields to aid
      in creating more meaningful debug messages through the NCQ codepaths.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435016308-6150-2-git-send-email-jsnow@redhat.com

  commit d31a3ebc28bf401cc5cce43f36068697d670c3f9
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      qtest/ahci: add port_reset test

      Test that we can survive a couple of cycles of running a basic identify
      test, some IO, and resetting the HBA. Ensures that we can bring the HBA
      back to compliant spec during the lifecycle of the VM.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-5-git-send-email-jsnow@redhat.com

  commit 95ea663693fdf4f39976f9aadb004fc77c2058ee
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      libqos/ahci: fix memory management bugs

      There's a handful of trivial bugs in the libqos/ahci functions,
      squish them together.

      - Zero cached pointers after freeing them
      - The Command List Buffer is an array of 32x 32 byte structures, not
        32x 8 byte pointers -- it's 1MiB, not 256 bytes. Zero it ALL.
      - Free the correct command in ahci_pick_cmd.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-4-git-send-email-jsnow@redhat.com

  commit 0d3e9d1f598e803a02c9bf43ec0b053e873ca79a
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      qtest/ahci: add test_max

      Test that the FIS delivered after a nondata command has appropriately
      updated registers, just as we'd expect a data command to do.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1434470575-21625-3-git-send-email-jsnow@redhat.com

  commit e9ebb2f76778d19227476e34c3d7aa6b8975c1b6
  Author: John Snow <jsnow@redhat.com>
  Date:   Sat Jul 4 02:06:02 2015 -0400

      ahci: Do not ignore memory access read size

      The only guidance the AHCI specification gives on memory access is:
      "Register accesses shall have a maximum size of 64-bits; 64-bit access
      must not cross an 8-byte alignment boundary."

      I interpret this to mean that aligned or unaligned 1, 2 and 4 byte
      accesses should work, as well as aligned 8 byte accesses.

      In practice, a real Q35/ICH9 responds to 1, 2, 4 and 8 byte reads
      regardless of alignment. Windows 7 can be observed making 1 byte
      reads to the middle of 32 bit registers to fetch error codes.

      Introduce a wrapper to support unaligned accesses to AHCI.
      This wrapper will support aligned 8 byte reads, but will make
      no effort to support unaligned 8 byte reads, which although they
      will work on real hardware, are not guaranteed to work and do
      not appear to be used by either Windows or Linux.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1434470575-21625-2-git-send-email-jsnow@redhat.com

  commit e75e2a14d5c13ad38dcf72b69922dee2dafbb0d0
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:27 2015 +0530

      numa: API to lookup NUMA node by address

      Introduce an API numa_get_node(ram_addr_t addr, Error **errp) that
      returns the NUMA node to which the given address belongs to. This
      API works uniformly for both boot time as well as hotplugged memory.

      This API is needed by sPAPR PowerPC to support
      ibm,dynamic-reconfiguration-memory device tree node which is needed for
      memory hotplug.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit abafabd8c982e875d60a10d37f0b91cff1003c55
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:26 2015 +0530

      numa: Store boot memory address range in node_info

      Store memory address range information of boot memory  in address
      range list of numa_info.

      This helps to have a common NUMA node lookup by address function that
      works for both boot-time memory and hotplugged memory.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit fa9ea81d15d459f6c4a39d77ae680af94cebd65e
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:25 2015 +0530

      numa,pc-dimm: Store pc-dimm memory information in numa_info

      Start storing the (start_addr, end_addr) of the pc-dimm memory
      in corresponding numa_info[node] so that this information can be used
      to lookup node by address.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8e23184b6b2f8426041854b18fb56a3ff197d5a0
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:24 2015 +0530

      pc: Abort if HotplugHandlerClass::plug() fails

      HotplugHandlerClass::plug() shouldn't fail and hence use error_abort
      to abort if it fails.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 43bbb49ef7032a8bfdafbd02d0286512af161089
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:23 2015 +0530

      pc,pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate routine

      pc_dimm_plug() has code that will be needed for memory plug handlers
      in other archs too. Extract code from pc_dimm_plug() into a generic
      routine pc_dimm_memory_plug() that resides in pc-dimm.c. Also
      correspondingly refactor re-usable unplug code into pc_dimm_memory_unplug().

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit a7d69ff10b085ba6f8236600829532984cdea714
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Mon Jun 29 13:50:22 2015 +0530

      pc,pc-dimm: Extract hotplug related fields in PCMachineState to a structure

      Move hotplug_memory_base and hotplug_memory fields of PCMachineState
      into a separate structure so that the same can be made use of from
      other architectures supporing memory hotplug.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 35360642d043c2a5366e8a04a10e5545e7353bd5
  Merge: 5317b0f 496eaca
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jul 3 12:05:31 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150703-1' into staging

      virtio-input: add input routing support, update multiseat docs.

      # gpg: Signature made Fri Jul  3 11:22:33 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150703-1:
        update pci-bridge-seat section in docs/multiseat.txt
        virtio-input: add input routing support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 496eacaa67653023540e090fb70b7caba429bbc0
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jul 1 10:59:47 2015 +0200

      update pci-bridge-seat section in docs/multiseat.txt

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5cce173323cfe1bb22f7a10f9b73ac7796909cef
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 24 11:59:16 2015 +0200

      virtio-input: add input routing support

      Add display and head properties for input routing to
      virtio-input devices, update multiseat documentation.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5317b0f6d4bb581c5c8f88f31138ee301ad2b7e5
  Merge: 6686ce3 c4d3c0a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 2 15:20:55 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150702-v3' into staging

      Several s390x patches including:
      - missing virtio-1 related code for virtio-ccw
      - bugfixes in ipl device, gdb, virtio-ccw
      - bugfix in s390-ccw bios + rebuild
      - introduce versioned machines for s390-ccw-virtio

      # gpg: Signature made Thu Jul  2 15:05:34 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150702-v3:
        s390x/migration: Introduce 2.4 machine
        s390x/gdb: synchronize cpu state after modifying acrs
        s390x/ipl: Fix boot if no bootindex was specified
        virtio-ccw: migrate ->revision
        s390x/virtio-ccw: support virtio-1 set_vq format
        s390x/virtio-ccw: add virtio set-revision call
        s390x/css: Add a callback for when subchannel gets disabled
        s390-ccw.img: update
        s390-ccw.img: Consume service interrupts
        css: mss/mcss-e vs. migration
        virtio-ccw: complete handling of guest-initiated resets

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4d3c0a2696c09a884b680d15b03325e46656a6c
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Jul 1 11:16:57 2015 +0200

      s390x/migration: Introduce 2.4 machine

      The section footer changes commit f68945d42bab ("Add a protective
      section footer") and commit 37fb569c0198 ("Disable section footers
      on older machine types") broke migration for any non-versioned
      machines.

      This pinpoints a problem of s390-ccw machines: it needs to
      be versioned to be compatible with future changes in common
      code data structures such as section footers.

      Let's introduce a version scheme for s390-ccw-virtio machines.
      We will use the old s390-ccw-virtio name as alias to the latest
      version as all existing libvirt XML for the ccw type were expanded
      by libvirt to that name.

      The only downside of this patch is, that the old alias s390-ccw
      will no longer be available as machines can have only one alias,
      but it should not really matter.

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com>
      Cc: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1435742217-62246-1-git-send-email-borntraeger@de.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 55b1b753dff022dcc95123bed35946b4977d31fa
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Jun 23 09:10:51 2015 +0200

      s390x/gdb: synchronize cpu state after modifying acrs

      Whenever we touch the access control registers, we have to make sure that
      the values will make it into kvm. Otherwise the change will simply be lost.

      When synchronizing qemu and kvm, a normal KVM_PUT_RUNTIME_STATE does not take
      care of these registers. Let's simply trigger a KVM_PUT_FULL_STATE sync,
      so the values will directly be written to kvm. The performance overhead can
      be ignored and this is much cleaner than manually writing these registers to kvm
      via our two supported ways.

      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6efd2c2a125b4369b8def585b0dac35c849b5eb3
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jun 18 16:37:39 2015 +0200

      s390x/ipl: Fix boot if no bootindex was specified

      commit fa92e218df1d ("s390x/ipl: avoid sign extension") introduced
      a regression:

      qemu-system-s390x -drive file=image.qcow,format=qcow2
      does not boot, the bios states
      "No virtio-blk device found!"

      adding bootindex=1 does boot.

      The reason is that the uint32_t as return value will not do the right
      thing for the return -1 (default without bootindex).
      The bios itself, will interpret a 64bit -1 as autodetect (but it will
      interpret 32bit -1 as ccw device address ff.ff.ffff)

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: qemu-stable@nongnu.org # v2.3.0
      Tested-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 213941d73baf8ba7ec5381c8402fed7925d613d4
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 25 12:20:08 2015 +0200

      virtio-ccw: migrate ->revision

      We need to migrate the revision field as well. No compatibility
      concerns as we already introduced migration of ->config_vector in
      this release.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 0db87e0d1763d3fb4039c2cffb0f3264da88ab30
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:13 2014 +0100

      s390x/virtio-ccw: support virtio-1 set_vq format

      Support the new CCW_CMD_SET_VQ format for virtio-1 devices.

      While we're at it, refactor the code a bit and enforce big endian
      fields (which had always been required, even for legacy).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit c42767f2bbd18d4ec895395c01c64bbec16b5b84
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Dec 11 14:25:12 2014 +0100

      s390x/virtio-ccw: add virtio set-revision call

      Handle the virtio-ccw revision according to what the guest sets.
      When revision 1 is selected, we have a virtio-1 standard device
      with byteswapping for the virtio rings.

      When a channel gets disabled, we have to revert to the legacy behavior
      in case the next user of the device does not negotiate the revision 1
      anymore (e.g. the boot firmware uses revision 1, but the operating
      system only uses the legacy mode).

      Note that revisions > 0 are still disabled.

      [CH: assure memory accesses are always BE]
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6686ce3f1628f045035d58db8890d20705fd5c34
  Merge: d2966f8 764ba3a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jul 2 10:44:34 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Jul  2 10:10:39 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block: remove redundant check before g_slist_find()
        block/nfs: limit maximum readahead size to 1MB
        block/iscsi: restore compatiblity with libiscsi 1.9.0
        iotests: Use event_wait in wait_ready
        qemu-iotests: Add test case for mirror with unmap
        qemu-iotests: Make block job methods common
        block: Remove bdrv_reset_dirty
        block: Fix dirty bitmap in bdrv_co_discard
        mirror: Do zero write on target if sectors not allocated
        qmp: Add optional bool "unmap" to drive-mirror
        block: Add bdrv_get_block_status_above
        timer: Use a single definition of NSEC_PER_SEC for the whole codebase
        timer: Move NANOSECONDS_PER_SECONDS to timer.h
        blockdev: no need to drain+flush in hmp_drive_del
        qapi: Rename 'dirty-bitmap' mode to 'incremental'
        qcow2: Handle EAGAIN returned from update_refcount
        block/iscsi: add support for request timeouts

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 764ba3ae511adddfa750db290ac8375d660ca5b9
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 29 16:12:13 2015 +0300

      block: remove redundant check before g_slist_find()

      An empty GSList is represented by a NULL pointer, therefore it's a
      perfectly valid argument for g_slist_find() and there's no need to
      make any additional check.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1435583533-5758-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 29c838cdc96c4d117f00c75bbcb941e1be9590fb
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Jun 26 13:14:01 2015 +0200

      block/nfs: limit maximum readahead size to 1MB

      a malicious caller could otherwise specify a very
      large value via the URI and force libnfs to allocate
      a large amount of memory for the readahead buffer.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1435317241-25585-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9049736ec70fdc886ac0df521fdd8b2886b2cb63
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Jun 26 12:18:01 2015 +0200

      block/iscsi: restore compatiblity with libiscsi 1.9.0

      RHEL7 and others are stuck with libiscsi 1.9.0 since there
      unfortunately was an ABI breakage after that release.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1435313881-19366-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d7b25297920d18fa2a2cde1ed21fde38a88c935f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:14 2015 +0800

      iotests: Use event_wait in wait_ready

      Only poll the specific type of event we are interested in, to avoid
      stealing events that should be consumed by someone else.

      Suggested-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c615091793f53ff33b8f6c1b1ba711cf7c93e97b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:13 2015 +0800

      qemu-iotests: Add test case for mirror with unmap

      This checks that the discard on mirror source that effectively zeroes
      data is also reflected by the data of target.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 866323f39d5c7bb053f5e5bf753908ad9f5abec7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:12 2015 +0800

      qemu-iotests: Make block job methods common

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e82e4bce127654b2dd42ef393587775be792334
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:11 2015 +0800

      block: Remove bdrv_reset_dirty

      Using this function would always be wrong because a dirty bitmap must
      have a specific owner that consumes the dirty bits and calls
      bdrv_reset_dirty_bitmap().

      Remove the unused function to avoid future misuse.

      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 508249952c0ea7472c62e17bf8132295dab4912d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:10 2015 +0800

      block: Fix dirty bitmap in bdrv_co_discard

      Unsetting dirty globally with discard is not very correct. The discard may zero
      out sectors (depending on can_write_zeroes_with_unmap), we should replicate
      this change to destination side to make sure that the guest sees the same data.

      Calling bdrv_reset_dirty also troubles mirror job because the hbitmap iterator
      doesn't expect unsetting of bits after current position.

      So let's do it the opposite way which fixes both problems: set the dirty bits
      if we are to discard it.

      Reported-by: wangxiaolong@ucloud.cn
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dcfb3beb5130694b76b57de109619fcbf9c7e5b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:09 2015 +0800

      mirror: Do zero write on target if sectors not allocated

      If guest discards a source cluster, mirroring with bdrv_aio_readv is overkill.
      Some protocols do zero upon discard, where it's best to use
      bdrv_aio_write_zeroes, otherwise, bdrv_aio_discard will be enough.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0fc9f8ea2800b76eaea20a8a3a91fbeeb4bfa81b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:08 2015 +0800

      qmp: Add optional bool "unmap" to drive-mirror

      If specified as "true", it allows discarding on target sectors where source is
      not allocated.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ba3f0e2545c365ebe1dbddb0e53058710d41881e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jun 8 13:56:07 2015 +0800

      block: Add bdrv_get_block_status_above

      Like bdrv_is_allocated_above, this function follows the backing chain until seeing
      BDRV_BLOCK_ALLOCATED.  Base is not included.

      Reimplement bdrv_is_allocated on top.

      [Initialized bdrv_co_get_block_status_above() ret to 0 to silence
      mingw64 compiler warning about the unitialized variable.  assert(bs !=
      base) prevents that case but I suppose the program could be compiled
      with -DNDEBUG.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Jun 12 16:01:30 2015 +0300

      timer: Use a single definition of NSEC_PER_SEC for the whole codebase

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: c6e55468856ba0b8f95913c4da111cc0ef266541.1434113783.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 471fae3c98d4f44b1957eb09d51ace440c585a20
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Jun 12 16:01:29 2015 +0300

      timer: Move NANOSECONDS_PER_SECONDS to timer.h

      We want to be able to reuse this define by making it common to
      multiple QEMU modules.

      This also makes it an integer since there's no need for it to be a
      float.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 6375912849da2ab561046dd013684535ccecca44.1434113783.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 126b8bbdfe8bc4042f13f230a4b36f90646f47c6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 28 16:17:09 2015 +0200

      blockdev: no need to drain+flush in hmp_drive_del

      bdrv_close already does that, and in fact hmp_drive_del would need
      another drain after the flush (which bdrv_close does).  So remove
      the duplication.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432822629-25401-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4b80ab2b7d950d5b22647b364e37eb81c756f061
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Jun 4 20:20:34 2015 -0400

      qapi: Rename 'dirty-bitmap' mode to 'incremental'

      If we wish to make differential backups a feature that's easy to access,
      it might be pertinent to rename the "dirty-bitmap" mode to "incremental"
      to make it clear what /type/ of backup the dirty-bitmap is helping us
      perform.

      This is an API breaking change, but 2.4 has not yet gone live,
      so we have this flexibility.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1433463642-21840-2-git-send-email-jsnow@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3e5feb6202149e8a963a33b911216e40d790f1d7
  Author: Jindřich Makovička <makovick@gmail.com>
  Date:   Wed Jun 24 07:05:25 2015 +0200

      qcow2: Handle EAGAIN returned from update_refcount

      Fixes a crash during image compression

      Signed-off-by: Jindřich Makovička <makovick@gmail.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5dd7a535b71a0f2f8e7af75c5d694174359ce323
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Jun 16 13:45:07 2015 +0200

      block/iscsi: add support for request timeouts

      libiscsi starting with 1.15 will properly support timeout of iscsi
      commands. The default will remain no timeout, but this can
      be changed via cmdline parameters, e.g.:

      qemu -iscsi timeout=30 -drive file=iscsi://...

      If a timeout occurs a reconnect is scheduled and the timed out command
      will be requeued for processing after a successful reconnect.

      The required API call iscsi_set_timeout is present since libiscsi
      1.10 which was released in October 2013. However, due to some bugs
      in the libiscsi code the use is not recommended before version 1.15.

      Please note that this patch bumps the libiscsi requirement to 1.10
      to have all function and macros defined. The patch fixes also a
      off-by-one error in the NOP timeout calculation which was fixed
      while touching these code parts.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1434455107-19328-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de7ea885c5394c1fba7443cbf33bd2745d32e6c2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:26 2015 +0200

      kvm: Switch to unlocked MMIO

      Do not take the BQL before dispatching MMIO requests of KVM VCPUs.
      Instead, address_space_rw will do it if necessary. This enables completely
      BQL-free MMIO handling in KVM mode for upcoming devices with fine-grained
      locking.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-10-git-send-email-pbonzini@redhat.com>

  commit 7070e085d490c396f9237c8f10bf8b6e69cd0066
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:25 2015 +0200

      acpi: mark PMTIMER as unlocked

      Accessing QEMU_CLOCK_VIRTUAL is thread-safe.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-9-git-send-email-pbonzini@redhat.com>

  commit 80b7d2efb63c225797345c152cdd3392b9fe7b72
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:24 2015 +0200

      kvm: Switch to unlocked PIO

      Do not take the BQL before dispatching PIO requests of KVM VCPUs.
      Instead, address_space_rw will do it if necessary. This enables
      completely BQL-free PIO handling in KVM mode for upcoming devices with
      fine-grained locking.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-8-git-send-email-pbonzini@redhat.com>

  commit 4b8523ee896750c37b4fa224a40d34703cbdf4c6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:23 2015 +0200

      kvm: First step to push iothread lock out of inner run loop

      This opens the path to get rid of the iothread lock on vmexits in KVM
      mode. On x86, the in-kernel irqchips has to be used because we otherwise
      need to synchronize APIC and other per-cpu state accesses that could be
      changed concurrently.

      Regarding pre/post-run callbacks, s390x and ARM should be fine without
      specific locking as the callbacks are empty. MIPS and POWER require
      locking for the pre-run callback.

      For the handle_exit callback, it is non-empty in x86, POWER and s390.
      Some POWER cases could do without the locking, but it is left in
      place for now.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-7-git-send-email-pbonzini@redhat.com>

  commit 4840f10eff37eebc609fcc933ab985dc66df95c6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:22 2015 +0200

      memory: let address_space_rw/ld*/st* run outside the BQL

      The MMIO case is further broken up in two cases: if the caller does not
      hold the BQL on invocation, the unlocked one takes or avoids BQL depending
      on the locking strategy of the target memory region and its coalesced
      MMIO handling.  In this case, the caller should not hold _any_ lock
      (a friendly suggestion which is disregarded by virtio-scsi-dataplane).

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-6-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 125b3806668106667dd2ae049593852859e12b63
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:21 2015 +0200

      exec: pull qemu_flush_coalesced_mmio_buffer() into address_space_rw/ld*/st*

      As memory_region_read/write_accessor will now be run also without BQL held,
      we need to move coalesced MMIO flushing earlier in the dispatch process.

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-5-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 196ea13104f802c508e57180b2a0d2b3418989a3
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Jun 18 18:47:20 2015 +0200

      memory: Add global-locking property to memory regions

      This introduces the memory region property "global_locking". It is true
      by default. By setting it to false, a device model can request BQL-free
      dispatching of region accesses to its r/w handlers. The actual BQL
      break-up will be provided in a separate patch.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1434646046-27150-4-git-send-email-pbonzini@redhat.com>

  commit afbe70535ff1a8a7a32910cc15ebecc0ba92e7da
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:19 2015 +0200

      main-loop: introduce qemu_mutex_iothread_locked

      This function will be used to avoid recursive locking of the iothread lock
      whenever address_space_rw/ld*/st* are called with the BQL held, which is
      almost always the case.

      Tracking whether the iothread is owned is very cheap (just use a TLS
      variable) but requires some care because now the lock must always be
      taken with qemu_mutex_lock_iothread().  Previously this wasn't the case.
      Outside TCG mode this is not a problem.  In TCG mode, we need to be
      careful and avoid the "prod out of compiled code" step if already
      in a VCPU thread.  This is easily done with a check on current_cpu,
      i.e. qemu_in_vcpu_thread().

      Hopefully, multithreaded TCG will get rid of the whole logic to kick
      VCPUs whenever an I/O event occurs!

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-3-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e7f7a3c86f884a77296a137b7c730a4d580c5c9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 18 18:47:18 2015 +0200

      main-loop: use qemu_mutex_lock_iothread consistently

      The next patch will require the BQL to be always taken with
      qemu_mutex_lock_iothread(), while right now this isn't the case.

      Outside TCG mode this is not a problem.  In TCG mode, we need to be
      careful and avoid the "prod out of compiled code" step if already
      in a VCPU thread.  This is easily done with a check on current_cpu,
      i.e. qemu_in_vcpu_thread().

      Hopefully, multithreaded TCG will get rid of the whole logic to kick
      VCPUs whenever an I/O event occurs!

      Cc: Frederic Konrad <fred.konrad@greensocs.com>
      Message-Id: <1434646046-27150-2-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdf026317daa3b9dfa281f29e96fbb6fd48394c8
  Author: 马文霜 <kevinnma@tencent.com>
  Date:   Wed Jul 1 15:41:41 2015 +0200

      Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES

      Last month, we experienced several guests crash(6cores-8cores), qemu logs
      display the following messages:

      qemu-system-x86_64: /build/qemu-2.1.2/kvm-all.c:976:
      kvm_irqchip_commit_routes: Assertion `ret == 0' failed.

      After analysis and verification, we can confirm it's irq-balance
      daemon(in guest) leads to the assertion failure. Start a 8 core guest with
      two disks, execute the following scripts will reproduce the BUG quickly:

      irq_affinity.sh
      ========================================================================

      vda_irq_num=25
      vdb_irq_num=27
      while [ 1 ]
      do
          for irq in {1,2,4,8,10,20,40,80}
              do
                  echo $irq > /proc/irq/$vda_irq_num/smp_affinity
                  echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
                  dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
                  dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
              done
      done
      ========================================================================

      QEMU setup static irq route entries in kvm_pc_setup_irq_routing(), PIC and
      IOAPIC share the first 15 GSI numbers, take up 23 GSI numbers, but take up
      38 irq route entries. When change irq smp_affinity in guest, a dynamic route
      entry may be setup, the current logic is: if allocate GSI number succeeds,
      a new route entry can be added. The available dynamic GSI numbers is
      1021(KVM_MAX_IRQ_ROUTES-23), but available irq route entries is only
      986(KVM_MAX_IRQ_ROUTES-38), GSI numbers greater than route entries.
      irq-balance's behavior will eventually leads to total irq route entries
      exceed KVM_MAX_IRQ_ROUTES, ioctl(KVM_SET_GSI_ROUTING) fail and
      kvm_irqchip_commit_routes() trigger assertion failure.

      This patch fix the BUG.

      Signed-off-by: Wenshuang Ma <kevinnma@tencent.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62ac4a52e27c706c860403fd1d8535a9a1073a19
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Dec 11 14:25:11 2014 +0100

      s390x/css: Add a callback for when subchannel gets disabled

      We need a possibility to run code when a subchannel gets disabled.
      This patch adds the necessary infrastructure.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6e7cd94462d65405037c993fc4401d6fceed6660
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 25 13:48:58 2015 +0200

      s390-ccw.img: update

      Update for "s390-ccw.img: Consume service interrupts".

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit bdc7fe3638fa7693eed5886b5b2afe0858d875fc
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Fri Jun 19 15:40:45 2015 +0200

      s390-ccw.img: Consume service interrupts

      We have to consume the outstanding service interrupt after each
      service call, otherwise a correct implementation will return
      CC=2 on subsequent service calls.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ec7353a146bb39c3bb3e5ccc50ca585aed97b7cf
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Jun 24 10:57:23 2015 +0200

      css: mss/mcss-e vs. migration

      Our main channel_subsys structure is not a device (yet), but we need
      to setup mss/mcss-e again if the guest had enabled it before. Use
      a hack that should catch most configurations (assuming that the guest
      will have enabled at least one device in higher subchannel sets or
      channel subsystems if it enabled the functionality.)

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fa8b0ca5d1b69975b715a259d3586cadf7a5280f
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Jun 23 15:46:31 2015 +0200

      virtio-ccw: complete handling of guest-initiated resets

      For a guest-initiated reset, we need to not only reset the virtio device,
      but also reset the VirtioCcwDevice into a clean state. This includes
      resetting the indicators, or else a guest will not be able to e.g.
      switch from classic interrupts to adapter interrupts.

      Split off this routine into a new function virtio_ccw_reset_virtio()
      to make the distinction between resetting the virtio-related devices
      and the base subchannel device clear.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d2966f804d70a244f5dde395fc5d22a50ed3e74e
  Merge: 2b464e1 a435612
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 17:03:20 2015 +0100

      Merge remote-tracking branch 'remotes/vivier/tags/pull-m68k-20150629' into staging

      Trivial m68k cleanup

      # gpg: Signature made Mon Jun 29 16:38:40 2015 BST using DSA key ID ABF36C53
      # gpg: Good signature from "Laurent Vivier <laurent@vivier.eu>"
      # gpg:                 aka "Laurent Vivier <Laurent@vivier.eu>"
      # gpg:                 aka "Laurent Vivier <Laurent@lvivier.info>"
      # gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
      # gpg:                 aka "[jpeg image of size 3881]"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 9EC7 B78A C0AC E697 5E4B  BDE3 34A4 F6C9 ABF3 6C53

      * remotes/vivier/tags/pull-m68k-20150629:
        m68k: remove useless parameter op_size from gen_lea_indexed()
        m68k: remove useless file m68k-qreg.h
        m68k: is_mem is useless

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a435612616202c837d62626dbe3e33a4e9a95772
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 02:51:49 2015 +0200

      m68k: remove useless parameter op_size from gen_lea_indexed()

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit bb337ac978b6def085eabf17830d5cc2a1bce6a8
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 02:07:24 2015 +0200

      m68k: remove useless file m68k-qreg.h

      Unused since:

          commit e1f3808e03f73e7a7fa966afbed2455dd052202e
          Author: pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
          Date:   Sat May 24 22:29:16 2008 +0000

              Convert m68k target to TCG.

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit 805167adcb900fa7b2b114d639c418f5313d0b42
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Wed Jun 24 01:00:22 2015 +0200

      m68k: is_mem is useless

      Remove is_mem as it is never tested anymore since:

          commit bfa50bc2638d877cf2900712b7503be22e8811cb
          Author: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
          Date:   Tue Nov 18 20:26:41 2008 +0000

              Remove premature memop TB terminations (Jan Kiszka)

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>

  commit 2b464e13f0d30e6c0b8f69ec908fceab30aea986
  Merge: dc1e135 5f37fd8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 29 13:26:43 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150629' into staging

      TriCore bugfixes

      # gpg: Signature made Mon Jun 29 13:08:17 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150629:
        target-tricore: fix depositing bits from PCXI into ICR

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f37fd8e2980818ab71bc4b4e21129e29acd73f7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 24 14:01:10 2015 +0200

      target-tricore: fix depositing bits from PCXI into ICR

      Spotted by Coverity, because (env->PCXI & MASK_PCXI_PCPN) >> 24
      is always zero.  The immediately preceding assignment is also
      wrong though.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1435147270-1040-1-git-send-email-pbonzini@redhat.com>

  commit dc1e1350f8061021df765b396295329797d66933
  Merge: d14b9d7 d46f7c9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 15:57:43 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, pci fixes, enhancements

      Almost exclusively bugfixes, though in this case,
      we are adding functionality to the pxb in order
      to make OVMF work on it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Fri Jun 26 14:43:27 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        Fix glib_subprocess test
        hw/pci-bridge: format special OFW unit address for PXB host
        hw/core: explicit OFW unit address callback for SysBusDeviceClass
        hw/pci-bridge: disable SHPC in PXB
        hw/pci-bridge: introduce "shpc" property
        hw/pci: introduce shpc_present() helper function
        hw/pci-bridge: add macro for "msi" property
        hw/pci-bridge: add macro for "chassis_nr" property
        hw/pci-bridge: expose _test parameter in SHPC_VMSTATE()
        migration: introduce VMSTATE_BUFFER_UNSAFE_INFO_TEST()
        add pci-bridge-seat
        pc: cleanup and convert TMP ACPI device description to AML API
        MAINTAINERS: add ACPI entry
        vhost: correctly pass error to caller in vhost_dev_enable_notifiers()
        balloon: add a feature bit to let Guest OS deflate balloon on oom
        qdev: fix OVERFLOW_BEFORE_WIDEN
        virito-pci: fix OVERRUN problem

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 41da4bd6420afd1209c408974920f63ff9c658e1
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:46 2015 -0700

      cpu-defs: Move out TB_JMP defines

      These are not Architecture specific in any way so move them out of
      cpu-defs.h. tb-hash.h is an appropriate place as a leading user and
      their strong relationship to TB hashing and caching.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <43ceca65a3fa240efac49aa0bf604ad0442e1710.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e1b89321bafea9fb33d87852fc91fee579d17dfe
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:45 2015 -0700

      include/exec: Move tb hash functions out

      This is one of very few things in exec-all with a genuine CPU
      architecture dependency. Move these hashing helpers to a new
      header to trim exec-all.h down to a near architecture-agnostic
      header.

      The defs are only used by cpu-exec and translate-all which are both
      arch-obj's so the new tb-hash.h has no core code usage.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <9d048b96f7cfa64a4d9c0b88e0dd2877fac51d41.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9e0dc48c9f05505b53cb28f860456a0648e56ddf
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:42 2015 -0700

      include/exec: Move standard exceptions to cpu-all.h

      These exception indicies are generic and don't have any reliance on the
      per-arch cpu.h defs. Move them to cpu-all.h so they can be used by core
      code that does not have access to cpu-defs.h.

      Reviewed-by: Richard Henderson <rth@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <dbebd3062c7cd4332240891a3564e73f374ddfcd.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6e0b07306d1793e8402dd218d2e38a7377b5fc27
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sat May 30 23:11:34 2015 -0700

      cpu-defs: Move CPU_TEMP_BUF_NLONGS to tcg

      The usages of this define are pure TCG and there is no architecture
      specific variation of the value. Localise it to the TCG engine to
      remove another architecture agnostic piece from cpu-defs.h.

      This follows on from a28177820a868eafda8fab007561cc19f41941f4 where
      temp_buf was moved out of the CPU_COMMON obsoleting the need for
      the super early definition.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <498e8e5325c1a1aff79e5bcfc28cb760ef6b214e.1433052532.git.crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 94beb661bd90bcb477eed6d3b07aced988c40163
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Jun 7 14:59:09 2015 -0700

      memory_mapping: Rework cpu related includes

      This makes it more consistent with all other core code files, which
      either just rely on qemu-common.h inclusion or precede cpu.h with
      qemu-common.h.

      cpu-all.h should not be included in addition to cpu.h. Remove it.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <1433714349-7262-1-git-send-email-crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 27e7755bea57c66097000f7612271ceefcbeb4a4
  Author: Artyom Tarasenko <atar4qemu@gmail.com>
  Date:   Tue Jun 23 14:30:18 2015 +0200

      cutils: allow compilation with icc

      Use VEC_OR macro for operations on VECTYPE operands

      Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
      Message-Id: <3f62d7a3a265f7dd99e50d016a0333a99a4a082a.1435062067.git.atar4qemu@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 34664507c7f038842f20a2c787915680b1fabba2
  Author: Artyom Tarasenko <atar4qemu@gmail.com>
  Date:   Tue Jun 23 14:30:17 2015 +0200

      qemu-common: add VEC_OR macro

      Intel C Compiler version 15.0.3.187 Build 20150407 doesn't support
      '|' function for non floating-point simd operands.

      Define VEC_OR macro which uses _mm_or_si128 supported
      both in icc and gcc on x86 platform.

      Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
      Message-Id: <54c804cdb3b3a93e93ef98f085dc57c4092580b7.1435062067.git.atar4qemu@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d14b9d79be8a424ebc66450d565b81eff2296d55
  Merge: ccb0c7e 4e2c0b2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:40:47 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150626' into staging

      target-arm queue:
       * Change the virt board's default interface type for block devices to virtio
       * Improve some error messages that will now be triggered by some incorrect
         but previously worked-by-accident command lines
       * Print ELR if we're doing debug logging of AArch64 exception entry
       * Handle the "completely empty semihosting commandline" correctly for
         softmmu (we already did for linux-user)
       * Add GICv2m description to ACPI tables for virt board
       * Fix some incorrect table revision entries in virt board ACPI tables

      # gpg: Signature made Fri Jun 26 14:29:39 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150626:
        hw/arm/virt: Make block devices default to virtio
        qdev-properties-system: Improve error message for drive assignment conflict
        qdev-properties-system: Change set_pointer's parse callback to use Error
        target-arm: A64: Print ELR when taking exceptions
        target-arm: default empty semihosting cmdline
        hw/arm/virt-acpi-build: Add GICv2m description in ACPI MADT table
        hw/arm/virt-acpi-build: Fix table revision and some comments

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e2c0b2a4ab810c8989e181a010e75aeaa1c55f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:37 2015 +0100

      hw/arm/virt: Make block devices default to virtio

      Now we have virtio-pci, we can make the virt board's default block
      device type be IF_VIRTIO. This allows users to use simplified
      command lines that don't have to explicitly create virtio-pci-blk
      devices; the -hda &c very short options now also work.

      This means we also need to set no_cdrom to avoid getting a
      default cdrom device -- this is needed because the virtio-blk
      device will fail if it is connected to a block backend with
      no media, which is what the default cdrom device typically is.
      Providing a cdrom with media via -cdrom will succeed, but silently
      create a device with non-removable medium. this is probably
      not really what the user wants, but is the best we can do now.

      Note that this change means that some command lines which used
      to work (by accident) will stop working. Where a drive was connected
      manually to a device but without 'if=none' being specified, we
      used to treat this as an IDE drive, which we would then not autoplug
      because the board doesn't support IDE. Now we will treat it as a
      virtio disk and autoplug it, which means the attempt to use the
      drive manually will fail:
        qemu-system-arm: -drive file=img.qcow2,id=foo: Drive 'foo' is already
        in use because it has been automatically connected to another device
        (did you need 'if=none' in the drive options?)
      The command line will have to be changed to include 'if=none', as the
      error message suggests.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-4-git-send-email-peter.maydell@linaro.org

  commit 62f7dbde4c75e48921fd1b773865250130c57bd8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      qdev-properties-system: Improve error message for drive assignment conflict

      If the user forgot if=none on their drive specification they're likely
      to get an error message because the drive is assigned once automatically
      by QEMU and once by the manual id=/drive= user command line specification.
      Improve the error message produced in this case to explicitly guide the
      user towards if=none.

      We rephrase the "drive conflict but not for an if=something" error as
      well to keep the wording in line.

      The two cases that change are:

      (1) Drive specified as to be auto-connected and also manually connected
      (and the board does handle this if= type):

        qemu-system-x86_64 -nodefaults -display none \
           -drive if=scsi,file=tmp.qcow2,id=foo -device ide-hd,drive=foo

      Previously:
        qemu-system-x86_64: -device ide-hd,drive=foo: Property 'ide-hd.drive'
        can't take value 'foo', it's in use

      Now:
        qemu-system-x86_64: -device ide-hd,drive=foo: Drive 'foo' is already in
        use because it has been automatically connected to another device (did
        you need 'if=none' in the drive options?)

      (2) Drive specified to be manually connected in two different ways:

        qemu-system-x86_64 -nodefaults -display none \
         -drive if=none,file=tmp.qcow2,id=foo -device ide-hd,drive=foo \
         -device ide-hd,drive=foo

      Previously:
        qemu-system-x86_64: -device ide-hd,drive=foo: Property 'ide-hd.drive'
        can't take value 'foo', it's in use

      Now:
        qemu-system-x86_64: -device ide-hd,drive=foo: Drive 'foo' is already in
        use by another device

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-3-git-send-email-peter.maydell@linaro.org

  commit f1fb9f0dc087c02b230be4cc96c5c76521f188fa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      qdev-properties-system: Change set_pointer's parse callback to use Error

      Instead of having set_pointer() call a parse callback which returns
      an error number that we then convert to an Error string with
      error_set_from_qdev_prop_error(), make the parse callback take an
      Error** and set the error itself. This will allow parse routines
      to provide more helpful error messages than the generic ones.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435068107-12594-2-git-send-email-peter.maydell@linaro.org

  commit b21ab1fc217b4a2b8f2f85d16bdd8510a7817a34
  Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      target-arm: A64: Print ELR when taking exceptions

      When taking an exception print the content of the exception link
      register. This is useful especially for synchronous exceptions because
      in that case this registers holds the address of the instruction that
      generated the exception.

      Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
      Message-id: 1435036655-16132-1-git-send-email-soren.brinkmann@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3c2bda216a00676e40301b5843ac3d6c3b2537a
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      target-arm: default empty semihosting cmdline

      If neither explicit semihosting args nor -kernel are used,
      make SYS_GET_CMDLINE return an empty string.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Message-id: AC7B5AFC-06AE-4FAD-9852-B65708E80E09@livius.net
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca7937365305d144cf0c97b907dac6f70ea152ef
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      hw/arm/virt-acpi-build: Add GICv2m description in ACPI MADT table

      Add GICv2m description in ACPI MADT table, so guest can use MSI when
      booting with ACPI.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Andrew Jones <drjones@redhat.com>
      Message-id: 1434676210-2276-1-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d0652b5765859049c96a13372bbe075be44e756b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Jun 26 14:22:36 2015 +0100

      hw/arm/virt-acpi-build: Fix table revision and some comments

      The table revision is not the ACPI spec version. Fix the wrong revision
      and also some comments.

      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433820378-8336-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ccb0c7e122db72d3a5da798c6414d4912bba828f
  Merge: 0a4a031 4b3bcd0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 26 11:32:58 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150626' into staging

      MIPS patches 2015-06-26

      Changes:
      * MIPS UHI semihosting support
      * microMIPS32 R6 support

      # gpg: Signature made Fri Jun 26 10:42:33 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150626:
        target-mips: add mips32r6-generic CPU definition
        target-mips: microMIPS32 R6 POOL16{A, C} instructions
        target-mips: microMIPS32 R6 Major instructions
        target-mips: microMIPS32 R6 POOL32{I, C} instructions
        target-mips: microMIPS32 R6 POOL32F instructions
        target-mips: microMIPS32 R6 POOL32A{XF} instructions
        target-mips: microMIPS32 R6 branches and jumps
        target-mips: add microMIPS32 R6 opcode enum
        target-mips: signal RI for removed instructions in microMIPS R6
        target-mips: raise RI exceptions when FIR.PS = 0
        target-mips: rearrange gen_compute_compact_branch
        target-mips: refactor {D}LSA, {D}ALIGN, {D}BITSWAP
        target-mips: remove an unused argument
        target-mips: add microMIPS TLBINV, TLBINVF
        target-mips: fix {RD, WR}PGPR in microMIPS
        target-mips: convert host to MIPS errno values when required
        target-mips: add Unified Hosting Interface (UHI) support
        target-mips: remove identical code in different branch
        hw/mips: Do not clear BEV for MIPS malta kernel load
        include/softmmu-semi.h: Make semihosting support 64-bit clean

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b3bcd016d83cc75f6a495c1db54b6c77f037adc
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:27 2015 +0100

      target-mips: add mips32r6-generic CPU definition

      Define a new CPU definition supporting MIPS32 Release 6 ISA and
      microMIPS32 Release 6 ISA.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ed7ce6c0f9d4370826557ce33d652beb88ccb3e6
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:26 2015 +0100

      target-mips: microMIPS32 R6 POOL16{A, C} instructions

      microMIPS32 Release 6 POOL16A/ POOL16C instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ab39ee452d74855adec91056812b8e1e5166302c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:25 2015 +0100

      target-mips: microMIPS32 R6 Major instructions

      Add new microMIPS32 Release 6 Major opcode instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3b4a5489447e7ed17cc504572cf729833853e7ab
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:24 2015 +0100

      target-mips: microMIPS32 R6 POOL32{I, C} instructions

      Add new microMIPS32 Release 6 POOL32I/POOL32C type instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2a24a7badeb6ad3ba72e7984f299623035d564d6
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:23 2015 +0100

      target-mips: microMIPS32 R6 POOL32F instructions

      Add new microMIPS32 Release 6 POOL32F instructions

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e03320958305a68f2bc6a32c87d7ed48303438f9
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:22 2015 +0100

      target-mips: microMIPS32 R6 POOL32A{XF} instructions

      Add new microMIPS32 Release 6 pool32a/pool32axf instructions.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 65935f070aa710cf340e96ae7ee36d2c1d5c8d15
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:21 2015 +0100

      target-mips: microMIPS32 R6 branches and jumps

      Add new microMIPS32 Release 6 branch and jump instructions.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3a1f426828cd8ffeec1a4fa8ca6ca3ed4f800edb
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:20 2015 +0100

      target-mips: add microMIPS32 R6 opcode enum

      Add microMIPS32 Release 6 opcode enum.
      Remove RI checking for pre-R6 reserved opcode.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9e8f441a7e094c0dc33a1c8f521d9e5bcfc1b4da
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:19 2015 +0100

      target-mips: signal RI for removed instructions in microMIPS R6

      Signal a Reserved Instruction exception for removed instruction encoding
      in microMIPS Release 6.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e29c962804c4dd3fabd44e703aa87eec555ed910
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:18 2015 +0100

      target-mips: raise RI exceptions when FIR.PS = 0

      64-bit paired-single (PS) floating point data type is optional in the
      pre-Release 6.
      It has to raise RI exception when PS type is not implemented. (FIR.PS = 0)
      (The PS data type is removed in the Release 6.)
      Loongson-2E and Loongson-2F don't have any implementation field in
      FCSR0(FIR) but do support PS data format, therefore for these cores RI will
      not be signalled regardless of PS bit.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6893f07466b045c5faf314ab9e57ef3b4a6f9e49
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:17 2015 +0100

      target-mips: rearrange gen_compute_compact_branch

      The function will be also used for microMIPS Release 6.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1f1b4c008e250f870719ed38fbd0bcc14322fc01
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:16 2015 +0100

      target-mips: refactor {D}LSA, {D}ALIGN, {D}BITSWAP

      Refactor those instructions in order to reuse them for microMIPS32
      Release 6.
      Rearrange gen_move_low32().

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f60eeb0c5ddd8ceb8ca6b3ba032159027afab67a
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:15 2015 +0100

      target-mips: remove an unused argument

      Remove an unused argument from decode_micromips32_opc()

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit e60ec06357470db5a0f25901ca19b6237e6da927
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:14 2015 +0100

      target-mips: add microMIPS TLBINV, TLBINVF

      Add microMIPS TLBINV, TLBINVF

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1bf5902de03732d4067c4e90171a1741d6542c45
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Thu Jun 25 00:24:13 2015 +0100

      target-mips: fix {RD, WR}PGPR in microMIPS

      rt, rs were swapped

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2c44b19c199f4ce2f1721120744d3d6e5d01d274
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:44 2015 +0100

      target-mips: convert host to MIPS errno values when required

      Convert only errno values which can be returned by system calls in
      mips-semi.c and are not generic to all archs.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 3b3c1694cfd394b73de426edebdbf90c28f664fd
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:43 2015 +0100

      target-mips: add Unified Hosting Interface (UHI) support

      Add UHI semihosting support for MIPS. QEMU run with "-semihosting" option
      will alter the behaviour of SDBBP 1 instruction -- UHI operation will be
      called instead of generating a debug exception.

      Also tweak Malta's pseudo-bootloader. On CPU reset the $4 register is set
      to -1 if semihosting arguments are passed to indicate that the UHI
      operations should be used to obtain input arguments.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit ff334767728011218c62f7476232d260cb5b28e6
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 11:08:42 2015 +0100

      target-mips: remove identical code in different branch

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit d6ca4277eee98b3c561e21ac105199891d346d79
  Author: Matthew Fortune <matthew.fortune@imgtec.com>
  Date:   Fri Jun 19 11:08:41 2015 +0100

      hw/mips: Do not clear BEV for MIPS malta kernel load

      The BEV flag controls whether the boot exception vector is still
      in place when starting a kernel.  When cleared the exception vector
      at EBASE (or hard coded address of 0x80000000) is used instead.

      The early stages of the linux kernel would benefit from BEV still
      being set to ensure any faults get handled by the boot rom exception
      handlers.  This is a moot point for system qemu as there aren't really
      any BEV handlers, but there are other good reasons to change this...

      The UHI (semi-hosting interface) defines special behaviours depending
      on whether an application starts in an environment with BEV set or
      cleared. When BEV is set then UHI assumes that a bootloader is
      relatively dumb and has no advanced exception handling logic.
      However, when BEV is cleared then UHI assumes that the bootloader
      has the ability to handle UHI exceptions with its exception handlers
      and will unwind and forward UHI SYSCALL exceptions to the exception
      vector that was installed prior to running the application.

      Signed-off-by: Matthew Fortune <matthew.fortune@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9f6f7ca1490563d98003149e6de32caf25c670da
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Jun 19 11:08:40 2015 +0100

      include/softmmu-semi.h: Make semihosting support 64-bit clean

      Correct addresses passed around in semihosting to use a data type suitable
      for both 32-bit and 64-bit targets.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 0a4a0312bf8b029cbd32a97db2cad669cf65ac49
  Merge: 58e8b33 1e81aba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 25 14:03:55 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Wed Jun 24 16:37:23 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net: simplify net_client_init1()
        net: drop if expression that is always true
        net: raise an error if -net type is invalid
        net: replace net_client_init1() netdev whitelist with blacklist
        net: add missing "netmap" to host_net_devices[]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 58e8b33518fd2bb6dce0ba7b6347c3df85aea3c6
  Merge: 355df30 1204854
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 25 11:19:46 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Wed Jun 24 16:27:53 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        virito-blk: drop duplicate check
        qemu-iotests: fix 051.out after qdev error message change
        iov: don't touch iov in iov_send_recv()
        raw-posix: Introduce hdev_is_sg()
        raw-posix: Use DPRINTF for DEBUG_FLOPPY
        raw-posix: DPRINTF instead of DEBUG_BLOCK_PRINT
        Fix migration in case of scsi-generic
        block: Use bdrv_is_sg() everywhere
        nvme: Fix memleak in nvme_dma_read_prp
        vvfat: add a label option
        util/hbitmap: Add an API to reset all set bits in hbitmap
        virtio-blk: Use blk_drain() to drain IO requests
        block-backend: Introduce blk_drain()
        throttle: Check current timers before updating any_timer_armed[]
        block: Let bdrv_drain_all() to call aio_poll() for each AioContext

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1e81aba5ac0b908ab859bf8ddf43ece33732d49c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:52 2015 +0100

      net: simplify net_client_init1()

      Drop the union and move the hubport creation into the !is_netdev case.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-6-git-send-email-stefanha@redhat.com

  commit 4ef0defbad9bc8b195f3392d1b7dcb42cd7ebe11
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:51 2015 +0100

      net: drop if expression that is always true

      Both is_netdev and !is_netdev paths already check that
      net_client_init_func[opts->kind] is non-NULL so there is no need for the
      if statement.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-5-git-send-email-stefanha@redhat.com

  commit d139e9a6cf01b8c31f5904b4ba40521d7224f7de
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:50 2015 +0100

      net: raise an error if -net type is invalid

      When a -net type is used that was not compiled into the binary there
      should be an error message.

      Note the special case for -net none, which is a no-op.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-4-git-send-email-stefanha@redhat.com

  commit 1322629b4f25730aed973d51983e7a3b021fe9c9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:49 2015 +0100

      net: replace net_client_init1() netdev whitelist with blacklist

      It's cumbersome to keep the whitelist up-to-date.  New netdev backends
      should most likely be allowed so a blacklist makes more sense than a
      whitelist.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1432743412-15943-3-git-send-email-stefanha@redhat.com

  commit 027a247bbf703e94258d07e38948946d7b85e91c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed May 27 17:16:48 2015 +0100

      net: add missing "netmap" to host_net_devices[]

      Although hmp-commands.hx lists "netmap" as a valid host_net_add type,
      the command rejects it because it's missing from the list.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1432743412-15943-2-git-send-email-stefanha@redhat.com

  commit 12048545019cd1d64c8147ea9277648e685fa489
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Jun 24 17:29:24 2015 +0800

      virito-blk: drop duplicate check

      in_num = req->elem.in_num, and req->elem.in_num is
      checked in line 489, so the check about in_num variable
      is superflous, let's drop it.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435138164-11728-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a30c4eb2ce7b2c15ab556be3cfe2340c17271ddd
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jun 23 15:56:09 2015 +0100

      qemu-iotests: fix 051.out after qdev error message change

      Commit f006cf7fa9a63ba8e4ccf57d46231ce594301727 ("qdev-monitor:
      Propagate errors through qdev_device_add()") dropped a meaningless error
      message.  This change in output caused qemu-iotests 051 to fail:

         QEMU_PROG: -device ide-drive,drive=disk: Device initialization failed.
        -QEMU_PROG: -device ide-drive,drive=disk: Device 'ide-drive' could not be initialized

      Update 051.out so the test passes again.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1435071369-30936-1-git-send-email-stefanha@redhat.com

  commit d46f7c9e648d8098ac73b36834ac81237b8c2c2d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 24 10:45:42 2015 +0100

      Fix glib_subprocess test

      A typo means that the tests dependent on glib with subprocess
      support are never run.

      Fixes: 9d41401b90fa10b335d2e739149d36437cfbf622

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 48ea3dedc54dbcb3c738ddef02a336739910ecfd
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:17 2015 +0200

      hw/pci-bridge: format special OFW unit address for PXB host

      We have agreed that OpenFirmware device paths in the "bootorder" fw_cfg
      file should follow the pattern

        /pci@i0cf8,%x/...

      for devices that live behind an extra root bus. The extra root bus in
      question is the %x'th among the extra root buses. (In other words, %x
      gives the position of the affected extra root bus relative to the other
      extra root buses, in bus_nr order.) %x starts at 1, and is formatted in
      hex.

      The portion of the unit address that comes before the comma is dynamically
      taken from the main host bridge, similarly to sysbus_get_fw_dev_path().

      Cc: Kevin O'Connor <kevin@koconnor.net>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0b336b3b98d8983d821ef9b0f159acc7c77cbac7
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:16 2015 +0200

      hw/core: explicit OFW unit address callback for SysBusDeviceClass

      The sysbus_get_fw_dev_path() function formats OpenFirmware device path
      nodes ("driver-name@unit-address") for sysbus devices. The first choice
      for "unit-address" is the base address of the device's first MMIO region.
      The second choice is its first IO port.

      However, if two sysbus devices with the same "driver-name" lack both MMIO
      and PIO resources, then there is no good way to distinguish them based on
      their OFW nodes, because in this case unit-address is omitted completely
      for both devices. An example is TYPE_PXB_HOST ("pxb-host").

      For the sake of such devices, introduce the explicit_ofw_unit_address()
      "virtual member function". With this function, each sysbus device in the
      same SysBusDeviceClass can state its own address.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Tested-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d10dda2d60c8c225a89a53d53add799b69f6bb46
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:14 2015 +0200

      hw/pci-bridge: disable SHPC in PXB

      OVMF downloads the ACPI linker/loader script from QEMU when the edk2 PCI
      Bus driver globally signals the firmware that PCI enumeration and resource
      allocation have completed. At this point QEMU regenerates the ACPI payload
      in an fw_cfg read callback, and this is when the PXB's _CRS gets
      populated.

      Unfortunately, when this happens, the PCI_COMMAND_MEMORY bit is clear in
      the root bus's command register, *unlike* under SeaBIOS. The consequences
      unfold as follows:

      - When build_crs() fetches dev->io_regions[i].addr, it is all-bits-one,
        because pci_update_mappings() --> pci_bar_address() calculated it as
        PCI_BAR_UNMAPPED, due to the PCI_COMMAND_MEMORY bit being clear.

      - Consequently, the SHPC MMIO BAR (bar 0) of the bridge is not added to
        the _CRS, *despite* having been programmed in PCI config space.

      - Similarly, the SHPC MMIO BAR of the PXB is not removed from the main
        root bus's DWordMemory descriptor.

      - Guest OSes (Linux and Windows alike) notice the pre-programmed SHPC BAR
        within the PXB's config space, and notice that it conflicts with the
        main root bus's memory resource descriptors. Linux reports

        pci 0000:04:00.0: BAR 0: can't assign mem (size 0x100)
        pci 0000:04:00.0: BAR 0: trying firmware assignment [mem
                                 0x88200000-0x882000ff 64bit]
        pci 0000:04:00.0: BAR 0: [mem 0x88200000-0x882000ff 64bit] conflicts
                                 with PCI Bus 0000:00 [mem
                                 0x88200000-0xfebfffff]

        While Windows Server 2012 R2 reports

          https://technet.microsoft.com/en-us/library/cc732199%28v=ws.10%29.aspx

          This device cannot find enough free resources that it can use. If you
          want to use this device, you will need to disable one of the other
          devices on this system. (Code 12)

      This issue was apparently encountered earlier, see the "hack" in:

        https://lists.nongnu.org/archive/html/qemu-devel/2015-01/msg02983.html

      and the current hole-punching logic in build_crs() and build_ssdt() is
      probably supposed to remedy exactly that problem -- however, for OVMF they
      don't work, because at the end of the PCI enumeration and resource
      allocation, which cues the ACPI linker/loader client, the command register
      is clear.

      The "shpc" property of "pci-bridge", introduced in the previous patches,
      allows us to disable the standard hotplug controller cleanly, eliminating
      the SHPC bar and the conflict.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4e5c9bfecf5da13e8e0f790002a55bb1cc0437b1
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:13 2015 +0200

      hw/pci-bridge: introduce "shpc" property

      In the PCI expander bridge, we will want to disable those features of
      pci-bridge that relate to SHPC (standard hotplug controller):

      - SHPC bar and underlying MemoryRegion
      - interrupt (INTx or MSI)
      - effective hotplug callbacks
      - other SHPC hooks (initialization, cleanup, migration etc)

      Introduce a new feature request bit in the PCIBridgeDev.flags field, and
      turn off the above if the bit is explicitly cleared.

      Suggested-by: Michael S. Tsirkin <mst@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 23ab143dcce8d7f758eb6946ebf68d8689018a9c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:12 2015 +0200

      hw/pci: introduce shpc_present() helper function

      It follows msi_present() in "include/hw/pci/msi.h".

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7a7c6a41c5583b24f6a35b02c7f68c84ebd7e177
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:11 2015 +0200

      hw/pci-bridge: add macro for "msi" property

      This should help catch property name typos at compile time.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3cf0ecb3c4f9bb6a7a58a62c0209509b4c9d13c6
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:10 2015 +0200

      hw/pci-bridge: add macro for "chassis_nr" property

      This should help catch property name typos at compile time.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0034e56209c1333bfca53356ce82663d801a15c5
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:09 2015 +0200

      hw/pci-bridge: expose _test parameter in SHPC_VMSTATE()

      Change the signature of the function-like macro SHPC_VMSTATE(), so that we
      can produce and expect this field conditionally in the migration stream,
      starting with an upcoming patch.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9df0b0e09c48ad543e6d12ee0c17d1857f83d3ca
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jun 19 04:40:08 2015 +0200

      migration: introduce VMSTATE_BUFFER_UNSAFE_INFO_TEST()

      There is no _TEST() variant of VMSTATE_BUFFER_UNSAFE_INFO() yet, but we'll
      soon need it. Introduce it and rebase the original
      VMSTATE_BUFFER_UNSAFE_INFO() on top.

      The parameter order of the new function-like macro follows that of
      VMSTATE_SINGLE_TEST(): "_test" is introduced between "_state" and
      "_version".

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 355df30554445c043a12168e9c5f912742050548
  Merge: 000d604 3de3d69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 18:25:55 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-06-23' into staging

      trivial patches for 2015-06-23

      # gpg: Signature made Tue Jun 23 18:23:45 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-06-23: (21 commits)
        util/qemu-sockets: improve ai_flag hints for ipv6 hosts
        hw/display/tcx.c: Fix memory leak
        hw/display/cg3.c: Fix memory leak
        Makefile: Add "make ctags"
        Makefile: Fix "make cscope TAGS"
        qemu-options: Use @itemx where appropriate
        qemu-options: Improve -global documentation
        throttle: Fix typo in the documentation of block_set_io_throttle
        hw/display/qxl-logger.c: Constify some variable
        configure: rearrange --help and consolidate enable/disable together
        libcacard: pkgconfig: tidy dependent libs
        vt82c686: QOMify
        xen_pt: QOMify
        wdt_i6300esb: QOMify
        piix4: QOMify
        piix: piix3 QOMify
        pci-assign: QOMify
        Print error when failing to load PCI config data
        Grammar: 'as to'->'as for'
        remove libdecnumber/dpd/decimal128Local.h
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3de3d698d942d1116152417f882c897b26b44e41
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Thu May 21 14:33:29 2015 +0200

      util/qemu-sockets: improve ai_flag hints for ipv6 hosts

      *) Do not use AI_ADDRCONFIG on listening sockets, because this flag
      makes it impossible to explicitly listen on '127.0.0.1' if no global
      ipv4 address is configured additionally, making this a very
      uncomfortable option.
      *) Add AI_V4MAPPED hint for connecting sockets.

      If your system is globally only connected via ipv6 you often still want
      to be able to use '127.0.0.1' and 'localhost' (even if localhost doesn't
      also have an ipv6 entry).
      For example, PVE - unless explicitly asking for insecure mode - uses
      ipv4 loopback addresses with QEMU for live migrations tunneled over SSH.
      These fail to start because AI_ADDRCONFIG makes getaddrinfo refuse to
      work with '127.0.0.1'.

      As for the AI_V4MAPPED flag: glibc uses it by default, and providing
      non-0 flags removes it. I think it makes sense to use it.

      I also want to point out that glibc explicitly sidesteps POSIX standards
      when passing 0 as hints by then assuming both AI_V4MAPPED and
      AI_ADDRCONFIG (the latter being a rather weird choice IMO), while
      according to POSIX.1-2001 it should be assumed 0. (glibc considers its
      choice an improvement.)
      Since either AI_CANONNAME or AI_PASSIVE are passed in our cases, glibc's
      default flags in turn are disabled again unless explicitly added, which
      I do with this patch.

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8684e85ca911b41d6a82ac5bcc5a0bfaba5eb7da
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 19:13:45 2015 +0800

      hw/display/tcx.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 22b2aeb82c811b227862c21e7a607087efbe5563
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 19:13:42 2015 +0800

      hw/display/cg3.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae5fdc81a16534ea04fc475f8723e81857c46ad4
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 22 13:35:08 2015 +0800

      Makefile: Add "make ctags"

      This generates ctags file

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit eaa2ddbb76798ec70d12351c0db43a7728d29150
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 22 13:35:07 2015 +0800

      Makefile: Fix "make cscope TAGS"

      Cscope and TAGS files work in source directory rather than the build
      directory, also, don't ask users to run configure first, because they
      may have an out of tree build.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f9cfd6555a3afb142a74a68438c6f4ee4c127e66
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 15 14:35:59 2015 +0200

      qemu-options: Use @itemx where appropriate

      Doesn't appear to make a difference, but let's use it consistently.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae08fd5a365e650d70acfe1d9027501707041b52
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 15 14:35:58 2015 +0200

      qemu-options: Improve -global documentation

      Recent commit 3751d7c "vl: allow full-blown QemuOpts syntax for
      -global" overloaded its existing argument syntax DRIVER.PROP=VALUE
      with QemuOpts syntax.  Unambigious as long as no DRIVER contains '='.

      Its documentation claims that "the two syntaxes are equivalent."
      Improve it to spell out how exactly the old syntax gets desugared into
      the new one.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6b932c0a5f951f1cfd3c459d8946074b9df8b829
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 15 16:12:52 2015 +0300

      throttle: Fix typo in the documentation of block_set_io_throttle

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a91e21186f81f712af8c02c7eec996ce25fb391f
  Author: Frediano Ziglio <fziglio@redhat.com>
  Date:   Thu Jun 11 14:17:56 2015 +0100

      hw/display/qxl-logger.c: Constify some variable

      Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c23f23b970ae8ce75d2254c64cf23d95a757811e
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 17 22:19:26 2015 +0300

      configure: rearrange --help and consolidate enable/disable together

      This is an attempt to rearrange configure --help output a bit
      and consolidate pairs of --enable/disable into its own section.

      After this, help text is easier to sort, manage and read.
      More descriptive text can be added as well, since we now have
      more space.

      While at it, mention en/dis-able-vte.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1e4db0595777b9b9a5a6a9f49ac3d187dda341f9
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 17 21:02:03 2015 +0300

      libcacard: pkgconfig: tidy dependent libs

      libcacard.pc file lists only one package in Requires
      field, which is nss, while glib-2.0 is also a requiriment.
      Furthermore, for libraries used internally by the library
      (this is the way nss and glib are used by libcacard),
      Requires.private shold be used instead of Requires.

      Fix both issues.

      This does not affect linking of qemu because it links
      with objects from libcacard directly.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 417349e6e95d9aa4e0fbc01434de30e8d405ab56
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:27 2015 +0800

      vt82c686: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f9b9d292afcb55f23b8863c0388a4b3e42c79747
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:26 2015 +0800

      xen_pt: QOMify

      Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 41fc9050fed524d300062fd8fe7aecd5c7adf5ac
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:25 2015 +0800

      wdt_i6300esb: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit acff3e48b7e1ac18e034cc612346bdc38ad96ee1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:24 2015 +0800

      piix4: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b7c69719d21bea305b7cff6ecde0974edc5ff4b8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:23 2015 +0800

      piix: piix3 QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1ea6305a834a01bba55309d012ee1fdc46c3eff2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 13 08:43:22 2015 +0800

      pci-assign: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7c59364d0329d36a7759033962a469ca714f884d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 3 17:58:01 2015 +0100

      Print error when failing to load PCI config data

      When loading migration fails due to a disagreement about
      PCI config data we don't currently get any errors explaining
      that was the cause of the problem or which byte in the config
      data was at fault.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4aab6282f8e1f7652b0470b078a08ab5678fb929
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jun 3 19:43:56 2015 +0100

      Grammar: 'as to'->'as for'

      Fixup migrate-incoming text as requested by Eric in:

       http://lists.nongnu.org/archive/html/qemu-devel/2015-03/msg03362.html

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bfa3ab619731653e752c7cf0ab3395ec8e70fe79
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Jun 3 17:37:27 2015 +0300

      remove libdecnumber/dpd/decimal128Local.h

      Commit 72ac97cdfc added two equivalent versions of decimal128Local.h,
      one in libdecnumber/dpd/ and another in include/libdecnumber/dpd/.
      Being identical by the code, the two files however differs in the
      licensing terms.  The one in libdecnumber/dpd/ (which is being
      removed by this patch) is licensed as GPL3.1 (plus gcc runtime
      exception), which, as far as I know, is not compatible with GPL-2.
      This file is not used (it is included from
      include/libdecnumber/dpd/decimal128.h, so version in include/ is
      used).

      More, the version in include/ can also be removed, since none
      of the 3 defines from that file are actually used by the code.
      Even more, one of the defines from there, decimal128SetSign,
      is redefined (to equivalent value) in libdecnumber/dpd/decimal128.c,
      but again, never used.

      What a mess...

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4969e90b8110d6880d1a7fcb3cab27c316a0d3e
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Jun 3 14:22:41 2015 +0100

      configure: append --extra-ldflags to LDFLAGS

      The help text says --extra-ldflags is appended to LDFLAGS so make it so.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 000d6042da0d73e5a71318b5fa96e5a084534d12
  Merge: 6966b2a ffffbb3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 17:46:20 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-220615-3' into staging

      xen-220615, more SOB lines

      # gpg: Signature made Tue Jun 23 17:19:08 2015 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-220615-3:
        Revert "xen-hvm: increase maxmem before calling xc_domain_populate_physmap"
        xen/pass-through: constify some static data
        xen/pass-through: log errno values rather than function return ones
        xen/pass-through: ROM BAR handling adjustments
        xen/pass-through: fold host PCI command register writes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffffbb369f3ed9bca5ff2867143f76d0c6e069c0
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Mon Jun 22 13:00:42 2015 +0000

      Revert "xen-hvm: increase maxmem before calling xc_domain_populate_physmap"

      This reverts commit c1d322e6048796296555dd36fdd102d7fa2f50bf.

      The original commit fixes a bug when assigning a large number of
      devices which require option roms to a guest.  (One known
      configuration that needs extra memory is having more than 4 emulated
      NICs assigned.  Three or fewer NICs seems to work without this
      functionality.)

      However, by unilaterally increasing maxmem, it introduces two
      problems.

      First, now libxl's calculation of the required maxmem during migration
      is broken -- any guest which exercised this functionality will fail on
      migration.  (Guests which have the default number of devices are not
      affected.)

      Secondly, it makes it impossible for a higher-level toolstack or
      administer to predict how much memory a VM will actually use, making
      it much more difficult to effectively use all of the memory on a
      machine.

      Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 74526eb01886ca45774c1e9c736f61536fa2bda1
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jun 5 13:04:55 2015 +0100

      xen/pass-through: constify some static data

      This is done indirectly by adjusting two typedefs and helps emphasizing
      that the respective tables aren't supposed to be modified at runtime
      (as they may be shared between devices).

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 3782f60d2047cb86567889307ce78baacf518635
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri Jun 5 13:04:18 2015 +0100

      xen/pass-through: log errno values rather than function return ones

      Functions setting errno commonly return just -1, which is of no
      particular use in the log file.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 69976894c1d91c4b0c985fa05936cb6b8d01382b
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Mon Jun 8 14:11:51 2015 +0100

      xen/pass-through: ROM BAR handling adjustments

      Expecting the ROM BAR to be written with an all ones value when sizing
      the region is wrong - the low bit has another meaning (enable/disable)
      and bits 1..10 are reserved. The PCI spec also mandates writing all
      ones to just the address portion of the register.

      Use suitable constants also for initializing the ROM BAR register field
      description.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 950fe0aa3f55ad6bb135fc9cde9ebf4df05f62fc
  Author: Jan Beulich <JBeulich@suse.com>
  Date:   Fri May 15 13:46:11 2015 +0100

      xen/pass-through: fold host PCI command register writes

      The code introduced to address XSA-126 allows simplification of other
      code in xen_pt_initfn(): All we need to do is update "cmd" suitably,
      as it'll be written back to the host register near the end of the
      function anyway.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit eb6c6a604890201e321a6ace32973d10dc033245
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 18 12:17:29 2015 +0200

      add pci-bridge-seat

      Simplifies multiseat configuration, see
      docs/multiseat.txt update for details.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72d97b3a543a9c2c820bd463ba24751ae4247ac3
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Tue Jun 9 05:31:53 2015 +0200

      pc: cleanup and convert TMP ACPI device description to AML API

      remove some code duplication in acpi-build.c and drop 5
      ASL and binary blobs files with TPM ACPI device description,
      replacing them with 1 small hunk written in AML API.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0e0b3592f6cfc56b3a4cc2c040552b7caaf2329f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jun 23 08:09:34 2015 +0200

      MAINTAINERS: add ACPI entry

      Igor agreed to help review ACPI patches, add an entry to MAINTAINERS
      with all ACPI stuff I could think of.
      Note: I listed ARM ACPI files here just to make sure we are Cc'd, no
      plan to maintain ACPI for ARM through my tree :)

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 16617e36b02ebdc83f215d89db9ac00f7d6d6d83
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:13:14 2015 +0800

      vhost: correctly pass error to caller in vhost_dev_enable_notifiers()

      We override the error value r in fail_vq, this will cause the caller
      can't detect the failure which may cause the caller may disable the
      notifiers twice if vhost is failed to start. Fix this by using another
      variable to keep track the return value of set_host_notifier().

      Fixes b0b3db79559e57db340b292621c397e7a6cdbdc5 ("vhost-net: cleanup
      host notifiers at last step")

      Cc: qemu-stable@nongnu.org
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e3816255bf4b6377bb405331e2ee0dc14d841b80
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Mon Jun 15 13:52:52 2015 +0300

      balloon: add a feature bit to let Guest OS deflate balloon on oom

      Excessive virtio_balloon inflation can cause invocation of OOM-killer,
      when Linux is under severe memory pressure. Various mechanisms are
      responsible for correct virtio_balloon memory management. Nevertheless it
      is often the case that these control tools does not have enough time to
      react on fast changing memory load. As a result OS runs out of memory and
      invokes OOM-killer. The balancing of memory by use of the virtio balloon
      should not cause the termination of processes while there are pages in the
      balloon. Now there is no way for virtio balloon driver to free memory at
      the last moment before some process get killed by OOM-killer.

      This does not provide a security breach as balloon itself is running
      inside Guest OS and is working in the cooperation with the host. Thus
      some improvements from Guest side should be considered as normal.

      To solve the problem, introduce a virtio_balloon callback which is
      expected to be called from the oom notifier call chain in out_of_memory()
      function. If virtio balloon could release some memory, it will make the
      system return and retry the allocation that forced the out of memory
      killer to run.

      This behavior should be enabled if and only if appropriate feature bit
      is set on the device. It is off by default.

      This functionality was recently merged into vanilla Linux.

        commit 5a10b7dbf904bfe01bb9fcc6298f7df09eed77d5
        Author: Raushaniya Maksudova <rmaksudova@parallels.com>
        Date:   Mon Nov 10 09:36:29 2014 +1030

      This patch adds respective control bits into QEMU. It introduces
      deflate-on-oom option for balloon device which does the trick.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Raushaniya Maksudova <rmaksudova@parallels.com>
      CC: Anthony Liguori <aliguori@amazon.com>
      CC: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      Acked-by: James Bottomley <JBottomley@Odin.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 6b64640dd25846c4de42aa433db56e0ff975993a
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Thu May 21 09:50:10 2015 +0800

      iov: don't touch iov in iov_send_recv()

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-id: 555D39D2.4000705@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3307ed7b3fac5ba99eb3b84904b0b7cdc3592a61
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:45:00 2015 +0300

      raw-posix: Introduce hdev_is_sg()

      Until now, an SG device was identified only by checking if its path
      started with "/dev/sg". Then, hdev_open() would set the bs->sg flag
      accordingly. The patch relies on the actual properties of the device
      instead of the specified file path.

      To this end, test for an SG device (e.g. /dev/sg0) by ensuring that
      all of the following holds:

       - The specified file name corresponds to a character device
       - The device supports the SG_GET_VERSION_NUM ioctl
       - The device supports the SG_GET_SCSI_ID ioctl

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Message-id: 1435056300-14924-6-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a93a3982a6645463fa822131d38b17284edd5633
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:59 2015 +0300

      raw-posix: Use DPRINTF for DEBUG_FLOPPY

      Get rid of several #ifdef DEBUG_FLOPPY and substitute them with
      DPRINTF.

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-5-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bcb225550dcc0d6fcef8e97012bae572ba78f73a
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:58 2015 +0300

      raw-posix: DPRINTF instead of DEBUG_BLOCK_PRINT

      Building the QEMU tools fails if we #define DEBUG_BLOCK inside
      block/raw-posix.c. Here instead of adding qemu-log.o in block-obj-y
      so that DEBUG_BLOCK_PRINT can be used, we substitute the latter with
      a simple DPRINTF() (that does not cause bit-rot).

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-4-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1b6bc94d5d43ff3e39abadae19f2dbcb0954eb93
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:57 2015 +0300

      Fix migration in case of scsi-generic

      During migration, QEMU uses fsync()/fdatasync() on the open file
      descriptor for read-write block devices to flush data just before
      stopping the VM.

      However, fsync() on a scsi-generic device returns -EINVAL which
      causes the migration to fail. This patch skips flushing data in case
      of an SG device, since submitting SCSI commands directly via an SG
      character device (e.g. /dev/sg0) bypasses the page cache completely,
      anyway.

      Note that fsync() not only flushes the page cache but also the disk
      cache. The scsi-generic device never sends flushes, and for
      migration it assumes that the same SCSI device is used by the
      destination host, so it does not issue any SCSI SYNCHRONIZE CACHE
      (10) command.

      Finally, remove the bdrv_is_sg() test from iscsi_co_flush() since
      this is now redundant (we flush the underlying protocol at the end
      of bdrv_co_flush() which, with this patch, we never reach).

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-3-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b192af8acc597a6e8068873434e56e0c7de1b7d3
  Author: Dimitris Aragiorgis <dimara@arrikto.com>
  Date:   Tue Jun 23 13:44:56 2015 +0300

      block: Use bdrv_is_sg() everywhere

      Instead of checking bs->sg use bdrv_is_sg() consistently throughout
      the code.

      Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1435056300-14924-2-git-send-email-dimara@arrikto.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 25940fa7e57ffce9d495b4c2aadc39790535856d
  Author: Lu Lina <lina.lulina@huawei.com>
  Date:   Fri Jun 19 14:27:34 2015 +0800

      nvme: Fix memleak in nvme_dma_read_prp

      Signed-off-by: Lu Lina <lina.lulina@huawei.com>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Message-id: 1434695254-69808-1-git-send-email-kathy.wangting@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d5941ddae82a35771656d7e35f64f7f8f19c5627
  Author: Wolfgang Bumiller <w.bumiller@proxmox.com>
  Date:   Fri Jun 19 11:35:29 2015 +0200

      vvfat: add a label option

      Until now the vvfat volume label was hardcoded to be
      "QEMU VVFAT", now you can pass a file.label=labelname option
      to the -drive to change it.

      The FAT structure defines the volume label to be limited to
      11 bytes and is filled up spaces when shorter than that. The
      trailing spaces however aren't exposed to the user by
      operating systems.

      [Added missing comment '#' characters in block-core.json to fix build
      errors.
      --Stefan]

      Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
      Message-id: 1434706529-13895-2-git-send-email-w.bumiller@proxmox.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c6a8c3283f1d53e360073bdb32f87a97e78e2880
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Fri May 22 09:29:46 2015 +0800

      util/hbitmap: Add an API to reset all set bits in hbitmap

      The function bdrv_clear_dirty_bitmap() is updated to use
      faster hbitmap_reset_all() call.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 555E868A.60506@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e40b3bfc7e82823cf4df5f0bf668f56db41e53a
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 17 13:37:20 2015 +0300

      virtio-blk: Use blk_drain() to drain IO requests

      Each call of the virtio_blk_reset() function calls blk_drain_all(),
      which works for all existing BlockDriverStates, while draining only
      one is needed.

      This patch replaces blk_drain_all() by blk_drain() in
      virtio_blk_reset(). virtio_blk_data_plane_stop() should be called
      after draining because it restores vblk->complete_request.

      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Message-id: 1434537440-28236-3-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 97b0385a346829cf03efe131a26a4b6a4cd0a21f
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 17 13:37:19 2015 +0300

      block-backend: Introduce blk_drain()

      This patch introduces the blk_drain() function which allows to replace
      blk_drain_all() when only one BlockDriverState needs to be drained.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1434537440-28236-2-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2f388b93a147258f9dbc83ebe63365edac4aa7a2
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 15 18:41:15 2015 +0300

      throttle: Check current timers before updating any_timer_armed[]

      Calling throttle_group_config() cancels all timers from a particular
      BlockDriverState, so any_timer_armed[] should be updated accordingly.

      However, with the current code it may happen that a timer is armed in
      a different BlockDriverState from the same group, so any_timer_armed[]
      would be set to false in a situation where there is still a timer
      armed.

      The consequence is that we might end up with two timers armed. This
      should not have any noticeable impact however, since all accesses to
      the ThrottleGroup are protected by a lock, and the situation would
      become normal again shortly thereafter as soon as all timers have been
      fired.

      The correct way to solve this is to check that we're actually
      cancelling a timer before updating any_timer_armed[].

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1434382875-3998-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f406c03c093f1451ac0ba7fde31eeb78e5e5e417
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Wed Jun 10 14:38:17 2015 +0300

      block: Let bdrv_drain_all() to call aio_poll() for each AioContext

      After the commit 9b536adc ("block: acquire AioContext in
      bdrv_drain_all()") the aio_poll() function got called for every
      BlockDriverState, in assumption that every device may have its own
      AioContext. If we have thousands of disks attached, there are a lot of
      BlockDriverStates but only a few AioContexts, leading to tons of
      unnecessary aio_poll() calls.

      This patch changes the bdrv_drain_all() function allowing it find shared
      AioContexts and to call aio_poll() only for unique ones.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-id: 1433936297-7098-4-git-send-email-yarygin@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6966b2a07190004e18ede33ce50a65009b36f3a6
  Merge: a320697 a5d4d7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 13:32:50 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150623-1' into staging

      virtio-input: property fixes, add evdev passthrough

      # gpg: Signature made Tue Jun 23 09:33:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150623-1:
        Add MAINTAINERS entry for virtio-input
        virtio-input: evdev passthrough
        virtio-input: move properties, use virtio_instance_init_common

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3206972a9eab65ec8e8f9ae320ad628ba4b58f1
  Merge: 0c8ff72 a0b1a66
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 23 10:38:00 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-22' into staging

      Monitor patches

      # gpg: Signature made Mon Jun 22 18:56:18 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-06-22: (24 commits)
        Include monitor/monitor.h exactly where needed
        Include qapi/qmp/qerror.h exactly where needed
        qerror: Move #include out of qerror.h
        qerror: Finally unused, clean up
        qmp: Wean off qerror_report()
        tpm: Avoid qerror_report() outside QMP command handlers
        qerror: Clean up QERR_ macros to expand into a single string
        qerror: Eliminate QERR_DEVICE_NOT_FOUND
        vl: Use error_report() for --display errors
        vl: Avoid qerror_report() outside QMP command handlers
        QemuOpts: Wean off qerror_report_err()
        qdev-monitor: Propagate errors through qdev_device_add()
        qdev-monitor: Propagate errors through set_property()
        qdev-monitor: Convert qbus_find() to Error
        qdev-monitor: Fix check for full bus
        qdev-monitor: Stop error avalanche in qbus_find_recursive()
        disas: Remove uses of CPU env
        monitor: Split mon_get_cpu fn to remove ENV_GET_CPU
        monitor: Fix failure path for "S" argument
        monitor: Point to "help" command on syntax error
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a5d4d7b580f42c47d240a2068c810e4147147f6e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jun 19 10:25:34 2015 +0200

      Add MAINTAINERS entry for virtio-input

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 006a5edebe656114e0e0a6fb24b8aae6401c1cf4
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 28 09:18:47 2014 +0100

      virtio-input: evdev passthrough

      This allows to assign host input devices to the guest:

      qemu -device virtio-input-host-pci,evdev=/dev/input/event<nr>

      The guest gets exclusive access to the input device, so be careful
      with assigning the keyboard if you have only one connected to your
      machine.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6f2b9a5b24c488d38ace01910c684749ff922e26
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 18 17:45:47 2015 +0200

      virtio-input: move properties, use virtio_instance_init_common

      Move properties from virtio-*-pci to virtio-*-device.
      Also make better use of QOM and attach common properties
      to the abstract parent classes (virtio-input-device and
      virtio-input-pci-device).

      Switch the hid device instance init functions over to use
      virtio_instance_init_common, so we get the properties of the
      virtio device aliased properly to the virtio pci proxy.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1fa795a853255fcc93e5d3e2a92d161a2ed96eb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:53:05 2015 +0800

      qdev: fix OVERFLOW_BEFORE_WIDEN

      Potentially overflowing expression "1 << prop->bitnr" with
      type "int" (32 bits, signed) is evaluated using 32-bit arithmetic,
      and then used in a context that expects an expression of type
      "uint64_t" (64 bits, unsigned).

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3750dabc69d76f0938cc726a64a70e4ae2fe21df
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Jun 23 09:53:04 2015 +0800

      virito-pci: fix OVERRUN problem

      Overrunning array "proxy->guest_features" of 2 4-byte
      elements at element index 2 (byte offset 8) using index
      "proxy->gfselect" (which evaluates to 2). Normally, the
      Linux kernel driver just read/write '0' or '1' as the
      "proxy->gfselect" values, so using '<' instead of '=<' to
      make coverity happy and avoid potential harm.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a0b1a66ea39bca011108734147a72232a4d08c7a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 18:16:21 2015 +0100

      Include monitor/monitor.h exactly where needed

      In particular, don't include it into headers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit cc7a8ea740ec74a144e866a1d24aa6b490e31923
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 17:22:46 2015 +0100

      Include qapi/qmp/qerror.h exactly where needed

      In particular, don't include it into headers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit d49b68364414d649b8e26232f2a600d415611662
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 18:29:20 2015 +0100

      qerror: Move #include out of qerror.h

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4629ed1e98961bbe678db68ef5f4342ff174a6c3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 14:29:59 2015 +0100

      qerror: Finally unused, clean up

      Remove it except for two things in qerror.h:

      * Two #include to be cleaned up separately to avoid cluttering this
        patch.

      * The QERR_ macros.  Mark as obsolete.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 485febc6d1382a82e4e1640729fffbf0c1392a44
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 17:25:50 2015 +0100

      qmp: Wean off qerror_report()

      The traditional QMP command handler interface

          int qmp_FOO(Monitor *mon, const QDict *params, QObject **ret_data);

      doesn't provide for returning an Error object.  Instead, the handler
      is expected to stash it in the monitor with qerror_report().

      When we rebased QMP on top of QAPI, we didn't change this interface.
      Instead, commit 776574d introduced "middle mode" as a temporary aid
      for converting existing QMP commands to QAPI one by one.  More than
      three years later, we're still using it.

      Middle mode has two effects:

      * Instead of the native input marshallers

            static void qmp_marshal_input_FOO(QDict *, QObject **, Error **)

        it generates input marshallers conforming to the traditional QMP
        command handler interface.

      * It suppresses generation of code to register them with
        qmp_register_command()

        This permits giving them internal linkage.

      As long as we need qmp-commands.hx, we can't use the registry behind
      qmp_register_command(), so the latter has to stay for now.

      The former has to go to get rid of qerror_report().  Changing all QMP
      commands to fit the QAPI mold in one go was impractical back when we
      started, but by now there are just a few stragglers left:
      do_qmp_capabilities(), qmp_qom_set(), qmp_qom_get(), qmp_object_add(),
      qmp_netdev_add(), do_device_add().

      Switch middle mode to generate native input marshallers, and adapt the
      stragglers.  Simplifies both the monitor code and the stragglers.

      Rename do_qmp_capabilities() to qmp_capabilities(), and
      do_device_add() to qmp_device_add, because that's how QMP command
      handlers are named today.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 8b53a19675d2329695179e47aa3797692fb0d9ba
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 12:09:02 2015 +0100

      tpm: Avoid qerror_report() outside QMP command handlers

      qerror_report() is a transitional interface to help with converting
      existing monitor commands to QMP.  It should not be used elsewhere.
      Replace by error_report().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c6bd8c706a799eb0fece99f468aaa22b818036f3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 11:54:50 2015 +0100

      qerror: Clean up QERR_ macros to expand into a single string

      These macros expand into error class enumeration constant, comma,
      string.  Unclean.  Has been that way since commit 13f59ae.

      The error class is always ERROR_CLASS_GENERIC_ERROR since the previous
      commit.

      Clean up as follows:

      * Prepend every use of a QERR_ macro by ERROR_CLASS_GENERIC_ERROR, and
        delete it from the QERR_ macro.  No change after preprocessing.

      * Rewrite error_set(ERROR_CLASS_GENERIC_ERROR, ...) into
        error_setg(...).  Again, no change after preprocessing.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 75158ebbe259f0bd8bf435e8f4827a43ec89c877
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 16 08:57:47 2015 +0100

      qerror: Eliminate QERR_DEVICE_NOT_FOUND

      Error classes other than ERROR_CLASS_GENERIC_ERROR should not be used
      in new code.  Hiding them in QERR_ macros makes new uses hard to spot.
      Fortunately, there's just one such macro left.  Eliminate it with this
      coccinelle semantic patch:

          @@
          expression EP, E;
          @@
          -error_set(EP, QERR_DEVICE_NOT_FOUND, E)
          +error_set(EP, ERROR_CLASS_DEVICE_NOT_FOUND, "Device '%s' not found", E)

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c6bf0f7ffa90c720377eb6bddd27037041acbc5b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 18:23:45 2015 +0100

      vl: Use error_report() for --display errors

      Results in nicer error messages.  Before this patch:

          Invalid GTK option string: gtk,lirum-larum

      After:

          qemu-system-x86_64: -display gtk,lirum-larum: Invalid GTK option string

      Of course, the thing ought to use QemuOpts instead of parsing by hand.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 1459407e88632e6d66cd6b71326eaf78e0a80772
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 09:47:12 2015 +0100

      vl: Avoid qerror_report() outside QMP command handlers

      qerror_report() is a transitional interface to help with converting
      existing monitor commands to QMP.  It should not be used elsewhere.
      Replace by error_report() in initial startup helpers parse_sandbox()
      and parse_add_fd().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 70b9433109ed99217b812f19800de550e2e0ecd5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 12:50:26 2015 +0100

      QemuOpts: Wean off qerror_report_err()

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      The only remaining user in qemu-option.c is qemu_opts_parse().  Is it
      used in QMP context?  If not, we can simply replace
      qerror_report_err() by error_report_err().

      The uses in qemu-img.c, qemu-io.c, qemu-nbd.c and under tests/ are
      clearly not in QMP context.

      The uses in vl.c aren't either, because the only QMP command handlers
      there are qmp_query_status() and qmp_query_machines(), and they don't
      call it.

      Remaining uses:

      * drive_def(): Command line -drive and such, HMP drive_add and pci_add

      * hmp_chardev_add(): HMP chardev-add

      * monitor_parse_command(): HMP core

      * tmp_config_parse(): Command line -tpmdev

      * net_host_device_add(): HMP host_net_add

      * net_client_parse(): Command line -net and -netdev

      * qemu_global_option(): Command line -global

      * vnc_parse_func(): Command line -display, -vnc, default display, HMP
        change, QMP change.  Bummer.

      * qemu_pci_hot_add_nic(): HMP pci_add

      * usb_net_init(): Command line -usbdevice, HMP usb_add

      Propagate errors through qemu_opts_parse().  Create a convenience
      function qemu_opts_parse_noisily() that passes errors to
      error_report_err().  Switch all non-QMP users outside tests to it.

      That leaves vnc_parse_func().  Propagate errors through it.  Since I'm
      touching it anyway, rename it to vnc_parse().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f006cf7fa9a63ba8e4ccf57d46231ce594301727
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 14:00:41 2015 +0100

      qdev-monitor: Propagate errors through qdev_device_add()

      Also polish an error message while I'm touching the line anyway,

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit 4caa489d1337c1a72d2e36185e4586ad246b98e1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 13:58:02 2015 +0100

      qdev-monitor: Propagate errors through set_property()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit d282842999b914c38c8be4659012aa619c22af8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 19:16:04 2015 +0100

      qdev-monitor: Convert qbus_find() to Error

      As usual, the conversion breaks printing explanatory messages after
      the error: actual printing of the error gets delayed, so the
      explanations precede rather than follow it.

      Pity.  Disable them for now.  See also commit 7216ae3.

      While there, eliminate QERR_BUS_NOT_FOUND, and clean up unusual
      spelling in the error message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ed238ba2a0239368dd0cec9bfaf3300a5bd303ce
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 18:39:16 2015 +0100

      qdev-monitor: Fix check for full bus

      Property bus has always been too screwed up to be really usable for
      values other than plain bus IDs.  This just fixes a bug that crept in
      in commit 1395af6 "qdev: add a maximum device allowed field for the
      bus."

      It doesn't always fail when it should:

          $ qemu-system-x86_64 -nodefaults -device virtio-serial-pci -device virtio-rng-device,bus=pci.0/virtio-serial-pci/virtio-bus

      Happily plugs the virtio-rng-device into the virtio-bus provided by
      virtio-serial-pci, even though its only slot is already occupied by a
      virtio-serial-device.

      And sometimes fails when it shouldn't:

          $ qemu-system-x86_64 -nodefaults -device virtio-serial-pci -device virtserialport,bus=virtio-bus/virtio-serial-device

      Yes, the virtio-bus is full, but the virtio-serial-bus provided by
      virtio-serial-device isn't, and that's the one we're trying to use.

      Root cause: we check "bus full" when we resolve the first element of
      the path.  That's the correct one only when it's also the last one.

      Fix by moving the "bus full" check to right before we return a bus.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a5ec494e274ddcad6d487e3872e16964ef57e0de
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 11 17:26:31 2015 +0100

      qdev-monitor: Stop error avalanche in qbus_find_recursive()

      Reproducer:

          $ qemu-system-x86_64 -nodefaults -device virtio-rng-pci -device virtio-rng-pci -device virtio-rng-device,bus=virtio-bus
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' is full
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' is full
          qemu-system-x86_64: -device virtio-rng-device,bus=virtio-bus: Bus 'virtio-bus' not found

      qbus_find_recursive() reports the "is full" error itself, and leaves
      reporting "not found" to its caller.  The result is confusion.  Write
      it a function contract that permits leaving all error reporting to the
      caller, and implement it.  Update callers to detect and report "is
      full".

      Screwed up when commit 1395af6 added the max_dev limit and the "is
      full" error condition to enforce it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d49190c4208f2c556c3a01962a81f8a85d522bb1
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 14:20:41 2015 -0700

      disas: Remove uses of CPU env

      disas does not need to access the CPU env for any reason. Change the
      APIs to accept CPU pointers instead. Small change pattern needs to be
      applied to all target translate.c. This brings us closer to making
      disas.o a common-obj and less architecture specific in general.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 5bcda5f7349da01aded719b595f32ce2b9d396db
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 14:20:40 2015 -0700

      monitor: Split mon_get_cpu fn to remove ENV_GET_CPU

      The monitor currently has one helper, mon_get_cpu() which will return
      an env pointer. The target specific users of this API want an env, but
      all the target agnostic users really just want the cpu pointer. These
      users then need to use the target-specifically defined ENV_GET_CPU to
      navigate back up to the CPU from the ENV. Split the API for the two
      uses cases to remove all need for ENV_GET_CPU.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e549d2aaeba1cfac207c9a9675cc203e6372a22e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:10 2015 -0400

      monitor: Fix failure path for "S" argument

      Since the "S" argument type is only used with the "?" flag,
      the bug can't bite.

      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit dd41eea77129a4cd8ae5170b02e0fee175af314e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:09 2015 -0400

      monitor: Point to "help" command on syntax error

      When a command fails due to incorrect syntax or input, suggest using
      the "help" command to get more information about the command.  This
      is only applicable for HMP.

      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ae50212ff717f3d295ebff352eb7d6cc08332b7e
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:08 2015 -0400

      monitor: cleanup parsing of cmd name and cmd arguments

      There's too much going on in monitor_parse_command().
      Split up the arguments parsing bits into a separate function
      monitor_parse_arguments(). Let the original function check for
      command validity and sub-commands if any and return data (*cmd)
      that the newly introduced function can process and return a
      QDict. Also, pass a pointer to the cmdline to track current
      parser location.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19f2db5c84e563597bd8b3c3190aef591060dec2
  Author: Bandan Das <bsd@redhat.com>
  Date:   Wed Jun 3 18:38:07 2015 -0400

      monitor: remove debug prints

      The preferred solution is to use tracepoints and there
      is good chance of bitrot with the debug prints not being
      enabled at compile time. Remove them.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bandan Das <bsd@redhat.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 34acbc95229f9f841bde83691a5af949c15e105b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri May 15 16:25:00 2015 -0600

      qobject: Use 'bool' inside qdict

      Now that qbool is fixed, let's fix getting and setting a bool
      value to a qdict member to also use C99 bool rather than int.

      I audited all callers to ensure that the changed return type
      will not cause any changed semantics.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fc48ffc39ed1060856475e4320d5896f26c945e8
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri May 15 16:24:59 2015 -0600

      qobject: Use 'bool' for qbool

      We require a C99 compiler, so let's use 'bool' instead of 'int'
      when dealing with boolean values.  There are few enough clients
      to fix them all in one pass.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0c8ff723bd29e5c8b2ca989f857ae5c37ec49c4e
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:26 2015 +1000

      m68k: fix usp processing on interrupt entry and exception exit

      The action to potentially switch sp register is not occurring at the correct
      point in the interrupt entry or exception exit sequences.

      For the interrupt entry case the sp on entry is used to create the stack
      exception frame - but this may well be the user stack pointer, since we
      haven't done the switch yet. Re-order the flow to switch the sp regs then
      use the current sp to create the exception frame.

      For the return from exception case the code is unwinding the sp after
      switching sp registers. But it should always unwind the supervisor sp
      first, then carry out any required sp switch.

      Note that these problems don't effect operation unless the user sp bit is
      set in the CACR register. Only a single sp is used in the default power up
      state. Previously Linux only used this single sp mode. But modern versions
      of Linux use the user sp mode now, so we need correct behavior for Linux
      to work.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Laurent Vivier <laurent@vivier.eu>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-4-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a8327e8a8288e301a2f01bc3ca2d465a3a4ca78
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:25 2015 +1000

      m68k: implement move to/from usp register instruction

      Fill out the code support for the move to/from usp instructions. They are
      being decoded, but there is no code to support there actions. So add it.

      Current versions of Linux running on the ColdFire 5208 use these instructions.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Laurent Vivier <laurent@vivier.eu>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-3-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c52f0cbba76310ad626e54996dbce08c7a8a820
  Author: Greg Ungerer <gerg@uclinux.org>
  Date:   Fri Jun 19 23:43:24 2015 +1000

      m68k: implement more ColdFire 5208 interrupt controller functionality

      Implement the SIMR and CIMR registers of the 5208 interrupt controller.
      These are used by modern versions of Linux running on ColdFire (not sure
      of the exact version they were introduced, but they have been in for quite
      a while now).

      Without this change when attempting to run a linux-3.5 kernel you will
      see:

        qemu: hardware error: mcf_intc_write: Bad write offset 28

      and execution will stop and dump out.

      Signed-off-by: Greg Ungerer <gerg@uclinux.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Laurent Vivier <laurent@vivier.eu>
      Message-id: 1434721406-25288-2-git-send-email-gerg@uclinux.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0a3346f5dea0a679322df804e1e78d7c10d12a9f
  Merge: cb4e0f9 daeba96
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 22 12:50:30 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Changes to name string ownership for alias properties
      * Improvements around enum properties
      * Cleanups around -object handling
      * New helper functions
      * Cleanups of qdev init helper functions
      * Add path argument to qom-tree script
      * QTest cleanup to use new qtest_add_data_func() consistently

      # gpg: Signature made Fri Jun 19 18:14:38 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qdev: Un-deprecate qdev_init_nofail()
        qdev: Deprecated qdev_init() is finally unused, drop
        qom: Don't pass string table to object_get_enum() function
        qom: Add an object_property_add_enum() helper function
        qom: Make enum string tables const-correct
        qom: Add object_new_with_props() / object_new_withpropv() helpers
        qom: Add helper function for getting user objects root
        vl: Create (most) objects before creating chardev backends
        doc: Document user creatable object types in help text
        backends: Fix typename of 'policy' enum property in hostmem obj
        scripts: Add support for path as argument of qom-tree
        tests: Use qtest_add_data_func() consistently
        qdev: Free property names after registering gpio aliases
        qom: strdup() target property name on object_property_add_alias()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cb4e0f9ddf7d45de7e4716cbab661ea568bd0b6c
  Merge: ad7020a e4a511f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 22 11:50:07 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * i8254 security fix
      * Avoid long 100% CPU wait after restarting guests that use the periodic timer
      * Fixes for access clamping (WinXP, MIPS)
      * wixl/.msi support for qemu-ga on Windows

      # gpg: Signature made Fri Jun 19 11:30:53 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: clamp accesses against the MemoryRegionSection
        exec: do not clamp accesses to MMIO regions
        mc146818rtc: Reset the periodic timer on load
        qemu-timer: Call clock reset notifiers on forward jumps
        tests: virtio-scsi: Add test for unaligned WRITE SAME
        tests: virtio-scsi: Move start/stop to individual test functions
        libqos: Complete virtio device ID definition list
        libqos: Allow calling guest_free on NULL pointer
        tests: Link libqos virtio object to virtio-scsi-test
        i8254: fix out-of-bounds memory access in pit_ioport_read()
        qemu-ga: Building Windows MSI installation with configure/Makefile
        qemu-ga: Introduce Windows MSI script
        qemu-ga: debug printouts to help troubleshoot installation
        qemu-ga: adding vss-[un]install options
        qemu-log: Open file for logging when specified

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ad7020a7e7b27d468ecc2aacb04ba4eb09017074
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:52 2015 -0700

      target-microblaze: Remove dead code

      This code is already being run in the mb_cpu_realizefn()
      function. As PVR registers are preserved on reset this
      code is not required.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 033af8e9aaba1994c4816cea5828aaddc383a907
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:48 2015 -0700

      s3adsp1800: Remove the hardcoded values from the reset

      Remove the hardcoded values from the machine specific reset
      function, as the same values are already set in the standard
      MicroBlaze reset.

      This also allows the entire reset function to be deleted, as
      PVR registers are now preserved on reset.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a87310a62d1885b8f6d6b5b30227cbd9792d2c3c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:45 2015 -0700

      ml605_mmu: Move the hardcoded values to the init function

      Move the hard coded register values to the init function.
      This also allows the entire reset function to be deleted, as
      PVR registers are now preserved on reset.

      The hardcoded PVR0 values can be removed as they are setting
      the endianness and stack protection, which is already done
      or invalid.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 6fad9e986b82c7c7ed7cfa0cc3ee38b3510a5432
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:42 2015 -0700

      target-microblaze: Convert pvr-full to a CPU property

      Originally the pvr-full PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 72e38754853443830152a3cfe586db1d9b15e8fe
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:38 2015 -0700

      target-microblaze: Convert version_mask to a CPU property

      Originally the version_mask PVR bits were manually set for each
      machine. This is a hassle and difficult to read, instead set them
      based on the CPU properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a88bbb006a523deabb90245a283d1914abd34e3e
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:35 2015 -0700

      target-microblaze: Convert endi to a CPU property

      Originally the endi PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit a6c3ed24748f06742413e174167b0faa7030c244
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:32 2015 -0700

      target-microblaze: Convert dcache-writeback to a CPU property

      Originally  the dcache-writeback PVR bits were manually set for each machine.
      This is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 714461237083c1eadcb9d686f8ce4088737c1d0a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:29 2015 -0700

      target-microblaze: Convert use-mmu to a CPU property

      Originally the use-mmu PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit be67e9ab9740d5a80e5c37bfd35247a4e449bc5a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Thu Jun 18 21:16:25 2015 -0700

      target-microblaze: Rename the usefpu variable

      Rename the usefpu variable to use_fpu.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f44c475cb6ded298486a589c4205ab70e485b48c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:32:35 2015 +1000

      target-microblaze: Disable stack protection by default

      Stack protection is not available when the MMU is enabled.
      As the MMU is enabled by default, disable stack protection
      by default.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 4e5d45ae5756123b3b7000c8b0b3d3a9ea4737da
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:31:58 2015 +1000

      target-microblaze: Convert use-fpu to a CPU property

      Originally the use-fpu PVR bits were manually set for each machine. This
      is a hassle and difficult to read, instead set them based on the CPU
      properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f27183abaaaf48e9d1f8469c7e99a987444f4410
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:31:20 2015 +1000

      target-microblaze: Tidy up the base-vectors property

      Rename the "xlnx.base-vectors" string to "base-vectors" and
      move the base_vectors variable into the cfg struct.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 9aaaa181949e4a23ca298fb7006e2d8bac842e92
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:30:43 2015 +1000

      target-microblaze: Allow the stack protection to be disabled

      Microblaze stack protection is configurable and isn't always enabled.
      This patch allows the stack protection to be disabled from the
      CPU properties.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 8bac22423e4c3b70082dd6c1b492ccf21f3b5a0c
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:30:05 2015 +1000

      target-microblaze: Preserve the pvr registers during reset

      Move the Microblaze PVR registers to the end of the CPUMBState
      and preserve them during reset. This is similar to what the
      QEMU ARM model does with some of it's registers.

      This allows the Microblaze PVR registers to only be set once
      at realise instead of constantly at reset.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 53432dc9ea37d3be4c8efc3023c2382e9da5334a
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri May 29 16:29:28 2015 +1000

      target-microblaze: Fix up indentation

      Fix up the incorrect indentation level in the helper_stackprot() function.

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit d87636b18f8de901e76bedd9c7f55d3eaed924ee
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 20:31:40 2015 -0700

      microblaze: s3adsp: Instantiate CPU using QOM

      Instantiate and realise the CPU directly, rather than using
      cpu_mb_init. Microblazes cpu_model argument is a dummy so remove the
      default cpu_model set logic.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit daeba9699d41ad79e2f3d34acea9c85c5d67a2ac
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 19 16:17:23 2015 +0200

      qdev: Un-deprecate qdev_init_nofail()

      It's a perfectly sensible helper function.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 0210afe6690be045cb849b2f16bffabda575a9bf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 19 16:17:22 2015 +0200

      qdev: Deprecated qdev_init() is finally unused, drop

      qdev_init() is a wrapper around setting property "realized" to true,
      plus error handling that passes errors to qerror_report_err().
      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      All code has been modernized to avoid qdev_init() and its
      inappropriate error handling.  We can finally drop it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a3590dacce94519c1747d8bf423744c6bb7d9941
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 27 16:07:56 2015 +0100

      qom: Don't pass string table to object_get_enum() function

      Now that properties can be explicitly registered as an enum
      type, there is no need to pass the string table to the
      object_get_enum() function. The object property registration
      already has a pointer to the string table.

      In changing this method signature, the hostmem backend object
      has to be converted to use the new enum property registration
      code, which simplifies it somewhat.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a8e3fbedc827f992657f5670212e854f62ec12ad
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:08 2015 +0100

      qom: Add an object_property_add_enum() helper function

      A QOM property can be parsed as enum using the visit_type_enum()
      helper function, but this forces callers to use the more complex
      generic object_property_add() method when registering it. It
      also requires that users of that object have access to the
      string map when they want to read the property value.

      This patch introduces a specialized object_property_add_enum()
      method which simplifies the use of enum properties, so the
      setters/getters directly get passed the int value.

        typedef enum {
           MYDEV_TYPE_FROG,
           MYDEV_TYPE_ALLIGATOR,
           MYDEV_TYPE_PLATYPUS,

           MYDEV_TYPE_LAST
        } MyDevType;

      Then provide a table of enum <-> string mappings

        static const char *const mydevtypemap[MYDEV_TYPE_LAST + 1] = {
           [MYDEV_TYPE_FROG] = "frog",
           [MYDEV_TYPE_ALLIGATOR] = "alligator",
           [MYDEV_TYPE_PLATYPUS] = "platypus",
           [MYDEV_TYPE_LAST] = NULL,
        };

      Assuming an object struct of

         typedef struct {
            Object parent_obj;
            MyDevType devtype;
            ...other fields...
         } MyDev;

      The property can then be registered as follows:

         static int mydev_prop_get_devtype(Object *obj,
                                           Error **errp G_GNUC_UNUSED)
         {
             MyDev *dev = MYDEV(obj);

             return dev->devtype;
         }

         static void mydev_prop_set_devtype(Object *obj,
                                            int value,
                                            Error **errp G_GNUC_UNUSED)
         {
             MyDev *dev = MYDEV(obj);

             dev->devtype = value;
         }

         object_property_add_enum(obj, "devtype",
                                  mydevtypemap, "MyDevType",
                                  mydev_prop_get_devtype,
                                  mydev_prop_set_devtype,
                                  NULL);

      Note there is no need to check the range of 'value' in
      the setter, because the string->enum conversion code will
      have already done that and reported an error as required.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 2e4450ff432daef524cb3557fca68a3b7b5c7823
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:07 2015 +0100

      qom: Make enum string tables const-correct

      The enum string table parameters in various QOM/QAPI methods
      are declared 'const char *strings[]'. This results in const
      warnings if passed a variable that was declared as

         static const char * const strings[] = { .... };

      Add the extra const annotation to the parameters, since
      neither the string elements, nor the array itself should
      ever be modified.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a31bdae5a76ecc060c1eb8a66be1896072c1e8b2
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:06 2015 +0100

      qom: Add object_new_with_props() / object_new_withpropv() helpers

      It is reasonably common to want to create an object, set a
      number of properties, register it in the hierarchy and then
      mark it as complete (if a user creatable type). This requires
      quite a lot of error prone, verbose, boilerplate code to achieve.

      First a pair of functions object_set_props() / object_set_propv()
      are added which allow for a list of objects to be set in
      one single API call.

      Then object_new_with_props() / object_new_with_propv() constructors
      are added which simplify the sequence of calls to create an
      object, populate properties, register in the object composition
      tree and mark the object complete, into a single method call.

      Usage would be:

         Error *err = NULL;
         Object *obj;
         obj = object_new_with_propv(TYPE_MEMORY_BACKEND_FILE,
                                     object_get_objects_root(),
                                     "hostmem0",
                                     &err,
                                     "share", "yes",
                                     "mem-path", "/dev/shm/somefile",
                                     "prealloc", "yes",
                                     "size", "1048576",
                                     NULL);

      Note all property values are passed in string form and will
      be parsed into their required data types, using normal QOM
      semantics for parsing from string format.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit bc2256c4ae86308a1521c89456b599d441119418
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:05 2015 +0100

      qom: Add helper function for getting user objects root

      Add object_get_objects_root() function which is a convenience for
      obtaining the Object * located at /objects in the object
      composition tree. Convert existing code over to use the new
      API where appropriate.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f08f9271bfe3f19a5eb3d7a2f48532065304d5c8
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:04 2015 +0100

      vl: Create (most) objects before creating chardev backends

      Some types of object must be created before chardevs, other types of
      object must be created after chardevs. As such there is no option but
      to create objects in two phases.

      This takes the decision to create as many object types as possible
      right away before anyother backends are created, and only delay
      creation of those few which have an explicit dependency on the
      chardevs. Hopefully the set which need delaying will remain small
      over time.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b9174d4f250cacb43b7cd9e07cf9f86818d62afd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:03 2015 +0100

      doc: Document user creatable object types in help text

      The QEMU help for -object is essentially useless, just giving users
      the generic syntax. Move it down into its own section and introduce
      a nested table where each user creatable object can be documented.
      The existing memory-backend-file, rng-random and rng-egd object
      types are documented.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b1028b4e8683740cd257a9b77577734664e61511
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed May 13 17:14:02 2015 +0100

      backends: Fix typename of 'policy' enum property in hostmem obj

      The 'policy' property was being registered with a typename of
      'str', but it is in fact an enum of the 'HostMemPolicy' type.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 799810fb2810ec4cb82f12ec9b023e1bfe434d71
  Merge: ffdb140 a59d31a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 17:05:15 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150619' into staging

      target-arm queue:
       * support --semihosting-config,arg=value
       * Cortex-R5 support (including implementing them on the Zynq board)
       * Cortex-M4 support (without FPU)
       * enable vfio-calxeda-xgmac
       * don't reset ALIAS sysregs

      # gpg: Signature made Fri Jun 19 14:41:54 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150619:
        semihosting: add --semihosting-config arg sub-argument
        semihosting: create SemihostingConfig structure and semihost.h
        arm: xlnx-zynqmp: Add 2xCortexR5 CPUs
        arm: xlnx-zynqmp: Add boot-cpu property
        arm: xlnx-zynqmp: Preface CPU variables with "apu"
        target-arm: Add support for Cortex-R5
        target-arm: Implement PMSAv7 MPU
        target-arm: Add registers for PMSAv7
        target-arm/helper.c: define MPUIR register
        target-arm: Do not reset sysregs marked as ALIAS
        hw/arm/sysbus-fdt: enable vfio-calxeda-xgmac dynamic instantiation
        target-arm: Add the Cortex-M4 CPU

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a59d31a1ebdce796a469242800db89bf09c94580
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      semihosting: add --semihosting-config arg sub-argument

      Add new "arg" sub-argument to the --semihosting-config allowing the user
      to pass multiple input arguments separately. It is required for example
      by UHI semihosting to construct argc and argv.

      Also, update ARM semihosting to support new option (at the moment it is
      the only target which cares about arguments).

      If the semihosting is enabled and no semihosting args have been specified,
      then fall back to -kernel/-append. The -append string is split on whitespace
      before initializing semihosting.argv[1..n]; this is different from what
      QEMU MIPS machines' pseudo-bootloaders do (i.e. argv[1] contains the whole
      -append), but is more intuitive from UHI user's point of view and Linux
      kernel just does not care as it concatenates argv[1..n] into single cmdline
      string anyway.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Message-id: 1434643256-16858-3-git-send-email-leon.alrae@imgtec.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cfe67cef48696e8b901aff38a82056ae64d69c98
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      semihosting: create SemihostingConfig structure and semihost.h

      Remove semihosting_enabled and semihosting_target and replace them with
      SemihostingConfig structure containing equivalent fields. The structure
      is defined in vl.c where it is actually set.

      Also introduce separate header file include/exec/semihost.h allowing to
      access semihosting config related stuff from target specific semihosting
      code.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1434643256-16858-2-git-send-email-leon.alrae@imgtec.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b58850e79d8df1185bd4999df81fbe6954cd2790
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Add 2xCortexR5 CPUs

      Add the 2xCortexR5 CPUs to zynqmp board. They are powered off on reset
      (this is true of real hardware) by default or selectable as the boot
      processor.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: da34128c73ca13fc4f8c3293e1a33d1e1e345655.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6396a193d36e10ff38f26d4ef785aba97362f29e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Add boot-cpu property

      Add a string property that specifies the primary boot cpu. All CPUs
      except the one selected will start-powered-off. This allows for elf
      boots on any CPU, which prepares support for booting R5 elfs directly
      on the R5 processors.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 53331c00d80c7ce9c6a83712348773f1b38fae2b.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e5577bc5563ccf453249e884be9a223deabab5b
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      arm: xlnx-zynqmp: Preface CPU variables with "apu"

      The CPUs currently supported by zynqmp are the APU (application
      processing unit) CPUs. There are other CPUs in Zynqmp so unqualified
      "cpus" in ambiguous. Preface the variables with "APU" accordingly, to
      prepare support adding the RPU (realtime processing unit) processors.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: ce32287fc365aea898465e981da3546a227e0811.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d6a6b13ea1dfeb25c43a648e94cfe4395906f1da
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      target-arm: Add support for Cortex-R5

      Introduce a CPU model for the Cortex R5 processor. ARMv7 with MPU,
      and both thumb and ARM div instructions.

      Also implement dummy ATCM and BTCM. These CPs are defined for R5 but
      don't have a lot of meaning in QEMU yet. Raz them so the guest can
      proceed if they are read. The TCM registers will return a size of 0,
      indicating no TCM.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: efe213163e6800578494aba864ac30329de4d396.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f6bda88ff839e2adefe4959b7def420b90703855
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:45 2015 +0100

      target-arm: Implement PMSAv7 MPU

      Unified MPU only. Uses ARM architecture major revision to switch
      between PMSAv5 and v7 when ARM_FEATURE_MPU is set. PMSA v6 remains
      unsupported and is asserted against.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: dcb03cda6dd754c5cc6a962fa11f25089811e954.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cb0b013a1fa421cdfb83257cd33f855cc90649a
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Add registers for PMSAv7

      Define the arm CP registers for PMSAv7 and their accessor functions.
      RGNR serves as a shared index that indexes into arrays storing the
      DRBAR, DRSR and DRACR registers. DRBAR and friends have to be VMSDd
      separately from the CP interface using a new PMSA specific VMSD
      subsection.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 172cf135fbd8f5cea413c00e71cc1c3cac704744.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3281af8114c6b8ead02f08b58e3c36895c1ea047
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm/helper.c: define MPUIR register

      Define the MPUIR register for MPU supporting ARMv6 and onwards.
      Currently we only support unified MPU.

      The size of the unified MPU is defined via the number of "dregions".
      So just a single config is added to specify this size. (When split MPU
      is implemented we will add an extra iregions config).

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 9f248950b803a08c8b3c978931663182f7e882e7.1434501320.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b061a82b8afcc45ce09d770d9c0acdf429401054
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Do not reset sysregs marked as ALIAS

      cp_reg_reset() is called from g_hash_table_foreach() which does not
      define a specific ordering of the hash table iteration. Thus doing reset
      for registers marked as ALIAS would give an ambiguous result when
      resetvalue is different for original and alias registers. Exit
      cp_reg_reset() early when passed an alias register. Then clean up alias
      register definitions from needless resetvalue and resetfn.

      In particular, this fixes a bug in the handling of the PMCR register,
      which had different resetvalues for its 32 and 64-bit views.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1434554713-10220-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit decf4f807b4498ca35a87e9de82bc9a4e64cc29a
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      hw/arm/sysbus-fdt: enable vfio-calxeda-xgmac dynamic instantiation

      This patch allows the instantiation of the vfio-calxeda-xgmac device
      from the QEMU command line (-device vfio-calxeda-xgmac,host="<device>").

      A specialized device tree node is created for the guest, containing
      compat, dma-coherent, reg and interrupts properties.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1434455898-17895-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ba890a9b2509a0087bb7eafddae02ea5ecbb7bb4
  Author: Aurelio C. Remonda <aurelioremonda@gmail.com>
  Date:   Fri Jun 19 14:17:44 2015 +0100

      target-arm: Add the Cortex-M4 CPU

      This patch adds the Cortex-M4 CPU. The M4 is basically the same as
      the M3, the main differences being the DSP instructions and an
      optional FPU.  Only no-FPU cortex-M4 is implemented here, cortex-M4F
      is not because the core target-arm code doesn't support the M-profile
      FPU model yet.

      Signed-off-by: Aurelio C. Remonda <aurelioremonda@gmail.com>
      Message-id: 1434461850-4104-1-git-send-email-aurelioremonda@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffdb1409a79c9cc91afd9f58df625fdca16bf8b9
  Merge: 89e9429 693a3e0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 12:54:08 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150619-1' into staging

      cocoa queue:
       * Add Machine menu, with entries for pause, resume, reset, power down, and
         media change and eject for removable drives

      # gpg: Signature made Fri Jun 19 11:24:11 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-cocoa-20150619-1:
        ui/cocoa.m: Add machine menu items to change and eject removable drive media
        ui/cocoa.m: Add Reset and Power Down menu items to Machine menu
        ui/cocoa.m: Add Machine menu with pause and resume menu items

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 89e9429c3cb42400f3a80890e0c20b18aa62a11d
  Merge: 473a494 1e7398a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 19 11:30:57 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      virtio, pci fixes, enhancements

      Most notably this includes virtio cross-endian patches.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Fri Jun 19 11:18:05 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        vhost: enable vhost without without MSI-X
        pci: Don't register a specialized 'config_write' if default behavior is intended
        hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()
        vhost_net: re-enable when cross endian
        vhost-net: tell tap backend about the vnet endianness
        tap: fix non-linux build
        tap: add VNET_LE/VNET_BE operations
        vhost: set vring endianness for legacy virtio
        virtio: introduce virtio_legacy_is_cross_endian()
        linux-headers: sync vhost.h
        vhost-user: part of virtio

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e4a511f8cc6f4a46d409fb5c9f72c38ba45f8d83
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 17 10:36:54 2015 +0200

      exec: clamp accesses against the MemoryRegionSection

      Because the clamping was done against the MemoryRegion,
      address_space_rw was effectively broken if a write spanned
      multiple sections that are not linear in underlying memory
      (with the memory not being under an IOMMU).

      This is visible with the MIPS rc4030 IOMMU, which is implemented
      as a series of alias memory regions that point to the actual RAM.

      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 965eb2fcdfe919ecced6c34803535ad32dc1249c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 17 10:40:27 2015 +0200

      exec: do not clamp accesses to MMIO regions

      It is common for MMIO registers to overlap, for example a 4 byte register
      at 0xcf8 (totally random choice... :)) and a 1 byte register at 0xcf9.
      If these registers are implemented via separate MemoryRegions, it is
      wrong to clamp the accesses as the value written would be truncated.

      Hence for these regions the effects of commit 23820db (exec: Respect
      as_translate_internal length clamp, 2015-03-16, previously applied as
      commit c3c1bb99) must be skipped.

      Tested-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae46e23964ad45d5bc72374040e87d8f52ac2178
  Author: Paul Donohue <qemu-devel@PaulSD.com>
  Date:   Fri Jun 12 10:10:14 2015 -0400

      mc146818rtc: Reset the periodic timer on load

      When loading a VM from a snapshot or migration, clock changes can cause
      the periodic timer to stall or loop rapidly.

      qemu-timer has a reset notifier mechanism that is used to avoid timer
      stalls or loops if the host clock changes while the VM is running when
      using QEMU_CLOCK_HOST.  However, when loading a snapshot or migration,
      qemu-timer is initialized and fires the reset notifier before
      mc146818rtc is initialized and has registered its reset handler.  In
      addition, this mechanism isn't used when using QEMU_CLOCK_REALTIME,
      which might also change when loading a snapshot or migration.

      To correct that problem, this commit resets the periodic timer after
      loading from a snapshot or migration if the clock has either jumped
      backward or has jumped forward by more than the clock jump limit that
      is used by the reset notifier code in qemu-timer.

      Signed-off-by: Paul Donohue <qemu-git@PaulSD.com>
      Message-Id: <20150612141013.GE2749@TopQuark.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb1a3a051d89975f26296163066bb0745ecca49d
  Author: Paul Donohue <qemu-devel@PaulSD.com>
  Date:   Fri Jun 12 10:08:45 2015 -0400

      qemu-timer: Call clock reset notifiers on forward jumps

      Commit 691a0c9c introduced a mechanism by which QEMU_CLOCK_HOST can
      notify other parts of the emulator when the host clock has jumped
      backward.  This is used to avoid stalling timers that were scheduled
      based on the host clock.

      However, if the host clock jumps forward, then timers that were
      scheduled based on the host clock may fire rapidly and cause other
      problems.  For example, the mc146818rtc periodic timer will block
      execution of the VM and consume host CPU while firing every interrupt
      for the time period that was skipped by the host clock.

      To correct that problem, this commit fires the reset notification if the
      host clock jumps forward by more than a hard-coded limit.  The limit is
      currently set to a value of 60 seconds, which should be small enough to
      prevent excessive timer loops, but large enough to avoid frequent resets
      in idle VMs.

      Signed-off-by: Paul Donohue <qemu-git@PaulSD.com>
      Message-Id: <20150612140845.GD2749@TopQuark.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 397c767b2de5b918a7b890d02aae83d6dcb2a470
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:20 2015 +0800

      tests: virtio-scsi: Add test for unaligned WRITE SAME

      This is an exercise for virtio-scsi tests using the libqos virtio
      library. A few common routines are added to facilitate future extensions
      of the test set.

      The added test case is a regression test for the bug in d7f4b1999e.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 693a3e01af8082f855094061650311fcaf3e1269
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add machine menu items to change and eject removable drive media

      Adds all removable devices to the Machine menu as a Change and Eject menu
      item pair. ide-cd0 would have a "Change ide-cd0..." and "Eject ide-cd0"
      menu items.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 270746142c3c96549ecd82c6097a6d85a35f27cf
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add Reset and Power Down menu items to Machine menu

      Add "Reset" and "Power Down" menu items to Machine menu.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1e7398a140f7a6bd9f5a438e7ad0f1ef50990e25
  Author: Pankaj Gupta <pagupta@redhat.com>
  Date:   Tue Jun 16 13:48:59 2015 +0530

      vhost: enable vhost without without MSI-X

      We use vhostforce to enable vhost even if Guests don't have MSI-X
      support and we fall back to QEMU virtio-net.

      This gives a very small performance gain, but the disadvantage
      is that guest now controls which virtio code is running
      (qemu or vhost) so our attack surface is doubled.

      This patch will enable vhost unconditionally whenever it's requested.
      For compatibility, enable vhost when vhostforce is set, as well.

      Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>

  commit 74de5504fd063019433ec0746105da774ede790d
  Author: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
  Date:   Tue Jun 16 11:24:39 2015 +0300

      pci: Don't register a specialized 'config_write' if default behavior is intended

      Few devices have their specialized 'config_write' methods which simply
      call 'pci_default_write_config' followed by a 'msix_write_config' or
      'msi_write_config' calls, using exact same arguments.

      This is unnecessary as 'pci_default_write_config' already invokes
      'msi_write_config' and 'msix_write_config'.

      Also, since 'pci_default_write_config' is the default 'config_write'
      handler, we can simply avoid the registration of these specialized
      versions.

      Cc: Leonid Shatz <leonid.shatz@ravellosystems.com>
      Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5ba03e2dd785362026917e4cc8a1fd2c64e8e62c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Jun 17 14:45:03 2015 +0200

      hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()

      This is done mainly for improving readability, and in preparation for the
      next patch, but Markus pointed out another bonus for the string being
      returned:

      "No arbitrary length limit. Before the patch, it's 39 characters, and the
      code breaks catastrophically when qdev_fw_name() is longer: the second
      snprintf() is called with its first argument pointing beyond path[], and
      its second argument underflowing to a huge size."

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Tested-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1717388645670336c48aa05d19b0acd07687a821
  Author: Cédric Le Goater <clg@fr.ibm.com>
  Date:   Wed Jun 17 15:23:54 2015 +0200

      vhost_net: re-enable when cross endian

      Cross-endianness is now checked by the core vhost code.

      revert 371df9f5e0f1 "vhost-net: disable when cross-endian"

      Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
      [ added commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ]
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:49 2015 +0200

      vhost-net: tell tap backend about the vnet endianness

      The default behaviour for TAP/MACVTAP is to consider vnet as native endian.

      This patch handles the cases when this is not true:
      - virtio 1.0: always little-endian
      - legacy cross-endian

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4ee9b43be9a6e4ae161a1e6322bfef90818589f6
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 18 16:52:23 2015 +0200

      tap: fix non-linux build

      tap_fd_set_vnet_le/tap_fd_set_vnet_be was missing,
      fix it up.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com>

  commit 8524f1c79e614552c0165db9cc75a8a6bd8607a5
  Author: John Arbuckle <programmingkidx@gmail.com>
  Date:   Fri Jun 19 10:53:27 2015 +0100

      ui/cocoa.m: Add Machine menu with pause and resume menu items

      Add Machine menu to the Macintosh interface with pause
      and resume menu items. These items can either pause or
      resume execution of the guest operating system.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Message-id: 6D7AE6AA-0595-4FAD-AACF-9DFAB87248F0@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 473a49460db0a90bfda046b8f3662b49f94098eb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jun 18 13:49:28 2015 -0300

      q35: Re-enable FDC on pc-q35-2.3 and older

      commit ea96bc629cbd52be98b2967a4b4f72e91dfc3ee4 doesn't match the patch
      submitted by Laszlo to qemu-devel. We reuse pc_q35_2_4_machine_options()
      inside pc_q35_2_3_machine_options(), so we need to undo the no_floppy
      change in pc_q35_2_3_machine_options().

      (This discrepancy was due to a bad merge.)

      This restores the previous behavior where all the 2.3 and older machines
      had no_floppy=0.

      Reported-by: Ján Tomko <jtomko@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-id: 1434646168-3100-1-git-send-email-ehabkost@redhat.com
      Cc: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      [PMM: mention that this was a merge issue, not a review issue]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff5397bc72a1716bb34302dd470343ebee7d6bf2
  Author: Martin Cerveny <M.Cerveny@computer.org>
  Date:   Wed May 13 14:14:54 2015 +0200

      scripts: Add support for path as argument of qom-tree

      Add processing of optional argument path as "tree base".

      Signed-off-by: Martin Cerveny <M.Cerveny@computer.org>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 53f77e4562f85ccf82c8831a4448e9aefb538837
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Mar 25 18:40:15 2015 +0100

      tests: Use qtest_add_data_func() consistently

      Replace uses of g_test_add_data_func() for QTest test cases.

      It is still valid to use it for any non-QTest test cases,
      which are not run for multiple target binaries.

      Suggested-by: John Snow <jsnow@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6bc5cf92c0ab0085ba9a6e0cebcf5a544f416ca7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 9 16:57:30 2015 -0300

      qdev: Free property names after registering gpio aliases

      Now that object_property_add_alias() strdup()s target_name, we can free
      the property names in qdev_pass_gpios().

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 1590d266d96b3f9b42443d6388dfc38f527ac2d8
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 9 16:57:29 2015 -0300

      qom: strdup() target property name on object_property_add_alias()

      With this, object_property_add_alias() callers can safely free the
      target property name, like what already happens with the 'name' argument
      to all object_property_add*() functions.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 8ffe756da0481233e1bd518b2b16489f51856292
  Merge: 1b58f5a e1d4210
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 18 13:32:39 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-06-18' into staging

      QAPI patches

      # gpg: Signature made Thu Jun 18 13:20:00 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qapi-2015-06-18:
        qapi-types: Bury code dead since commit 6b5abc7
        qapi-types: Split generate_fwd_builtin() off generate_fwd_struct()
        qapi-types: Drop unused members parameters
        qapi-types: Don't filter out expressions with 'gen'
        qapi: Catch and reject flat union branch of array type
        tests/qapi-schema: New flat union array branch test case
        qapi: Better separate the different kinds of helpers
        qapi: Move exprs checking from parse_schema() to check_exprs()
        qapi: Fix to reject stray 't', 'f' and 'n'
        qapi: Simplify inclusion cycle detection
        qapi: Fix file name in error messages for included files
        qapi: Improve a couple of confusing variable names
        qapi: Eliminate superfluous QAPISchema attribute input_dir
        qapi: Drop bogus command from docs
        MAINTAINERS: Fix up QAPI and QAPI schema file patterns

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e1d4210c3a50059a3889cedc44a8aa193fa63d7d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 09:45:55 2015 +0200

      qapi-types: Bury code dead since commit 6b5abc7

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c5ecd7e18f912ab5e91f09b0333fb07567885d42
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 09:22:32 2015 +0200

      qapi-types: Split generate_fwd_builtin() off generate_fwd_struct()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ae0a7a109037160465f55f8bab06897f0a904def
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 10:40:17 2015 +0200

      qapi-types: Drop unused members parameters

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4f3568002393380558705397bda4cd5f224ffe29
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 08:32:51 2015 +0200

      qapi-types: Don't filter out expressions with 'gen'

      Useless, because it can only occur in commands, and we're not dealing
      with commands here.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f9a1427361fe06ac67480d580412dc4ed6f5d03b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 13:07:43 2015 +0200

      qapi: Catch and reject flat union branch of array type

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 75276710ae0a9f802a9774a8d845a2c84f89305a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 13:03:04 2015 +0200

      tests/qapi-schema: New flat union array branch test case

      The new test demonstrates another generator crash.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 00e4b285a31d19dcd88bd46729c9e09bfc9cc7fd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 10:04:36 2015 +0200

      qapi: Better separate the different kinds of helpers

      Insert comments to separate sections dealing with parsing, semantic
      analysis, code generation, and so forth.

      Move helpers to their proper section.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4d076d67c2c74662db092ecf4f99600b18209b2e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 08:55:21 2015 +0200

      qapi: Move exprs checking from parse_schema() to check_exprs()

      To have expression semantic analysis in one place rather than two.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e565d934d21e3544b820cd03b88061e71ab644a0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jun 10 08:24:58 2015 +0200

      qapi: Fix to reject stray 't', 'f' and 'n'

      Screwed up in commit e53188a.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a1366087270b312d94ff8c4031395a4218f160d4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:54:09 2015 +0200

      qapi: Simplify inclusion cycle detection

      We maintain a stack of filenames in include_hist for convenient cycle
      detection.

      As error_path() demonstrates, the same information is readily
      available in the expr_info, so just use that, and drop include_hist.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8608d2525186062099a38971c276752e7a38903a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 18:32:29 2015 +0200

      qapi: Fix file name in error messages for included files

      We print the name as it appears in the include expression.  Tools
      processing error messages want it relative to the working directory.
      Make it so.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 54414047eca5bee7d5ba6e7af5fb251f8635896c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:22:45 2015 +0200

      qapi: Improve a couple of confusing variable names

      old name      new name
      ----------------------------
      input_file    fname
      input_relname fname
      input_fname   abs_fname
      include_path  incl_abs_fname
      parent_info   incl_info

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12c707944927b8aa42752198dcf419a0bafe5d33
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 16:49:13 2015 +0200

      qapi: Eliminate superfluous QAPISchema attribute input_dir

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 836c3b01d2630192d6f5a941ca073bc8d650574b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 9 14:38:58 2015 +0200

      qapi: Drop bogus command from docs

      Commit 87a560c4 added it in the wrong place.  Commit 59a2c4ce added it
      in the right place, but didn't remove it from the wrong place.  Do
      that now.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 0311c5bde313c9ffcda2a198bd7cc70ae130d973
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Jun 12 15:15:54 2015 +0200

      MAINTAINERS: Fix up QAPI and QAPI schema file patterns

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1b58f5a7f6fbe811cc486cd5786483bad5d51bbf
  Merge: e207527 a3122b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 18 11:36:42 2015 +0100

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

      Update OpenBIOS images

      # gpg: Signature made Wed Jun 17 20:06:06 2015 BST using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-openbios-signed:
        Update OpenBIOS images

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e20752775197d3606c50703422d2c5d53ecf54bb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Jun 17 13:35:00 2015 +0100

      vfio: fix build error on CentOS 5.7

      Include linux/vfio.h after sys/ioctl.h, just like in hw/vfio/common.c.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Message-id: 1434544500-22405-1-git-send-email-leon.alrae@imgtec.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3122b681aee8a41268c610ca3a5e7a066a9091a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Wed Jun 17 20:02:15 2015 +0100

      Update OpenBIOS images

      Update OpenBIOS images to SVN r1340 built from submodule.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit c80cd6bb9c20ef518c56319ce44d2971171e677d
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:44 2015 +0200

      tap: add VNET_LE/VNET_BE operations

      The linux tap and macvtap backends can be told to parse vnet headers
      according to little or big endian. This is done through the TUNSETVNETLE
      and TUNSETVNETBE ioctls.

      This patch brings all the plumbing for QEMU to use these APIs.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 04b7a1523d65bb5c78832098cf3108a1aadcaf8a
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:39 2015 +0200

      vhost: set vring endianness for legacy virtio

      Legacy virtio is native endian: if the guest and host endianness differ,
      we have to tell vhost so it can swap bytes where appropriate. This is
      done through a vhost ring ioctl.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 41d283bdab08868a244b9c19dce507fdf15a8990
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:34 2015 +0200

      virtio: introduce virtio_legacy_is_cross_endian()

      This helper will be used by vhost and tap to detect cross-endianness in
      the legacy virtio case.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 332f64073bddc9240cd572f64682a44572b67049
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Wed Jun 17 15:23:29 2015 +0200

      linux-headers: sync vhost.h

      This patch brings the cross-endian vhost API to QEMU.

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 06b008d941fd3e9684d38a9b3181a1cf301c78d1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:19 2015 +0800

      tests: virtio-scsi: Move start/stop to individual test functions

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bea2f0982b335c13448dbde8a409107764fa8b59
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:18 2015 +0800

      libqos: Complete virtio device ID definition list

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 28452758c405e16d9890c44d6031d44233e8cb38
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:17 2015 +0800

      libqos: Allow calling guest_free on NULL pointer

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ebe7d8b166c59b029521f8d95db011e5e0fc649d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 24 19:35:16 2015 +0800

      tests: Link libqos virtio object to virtio-scsi-test

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d4862a87e31a51de9eb260f25c9e99a75efe3235
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Wed Jun 17 12:46:11 2015 +0200

      i8254: fix out-of-bounds memory access in pit_ioport_read()

      Due converting PIO to the new memory read/write api we no longer provide
      separate I/O region lenghts for read and write operations. As a result,
      reading from PIT Mode/Command register will end with accessing
      pit->channels with invalid index.

      Fix this by ignoring read from the Mode/Command register.

      This is CVE-2015-3214.

      Reported-by: Matt Tait <matttait@google.com>
      Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9dacf32d2cbd66cbcce7944ebdfd6b2df20e33b8
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:40 2015 +0300

      qemu-ga: Building Windows MSI installation with configure/Makefile

      New options were added to enable Windows MSI installation package
      creation:

      Option --enable-guest-agent-msi, like the name suggests, enables building
      Windows MSI package for QEMU guest agent; option --disable-guest-agent-msi
      disables MSI package creation; by default, no MSI package is created

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-5-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66ae13bb9eb2b16b59698e992bfcea61563b9d78
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:39 2015 +0300

      qemu-ga: Introduce Windows MSI script

      The script enables building Windows MSI installation package on Linux with wixl tool.

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-4-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c69403fcd4a0cb89f838a212ab71e4a1a3464c95
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:38 2015 +0300

      qemu-ga: debug printouts to help troubleshoot installation

      Debug printouts extended, helps installation troubleshooting

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-3-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5e031072e71eebab3d7d2ea4609e84bc928d893e
  Author: Yossi Hindin <yhindin@redhat.com>
  Date:   Wed May 6 14:57:37 2015 +0300

      qemu-ga: adding vss-[un]install options

      Existing command line options include '-s install' and '-s uninstall'.
      These options install/uninstall both Windows QEMU GA service
      and optional VSS COM server. The QEMU GA Windows service allows
      always-on serving guest agent's QMP commands and VSS COM server
      enables guest agent integration with Volume Shadow Service.

      This commit introdices new options '-s vss-install' and '-s vss-uninstall',
      affecting only GA VSS COM server registration. The new options are useful
      for registering and unregistering the COM server during MSI installation,
      upgrade and uninstallation.

      Signed-off-by: Yossi Hindin <yhindin@redhat.com>
      Message-Id: <1430913460-13174-2-git-send-email-yhindin@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 67633bb4f7743be2cb2e70b61e482ab92bf1724e
  Author: Pranith Kumar <bobby.prani@gmail.com>
  Date:   Wed Jun 10 10:20:24 2015 -0400

      qemu-log: Open file for logging when specified

      qemu-log defaults to stderr when there is no '-D' option mentioned on command
      line. When '-D' option is specified, we also need to specify '-d' option for it
      to use the specified logfile. When using monitor to enable logging this is
      troublesome since there will be no '-d' option because of which monitor dumps
      the logs to stderr.

      Fix this by opening the log file when '-D' is specified on the command line.
      Also fix an ancient comment which does not hold true since changing location and
      log level has now been streamlined.

      Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      CC: Luiz Capitulino <lcapitulino@redhat.com>
      CC: Markus Armbruster <armbru@redhat.com>
      CC: Peter Maydell <peter.maydell@linaro.org>
      Message-Id: <1433946024-18439-1-git-send-email-bobby.prani@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f754c3c9cce3c4789733d9068394be4256dfe6a8
  Merge: a09f4a9 1f68f1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 12:43:26 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-06-17

      This is a special one. Two awesome features in one pull request:

        - CCW support for TCG
        - Watchpoint support for TCG

      To celebrate this, we also switch the default machine model from s390-virtio
      to s390-ccw and give users a fully working s390x model again!

      # gpg: Signature made Wed Jun 17 11:42:26 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream: (26 commits)
        s390x: Switch to s390-ccw machine as default
        target-s390x: PER: add Breaking-Event-Address register
        target-s390x: PER instruction-fetch nullification event support
        target-s390x: PER store-using-real-address event support
        target-s390x: PER storage-alteration event support
        translate-all: fix watchpoints if retranslation not possible
        target-s390x: PER instruction-fetch event support
        target-s390x: PER successful-branching event support
        target-s390x: basic PER event handling
        target-s390x: add get_per_in_range function
        target-s390x: add get_per_atmid function
        target-s390x: add PER related constants
        target-s390x: mvc_fast_memmove: access memory through softmmu
        target-s390x: mvc_fast_memset: access memory through softmmu
        target-s390x: function to adjust the length wrt page boundary
        softmmu: provide tlb_vaddr_to_host function for user mode
        target-s390x: wire up I/O instructions in TCG mode
        target-s390x: wire up DIAG REIPL in TCG mode
        target-s390x: wire up DIAG IPL in TCG mode
        target-s390x: fix s390_cpu_initial_reset
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1f68f1d36c3af09ed31a529ad69c3d09880d10fd
  Author: Alexander Graf <agraf@suse.de>
  Date:   Tue Jun 16 23:06:33 2015 +0200

      s390x: Switch to s390-ccw machine as default

      We now finally have TCG support for the basic set of instructions necessary
      to run the s390-ccw machine. That means in any aspect possible that machine
      type is now superior to the legacy s390-virtio machine.

      Switch over to the ccw machine as default. That way people don't get a halfway
      broken machine with the s390x target.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 3da0ab35292fe93640cfdd95aa8bedec8f145d2c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:03 2015 +0200

      target-s390x: PER: add Breaking-Event-Address register

      This patch adds support for PER Breaking-Event-Address register. Like
      real hardware, it save the current PSW address when the PSW address is
      changed by an instruction. We have to take care of optimizations QEMU
      does, a branch to the next instruction is still a branch.

      This register is copied to low core memory when a program exception
      happens.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 83bb161299c019e25a3add59504f0b69e6257dcd
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:02 2015 +0200

      target-s390x: PER instruction-fetch nullification event support

      For the instruction-fetch nullification event, we just reuse the
      existing instruction-fetch code and trigger the exception immediately
      in that case.

      There is no need to save the CPU state in the TCG code as it has been
      saved by the previous instruction before calling the per_check_exception
      helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2f54394997bfc808bbfbebb2d8294edd17d63808
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:01 2015 +0200

      target-s390x: PER store-using-real-address event support

      This PER event happens each time the STURA or STURG instructions are
      used. As they use helpers, we can just save the event in the PER code
      there, if enabled.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 311918b979c5364c30392c1054ed77d047a83953
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:46:00 2015 +0200

      target-s390x: PER storage-alteration event support

      For the PER storage-alteration event we can use the QEMU watchpoint
      infrastructure. When PER is enabled or PER control register changed we
      enable the corresponding watchpoints. When a watchpoint arises we can
      save the event. Unfortunately the current code does not provide the
      address space used to trigger the watchpoint. For now we assume it comes
      from the default ASC.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8d302e76755b8157373073d7107e31b0b13f80c1
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:59 2015 +0200

      translate-all: fix watchpoints if retranslation not possible

      The tb_check_watchpoint function currently assumes that all memory
      access is done either directly through the TCG code or through an
      helper which knows its return address. This is obviously wrong as the
      helpers use cpu_ldxx/stxx_data functions to access the memory.

      Instead of aborting in that case, don't try to retranslate the code, but
      assume that the CPU state (and especially the program counter) has been
      saved before calling the helper. Then invalidate the TB based on this
      address.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f0e0d817c22539cd2ce1bcb5487e076f117b04c0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:58 2015 +0200

      target-s390x: PER instruction-fetch event support

      For the PER instruction-fetch, we can't use the QEMU breakpoint
      infrastructure as it triggers for a single address and not a full
      address range, and as it actually stop before the instruction and
      not before.

      We therefore call an helper with the just fetched instruction address,
      which check if the address is within the PER address range. If it is
      the case, an event is recorded and will be signaled through an
      exception.

      Note that we implement here the PER-3 behaviour, that is an invalid
      opcode is not considered as an instruction fetch. Without PER-3 this
      behavious is undefined.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2c2275eb41c612df4bd115cf71d6e651d105f69c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:57 2015 +0200

      target-s390x: PER successful-branching event support

      For the PER successful-branching event support, we can't rely on any
      QEMU infrastucture. We therefore call an helper in all places where
      a branch can be taken. We have to pay attention to the branch to next
      case, as it's still a taken branch.

      We don't need to care about the cases using goto_tb, as we have disabled
      them in the previous patch.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 777c98c32ce577a9671b9267ff6e2802f69ebafd
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:56 2015 +0200

      target-s390x: basic PER event handling

      This patch add basic support to generate PER exceptions. It adds two
      fields to the cpu structure to record for the PER address and PER
      code & ATMID values. When an exception is triggered and a PER event is
      pending, the two PER values are copied to the lowcore area.

      At the end of an instruction, an helper is checking for a possible
      pending PER event and triggers an exception in that case. For that to
      work with branches, we need to disable TB chaining when PER is
      activated. Fortunately it's already in the TB flags.

      Finally in case of a SERVICE CALL exception, we need to trigger the PER
      exception immediately after.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d453d103831c966e7920f146eb3416e43b588f89
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:55 2015 +0200

      target-s390x: add get_per_in_range function

      This function checks if an address is in between the PER starting
      address and the PER ending address, taking care of a possible
      address range loop.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a8f931a931f8866abdb2f836d0fb6fb7d2606645
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:54 2015 +0200

      target-s390x: add get_per_atmid function

      This function returns the ATMID field that is stored in the
      per_perc_atmid lowcore entry.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fb01bf4c6b86d9ac00ea87d60f97871ee1488188
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:53 2015 +0200

      target-s390x: add PER related constants

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6da528d14de29138ca5ac43d6d059889dd24f464
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:52 2015 +0200

      target-s390x: mvc_fast_memmove: access memory through softmmu

      mvc_fast_memmove is bypassing the softmmu functions, getting the
      physical source and destination addresses using the mmu_translate
      function and accessing the corresponding physical memory. This
      prevents watchpoints to work correctly.

      Instead use the tlb_vaddr_to_host function to get the host addresses
      corresponding to the guest source and destination addresses through the
      softmmu code and fallback to the byte level code in case the
      corresponding address are not in the QEMU TLB or being examined through
      a watchpoint. As a bonus it works even for area crossing pages by
      splitting the are into chunks contained in a single page, bringing some
      performances improvements. We can therefore remove the 8-byte
      loads/stores method, as it is now quite unlikely to be used.

      At the same time change the name of the function to fast_memmove as it's
      not specific to mvc and use the same argument order as the C memmove
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fc89efe693278c79273f3bbf6b581e8a749c85b0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:51 2015 +0200

      target-s390x: mvc_fast_memset: access memory through softmmu

      mvc_fast_memset is bypassing the softmmu functions, getting the
      physical address using the mmu_translate function and accessing the
      corresponding physical memory. This prevents watchpoints to work
      correctly.

      Instead use the tlb_vaddr_to_host function to get the host address
      corresponding to the guest address through the softmmu code and fallback
      to the byte level code in case the corresponding address is not in the
      QEMU TLB or being examined through a watchpoint. As a bonus it works
      even for area crossing pages by splitting the are into chunks contained
      in a single page, bringing some performances improvements.

      At the same time change the name of the function to fast_memset as it's
      not specific to mvc and use the same argument order as the C memset
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d7ce6b7a0ba4328a286d09d96395a8fc2fd6943c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:50 2015 +0200

      target-s390x: function to adjust the length wrt page boundary

      This patch adds a function to adjust the length of a transfer so that
      it doesn't cross a page boundary in softmmu mode. It does nothing in
      user mode.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2e83c496261c799b0fe6b8e18ac80cdc0a5c97ce
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 13 00:45:49 2015 +0200

      softmmu: provide tlb_vaddr_to_host function for user mode

      To avoid to many #ifdef in target code, provide a tlb_vaddr_to_host for
      both user and softmmu modes. In the first case the function always
      succeed and just call the g2h function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ad8a4570add09a7635cb8cd1c9327640521ee7a7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Jun 15 17:57:09 2015 +0200

      target-s390x: wire up I/O instructions in TCG mode

      The code handling the I/O instructions for KVM decodes the instruction
      itself. In TCG mode also pass the full instruction word to the helpers.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2ecacb0b4b6c73af424b7b4389fa55809368a98b
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:08 2015 +0200

      target-s390x: wire up DIAG REIPL in TCG mode

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8df7eef3059394bd53cdf7609aac9a50a78aa030
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:07 2015 +0200

      target-s390x: wire up DIAG IPL in TCG mode

      DIAG IPL is already implemented for KVM, but not wired from TCG. For
      that change the format of the instruction so that we can get R1 and R3
      numbers in addition to the function code.

      The diag function can change plenty of things, including CC, so we
      should enter with a static CC. Also it doesn't set the value of general
      register 2 to 0 as in the current code. We also need to exit the CPU
      loop after a reset, which means a new PSW.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cbed0ba78f04ce9e2e718431f64eb4b621288aca
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:06 2015 +0200

      target-s390x: fix s390_cpu_initial_reset

      The s390_cpu_initial_reset function zeroes a big part of the CPU state
      structure, including CPU_COMMON, and thus the QEMU TLB structure. As
      they should not be initialized with zeroes only, we need to call the
      tlb_flush to initialize it correctly.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cc0d079d4582ee0ed97b5e3e3da4f6cb2b5bd67f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:05 2015 +0200

      target-s390x: initialize I/O interrupt queue

      env->io_index[] should be set to -1 during CPU reset to mark the
      I/O interrupt queue as empty.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7107e5a756317151666d47d1bc1e170293babaff
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:04 2015 +0200

      target-s390x: correctly initialize ext interrupt queue

      env->ext_index should be initialized to -1 to mark the external
      interrupt queue as emtpy. This should not be done in s390_cpu_initfn
      as all the interrupt fields are later reset to 0 by the memset in
      s390_cpu_initial_reset or s390_cpu_full_reset. Move the initialization
      there.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 06e3c077daa08c0a616e9507eb737401883ab645
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:03 2015 +0200

      target-s390x: fix setcc in TCG mode

      In TCG mode we should store the CC value in env->cc_op. However do it
      inconditionnaly because:
      - the tcg_enabled function is not inlined
      - it's probably faster to always store the value, especially given it
        is likely in the same cache line than env->psw.mask.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a499973ff32bc58f2db7b88ad5597ffdbc2becd7
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:02 2015 +0200

      virtio-ccw: disable ioevent bit when ioeventfds are not enabled

      This remove the corresponding error messages in TCG mode, and allow to
      simplify the s390_assign_subch_ioeventfd() function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d49f4ab48ec76e590ad72a2d6c3fba8459d3ded7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Jun 15 17:57:01 2015 +0200

      s390/ioinst: fix endianness in ioinst_schib_valid

      The ioinst_schib_valid gets a SCHIB in guest endianness, we should
      byteswap the fields we access.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ae52e585bf5e9678a77be033fd4b430a2e78dfed
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 17:57:00 2015 +0200

      s390/ioinst: fix IO_INT_WORD_ISC macro

      The I/O-Interruption Subclass field corresponds to bits 2 to 5 (BE
      notation) of the Interruption-Identification Word. The value should
      be shift by 27 instead of 24.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a09f4a9d19c500ea5cbcdc0bd7f0d540cf54f9f5
  Merge: 8c29f8d f3bcd42
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 11:12:35 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-seabios-1.8.2-20150617-1' into staging

      update seabios to release 1.8.2
      add vgabios for virtio-vga

      # gpg: Signature made Wed Jun 17 08:34:22 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-seabios-1.8.2-20150617-1:
        update seabios and vgabios binaries
        tag our seabios builds
        update seabios submodule to release 1.8.2

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8c29f8d6b9595ac0f9ab1b41f22e91aebab482d7
  Merge: 93f6d1c f8d30a4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 17 10:13:40 2015 +0100

      Merge remote-tracking branch 'remotes/kvaneesh/tags/for-upstream-signed' into staging

      VirtFS update:

      * Fix for virtfs-proxy-helper crash
      * Gracefully handle the error condition on input validation in virtfs-proxy-helper

      # gpg: Signature made Tue Jun 16 16:21:28 2015 BST using RSA key ID 04C4E23A
      # gpg: Good signature from "Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 4846 9DE7 1860 360F A6E9  968C DE41 A4FE 04C4 E23A

      * remotes/kvaneesh/tags/for-upstream-signed:
        virtfs-proxy-helper: fail gracefully if socket path is too long
        virtfs-proxy-helper: add missing long option terminator

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3bcd42683dcc48c576281399d6cf6b34da6ba41
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:28:03 2015 +0200

      update seabios and vgabios binaries

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7edf2f0ec4edbde50be3b54306adf5b8b16ca68b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:24:55 2015 +0200

      tag our seabios builds

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 10500ce26069b7c4746e8a2276aa03220a29581c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 17 09:11:47 2015 +0200

      update seabios submodule to release 1.8.2

      git shortlog rel-1.8.1..rel-1.8.2
      =================================

      Gerd Hoffmann (1):
            vga: rework virtio-vga support

      Kevin O'Connor (5):
            vgabios: Add config option for assembler fixups
            vgabios: Emulate "leal" instruction
            build: Support "make VERSION=xyz" to override the default build version
            build: CONFIG_VGA_FIXUP_ASM should depend on CONFIG_BUILD_VGABIOS
            vgabios: On bda_save_restore() the saved vbe_mode also has flags in it

      Paolo Bonzini (1):
            smm: ignore bits 16,18-31 of SMM revision ID

      Vladimir Serbinenko (1):
            ahci: Ignore max_ports.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f8d30a4f96d6c3a12e692d2e69b8fe4734b916c6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 30 14:57:16 2015 +0100

      virtfs-proxy-helper: fail gracefully if socket path is too long

      Replace the assertion check with graceful failure when the socket path
      is too long.  Programs should not crash on invalid input.  Print an
      error message and exit properly.

      Cc: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit bf6667d63ef4c4fbaf91051589a594ec1c235308
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 30 14:57:15 2015 +0100

      virtfs-proxy-helper: add missing long option terminator

      The getopt_long(3) long options array must have a zeroed terminator.

      This patch solves a segmentation fault when an unknown command-line
      option is encountered:

        $ fsdev/virtfs-proxy-helper --help
        Segmentation fault (core dumped)

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 93f6d1c16036aaf34055d16f54ea770fb8d6d280
  Merge: 4316536 7a4dfd1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 16 10:35:43 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150615-1' into staging

      virtio-gpu: pci support bits and virtio-vga.

      # gpg: Signature made Mon Jun 15 13:55:19 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150615-1:
        virtio-vga: add vgabios configuration
        virtio-vga: add '-vga virtio' support
        virtio-vga: add virtio gpu device with vga compatibility
        virtio-gpu-pci: add virtio pci support
        virtio-gpu: fix error message

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4316536bf424d2e7f9cfa7d0dd561adb0986cc81
  Merge: 1dfe73b 45c874e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 16 09:07:22 2015 +0100

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150616' into staging

      linux-user patches for 2.4 softfreeze
      second spin with ioctl patch refreshed

      # gpg: Signature made Tue Jun 16 08:03:14 2015 BST using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150616:
        linux-user: ioctl() command type is int
        linux-user: fix the breakpoint inheritance in spawned threads
        linux-user: use __get_user and __put_user in cmsg conversions
        linux-user: Fix length handling in host_to_target_cmsg
        linux-user: Use abi_ulong for TARGET_ELF_PAGESTART
        linux-user: Allocate thunk size dynamically

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 45c874ebbae661238bfa3c0534480ebe2940b112
  Author: Laurent Vivier <laurent@vivier.eu>
  Date:   Tue Jun 16 00:35:28 2015 +0200

      linux-user: ioctl() command type is int

      When executing a 64bit target chroot on 64bit host,
      the ioctl() command can mismatch.

      It seems the previous commit doesn't solve the problem in
      my case:

          9c6bf9c7 linux-user: Fix ioctl cmd type mismatch on 64-bit targets

      For example, a ppc64 chroot on an x86_64 host:

      bash-4.3# ls
      Unsupported ioctl: cmd=0x80087467
      Unsupported ioctl: cmd=0x802c7415

      The origin of the problem is in syscall.c:do_ioctl().

          static abi_long do_ioctl(int fd, abi_long cmd, abi_long arg)

      In this case (ppc64) abi_long is long (on the x86_64), and

          cmd = 0x0000000080087467

      then
          if (ie->target_cmd == cmd)

      target_cmd is int, so target_cmd = 0x80087467
      and to compare an int with a long, the sign is extended to 64bit,
      so the comparison is:

          if (0xffffffff80087467 == 0x0000000080087467)

      which doesn't match whereas it should.

      This patch uses int in the case of the target command type
      instead of abi_long.

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1d085f6cae51b1a0fb92ad03ce8bf038e29c9750
  Author: Thierry Bultel <thierry.bultel@basystemes.fr>
  Date:   Fri Jun 12 11:24:10 2015 +0200

      linux-user: fix the breakpoint inheritance in spawned threads

      When a thread is spawned, cpu_copy re-initializes
      the bp & wp lists of current thread, instead of the ones
      of the new thread.
      The effect is that breakpoints are no longer hit.

      Signed-off-by: Thierry Bultel <thierry.bultel@basystemes.fr>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 876e23cb2e545148a0ee4effda5c63c861855941
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 19:46:32 2015 +0100

      linux-user: use __get_user and __put_user in cmsg conversions

      The target payloads in cmsg conversions may not have the alignment
      required by the host. Using the get_user and put_user functions is
      the easiest way to handle this and also do the byte-swapping we
      require.

      (Note that prior to this commit target_to_host_cmsg was incorrectly
      using __put_user() rather than __get_user() for the SCM_CREDENTIALS
      conversion, which meant it wasn't getting the benefit of the
      misalignment handling.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit c2aeb2586bd258ad76fcfe308f883075e73ff1d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 19:46:31 2015 +0100

      linux-user: Fix length handling in host_to_target_cmsg

      The previous code for handling payload length when converting
      cmsg structures from host to target had a number of problems:
       * we required the msg->msg_controllen to declare the buffer
         to have enough space for final trailing padding (we were
         checking against CMSG_SPACE), whereas the kernel does not
         require this, and common userspace code assumes this. (In
         particular, glibc's "try to talk to nscd" code that it will
         run on startup will receive a cmsg with a 4 byte payload and
         only allocate 4 bytes for it, which was causing us to do
         the wrong thing on architectures that need 8-alignment.)
       * we weren't correctly handling the fact that the SO_TIMESTAMP
         payload may be larger for the target than the host
       * we weren't marking the messages with MSG_CTRUNC when we did
         need to truncate a message that wasn't truncated by the host,
         but were instead logging a QEMU message; since truncation is
         always the result of a guest giving us an insufficiently
         sized buffer, we should report it to the guest as the kernel
         does and don't log anything

      Rewrite the parts of the function that deal with length to
      fix these issues, and add a comment in target_to_host_cmsg
      to explain why the overflow logging it does is a QEMU bug,
      not a guest issue.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1dfe73b94de5a75038a725b17dc7d08a23a977ec
  Merge: b500e4d f264d51
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:43:09 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150615' into staging

      target-arm queue:
       * Handle "extended small page" descriptors correctly
       * Use extended address bits from supersection short descriptors
       * Update interrupt status for all cores in gic_update
       * Fix off-by-one in exynos4210_fimd bit-swap code
       * Remove stray unused 'pending_exception' field
       * Add Cortex-A53 KVM support
       * Fix reset value of REVIDR
       * Add AArch32 MIDR aliases for ARMv8 cores
       * MAINTAINERS update for ARM ACPI code
       * Trust the kernel's value of MPIDR if we're using KVM
       * Various pxa2xx device updates to avoid old APIs
       * Mark pxa2xx copro registers as ARM_CP_IO so -icount works
       * Correctly UNDEF Thumb2 DSP insns on Cortex-M3
       * Initial work towards implementing PMSAv7
       * Fix a reset order bug introduced recently
       * Correct "preferred return address" for cpreg access exceptions
       * Add ACPI SPCR table for the virt board

      # gpg: Signature made Mon Jun 15 18:19:34 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150615: (28 commits)
        hw/arm/virt-acpi-build: Add SPCR table
        ACPI: Add definitions for the SPCR table
        target-arm: Correct "preferred return address" for cpreg access exceptions
        hw/arm/boot: fix rom_reset notifier registration order
        arm: helper: rename get_phys_addr_mpu
        arm: Add has-mpu property
        arm: Implement uniprocessor with MP config
        arm: Refactor get_phys_addr FSR return mechanism
        arm: helper: Factor out CP regs common to [pv]msa
        arm: Don't add v7mp registers in MPU systems
        arm: Do not define TLBTR in PMSA systems
        target-arm: Add the THUMB_DSP feature
        hw/sd/pxa2xx_mmci: Stop using old_mmio in MemoryRegionOps
        hw/arm/pxa2xx: Convert pxa2xx-ssp to VMState
        hw/arm/pxa2xx: Add reset method for pxa2xx_ssp
        hw/arm/pxa2xx: Convert pxa2xx-fir to QOM and VMState
        hw/arm/pxa2xx: Mark coprocessor registers as ARM_CP_IO
        target-arm: Use the kernel's idea of MPIDR if we're using KVM
        MAINTAINERS: Add myself as ARM ACPI Subsystem maintainer
        target-arm: add AArch32 MIDR aliases in ARMv8
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f264d51d8ad939d7fb339d61a8cf680ed0cb21a2
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      hw/arm/virt-acpi-build: Add SPCR table

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433929959-29530-3-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b8a0d75ef85b8f24c92a6c50817fa9579b4a98d9
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      ACPI: Add definitions for the SPCR table

      SPCR is the Serial Port Console Redirection Table. See the document
      linked from http://uefi.org/acpi. For serial port types, "Interface
      Type", see the documentation for the Debug Port Table 2 (DBG2).

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1433929959-29530-2-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3977ee5d7a9f2e3664dd8b233f3224694e23b62b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      target-arm: Correct "preferred return address" for cpreg access exceptions

      The architecture defines that when taking an exception trying to
      access a coprocessor register, the "preferred return address" for
      the exception is the address of the instruction that caused the
      exception. Correct an off-by-4 error which meant we were returning
      the address after the instruction for traps which happened because
      of a failure of a runtime access-check function on an AArch32
      register. (Traps caused by translate-time checkable permissions
      failures had the correct address, as did traps on AArch64 registers.)

      This fixes https://bugs.launchpad.net/qemu/+bug/1463338

      Reported-by: Robert Buhren <robert@robertbuhren.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433861440-30133-1-git-send-email-peter.maydell@linaro.org

  commit 63a183ed0eac2956574745c84faffa042d99afb8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 15 18:06:11 2015 +0100

      hw/arm/boot: fix rom_reset notifier registration order

      commit ac9d32e39664e060cd1b538ff190980d57ad69e4 had the consequence to
      register the do_cpu_reset after the rom_reset one. Hence they get
      executed in the wrong order. This commit restores the registration of
      do_cpu_reset in arm_load_kernel.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reported-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434111582-9325-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13689d43646482f7305282de1bdd662c0d2b8b77
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: helper: rename get_phys_addr_mpu

      This get_phys_addr is really for pmsav5. Rename it accordingly.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: bf4b019aa87d682a45998105ef8e4d4e97a5e117.1434066412.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f325f568fbd0158cd413e7d637573ba90b3eaab
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Add has-mpu property

      For processors that support MPUs, add a property to de-feature it. This
      is similar to the implementation of the EL3 feature.

      The processor definition in init sets ARM_FEATURE_MPU if it can support
      an MPU. post_init exposes the property, defaulting to true. If cleared
      by the instantiator, ARM_FEATURE_MPU is then removed at realize time.

      This is to support R profile processors that may or may-not have an MPU
      configured.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 632918cc48786e868ea18aa6bd12f70597994cad.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8e81b319d1ae1224cc7059877dcdf04a5aad59d
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Implement uniprocessor with MP config

      Add a boolean for indicating uniprocessors with MP extensions. This
      drives the U bit in MPIDR. Prepares support for Cortex-R5.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a70a80583df265e0174f01fa1fc92b33ea6d1db5.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7cc4e82f04a1c5b218a657f677a2fdd1e1c2889
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Refactor get_phys_addr FSR return mechanism

      Currently, the return code for get_phys_addr is overloaded for both
      success/fail and FSR value return. This doesn't handle the case where
      there is an error with a 0 FSR. This case exists in PMSAv7.

      So rework get_phys_addr and friends to return a success/failure boolean
      return code and populate the FSR via a caller provided uint32_t
      pointer.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a209e3d8ae00cda55260c970891f520210e26bad.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8e5d75c950a1241f6e1243c37f28cd58f68fedc9
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: helper: Factor out CP regs common to [pv]msa

      V6+ PMSA and VMSA share some common registers that are currently
      in the VMSA definition block. Split them out into a new def that can
      be shared to PMSA.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 284db78a43c63c9bfbb60de539672c361bcb6af8.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e5cf9e35f25f9f932a6ce25107c11b67b426a43
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Don't add v7mp registers in MPU systems

      These registers are VMSA specific so they should be conditional on
      VMSA (i.e. !MPU).

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 7bb8843e45f2635c6b7a583c5bb5da51ed4442a0.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8085ce63c5967d200f1241b6c0a189371993c5df
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Jun 15 18:06:10 2015 +0100

      arm: Do not define TLBTR in PMSA systems

      If doing a PMSA (MPU) system do not define the VMSA specific TLBTR CP.
      The def is done separately from VMSA registers group as it is affected
      by both the OMAP/STRONGARM RW errata and the MIDR backgrounding.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: b03fea3840207edf633f5c9189400c3dd6a28d14.1434066412.git.peter.crosthwaite@xilinx.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 62b44f059a84d1ac580a653fc4110dfabaef6b83
  Author: Aurelio C. Remonda <aurelioremonda@gmail.com>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      target-arm: Add the THUMB_DSP feature

      Create an ARM_FEATURE_THUMB_DSP controlling the Thumb encodings of
      the 85 DSP instructions (these are all Thumb2). This is enabled for
      all non-M-profile CPUs with Thumb2 support, as the instructions are
      mandatory for R and A profiles. On M profile they are optional and
      not present in the Cortex-M3 (though they are in the M4).

      The effect of this commit is that we will now treat the DSP
      encodings as illegal instructions on M3, when previously we
      incorrectly implemented them.

      Signed-off-by: Aurelio C. Remonda <aurelioremonda@gmail.com>
      Message-id: 1434311355-26554-1-git-send-email-aurelioremonda@gmail.com
      [PMM: added clz/crc32/crc32c and default case to the early-decode switch;
       minor format/spacing fixups; reworded commit message a bit]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13e1e476b4bc111d36fffaea025f90d8db52b697
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/sd/pxa2xx_mmci: Stop using old_mmio in MemoryRegionOps

      Update the pxa2xx_mmci device to stop using the old_mmio read
      and write callbacks in its MemoryRegionOps. This actually
      simplifies the code because the separate byte/halfword/word
      access functions were all calling into a single function to
      do the work anyway.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-6-git-send-email-peter.maydell@linaro.org

  commit 8e079caf82c3658ee64bca37c91953b38296d427
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Convert pxa2xx-ssp to VMState

      The pxa2xx-ssp device is already a QOM device but is still
      using the old-style register_savevm(); convert to VMState.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-5-git-send-email-peter.maydell@linaro.org

  commit ce3203464bee89d2ae958717222981326a37775e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Add reset method for pxa2xx_ssp

      The pxa2xx_ssp device was missing a reset method; add one.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter..crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-4-git-send-email-peter.maydell@linaro.org

  commit 1fd9f2df241554b68b3a19ad1c94c475c7bb85ea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Convert pxa2xx-fir to QOM and VMState

      Convert the pxa2xx-fir device to QOM, including using a
      VMState for its migration info.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-3-git-send-email-peter.maydell@linaro.org

  commit 14c3032a7ebd5a354381465453c0c0690b7342d1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      hw/arm/pxa2xx: Mark coprocessor registers as ARM_CP_IO

      The pxa2xx custom coprocessor registers in cp6 and cp14 do device
      accesses, so mark the non-constant regs as ARM_CP_IO so that
      icount works correctly and doesn't abort.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1434117989-7367-2-git-send-email-peter.maydell@linaro.org

  commit eb5e1d3c85dffe677da2550d211f9304a7d5ba3b
  Author: Pavel Fedin <p.fedin@samsung.com>
  Date:   Mon Jun 15 18:06:09 2015 +0100

      target-arm: Use the kernel's idea of MPIDR if we're using KVM

      When we're using KVM, the kernel's internal idea of the MPIDR
      affinity fields must match the values we tell it for the guest
      vcpu cluster configuration in the device tree. Since at the moment
      the kernel doesn't support letting userspace tell it the correct
      affinity fields to use, we must read the kernel's view and
      reflect that back in the device tree.

      Signed-off-by: Shlomo Pongratz <shlomo.pongratz@huawei.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Message-id: 02f601d0a1e6$90c7d630$b2578290$@samsung.com
      [PMM: Use a local #define rather than a global variable for
       the TCG ARM_CPUS_PER_CLUSTER setting. Tweak a comment. Update the
       commit message.]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f4d260e70aff7c3796d97c78ba0663696e2d503
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      MAINTAINERS: Add myself as ARM ACPI Subsystem maintainer

      Add Shannon Zhao as the maintainer for the ARM ACPI Subsystem.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433248318-6076-1-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac00c79ff6635ae9fd732ff357ada0d05e795500
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm: add AArch32 MIDR aliases in ARMv8

      According to ARMv8 ARM, there are additional aliases to MIDR system register in
      AArch32 state. So add them to the list.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433321048-23793-3-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 13b72b2b9aa7ab7ee129e38e9587acd6a1b9a932
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm: Fix REVIDR reset value

      According to ARM Cortex-A53/A57 TRM, REVIDR reset value should be zero. So let
      REVIDR reset value be specified by CPU model and correct it for Cortex-A53/A57.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433321048-23793-2-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8772de2c53b44c75f18140646aa928e6d77cb9d8
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      hw/arm/virt: Add cortex-a53 cpu support in machine virt

      Add cortex-a53 cpu support in machine virt, so it can be used for TCG
      and KVM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1433207452-4512-3-git-send-email-shannon.zhao@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7525465e6def0ef878741087b36e4657016dce80
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm/kvm64: Add cortex-a53 cpu support

      Since commit e353102(target-arm: cpu64: Add support for Cortex-A53) has
      added Cortex-A53 cpu support for target-arm, this patch just enables it
      for kvm-arm.

      Here adding XGENE_POTENZA just makes the enum continuous.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1433207452-4512-2-git-send-email-shannon.zhao@linaro.org
      [PMM: Don't add the CPU types to cpus_to_try[]; this array only
       lists old CPUs which were supported in pre-PREFERRED_TARGET kernels]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a79e0218e0ae27c9cdd2648bd46e5a916c903cc2
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      target-arm/cpu.h: remove pending_exception

      This isn't used by any of the code. In fact it looks like it was never
      used as it came in with ARMv7 support.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1434020015-8868-1-git-send-email-alex.bennee@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 644ead5be1a851abff16886240c5c6fc1c5137c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:08 2015 +0100

      hw/display/exynos4210_fimd: Fix bit-swapping code

      fimd_swap_data() includes code to reverse the bits in a
      64-bit integer, but an off-by-one error meant that it would
      try to shift off the top of the integer. Correct the bug
      (spotted by Coverity).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1432912615-23107-1-git-send-email-peter.maydell@linaro.org

  commit 235069a380147e31236b94c31528fc5170c3a421
  Author: Johan Karlsson <Johan.Karlsson@enea.com>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      arm_gic: gic_update should always update all cores

      This patch fixes so that gic_update always updates all the cores with
      new pending irq states.  If the function returns early it is possible
      to get interrupts that has already been acknowledged.

      Signed-off-by: Johan Karlsson <johan.karlsson@enea.com>
      [PMM: rebased to apply to current master]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e42a6ca37e39e56725518851f4388e46bd91129
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      target-arm: use extended address bits from supersection short descriptor

      Since ARMv7 with LPAE support, a supersection short translation table
      descriptor has had extended base address fields which hold bits 39:32 of
      translated address. These fields are IMPDEF in ARMv6 and ARMv7 without
      LPAE support.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1433235718-30485-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc1891c74ae122a9dc7854f38bae7db03cd911e6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 18:06:07 2015 +0100

      target-arm: Handle "extended small page" descriptors correctly

      The old ARMv5-style page table format includes a kind of second level
      descriptor named the "extended small page" format, whose primary purpose
      is to allow specification of the TEX memory attribute bits on a 4K page.
      This exists on ARMv6 and also (as an implementation extension) on XScale
      CPUs; it's UNPREDICTABLE on v5.

      We were mishandling this in two ways:
       (1) we weren't implementing it for v6 (probably never noticed because
      Linux will use the new-style v6 page table format there)
       (2) we were not correctly setting the page_size, which is 4K, not 1K

      The latter bug went unnoticed for years because the only thing which
      the page_size affects is which TLB entries get flushed when the guest
      does a TLB invalidate on an address in the page, and prior to commit
      2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's
      habit of writing the SCTLR pointlessly a lot.

      (We can assume that after commit 2f0d8631b7 the bug went unnoticed
      for a year because nobody's actually using the Zaurus/XScale emulation...)

      Report the correct page size for these descriptors, and permit them
      on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus
      can boot the kernel OK but gets random segfaults when it tries to
      run userspace programs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1432844085-16441-1-git-send-email-peter.maydell@linaro.org

  commit b500e4db8e3e0b5f41a2dd14e2001200e5fc7d6b
  Merge: 46bca54 d95d7d8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 16:15:32 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-20150615-1' into staging

      audio: remove obsolete backends (esd, fmod, winwave).
      audio: stop using global variables, small fixes.
      audio: remove some obsolte and unused code.

      # gpg: Signature made Mon Jun 15 13:24:44 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-audio-20150615-1:
        ossaudio: use trace events instead of debug config flag
        alsaaudio: use trace events instead of verbose
        dsoundaudio: remove primary buffer
        dsoundaudio: remove *_retries kludges
        audio: remove plive
        audio: remove LOG_TO_MONITOR along with default_mon
        MAINTAINERS: remove malc from audio
        sdlaudio: do not allow multiple instances
        coreaudio: do not use global variables where possible
        dsoundaudio: do not use global variables
        paaudio: fix possible resource leak
        wavaudio: do not use global variables
        ossaudio: do not use global variables
        alsaaudio: do not use global variables
        paaudio: do not use global variables
        audio: expose drv_opaque to init_out and init_in
        only enable dsound in case the header file is present
        audio: remove winwave audio driver
        audio: remove fmod backend
        audio: remove esd backend

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a084ea39aec84d352dbd3de0f523daaaaac8c7d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 15 16:20:21 2015 +0200

      vhost-user: part of virtio

      vhost user is related to virtio, add it to the relevant entry.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 46bca5404b08201bb9df1ac32bc88fc7e6db1f74
  Merge: f3e3b08 8369e33
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 13:24:50 2015 +0100

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150615' into staging

      s390x/kvm/watchdog

      1. Implement a diag288 based watchdog
      2. Fix virtio-ccw BIOS for gcc >= 4.9

      # gpg: Signature made Mon Jun 15 12:36:25 2015 BST using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150615:
        s390/bios: build with -fdelete-null-pointer-checks
        watchdog: Add new Virtual Watchdog action INJECT-NMI
        nmi: Implement inject_nmi() for non-monitor context use
        s390x/watchdog: diag288 migration support
        s390x/kvm: diag288 instruction interception and handling
        s390x/watchdog: introduce diag288 watchdog device
        watchdog: change option wording to allow for more watchdogs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8369e339d24f365750da456588e742674c153437
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon Jun 15 12:24:03 2015 +0200

      s390/bios: build with -fdelete-null-pointer-checks

      Starting with version 4.9, GCC assumes it can't safely dereference null
      pointers, and uses this for some optimizations. On s390, the lowcore
      memory is located at address 0, so this assumption is wrong and breaks
      the s390-ccw firmware. Pass -fdelete-null-pointer-checks to avoid that.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1434363843-14576-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d95d7d802c33f6277c9fb967c14ae0cc99aeb072
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:07 2015 +0200

      ossaudio: use trace events instead of debug config flag

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fbb7ef56d55723a4996c288b50a16e6283eea13f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:06 2015 +0200

      alsaaudio: use trace events instead of verbose

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6dd35fd81e06d469b6f5280adee0a16ee383db57
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:05 2015 +0200

      dsoundaudio: remove primary buffer

      Enabling this option just creates a playback buffer with the specified settings,
      and then ignores it. It's probably some outdated hack to set audio formats on
      windows. (The first created stream dictates all other streams settings, at least
      on some Windows versions). Setting DAC_FIXED_SETTINGS should have the same
      effect as setting (the now removed) primary buffer.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2762955f723570944966347600b5746e7dd99388
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:04 2015 +0200

      dsoundaudio: remove *_retries kludges

      According to MSDN this may happen when the window is not in the foreground, but
      the default is 1 since a long time (which means no retries), so it should be ok.
      I've found no problems during testing it on Windows 7 and wine, so this was
      probably only the case with some old Windows versions.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 73ad33ef7ba0d1e7c7f276663f36c4f72b9193a9
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:03 2015 +0200

      audio: remove plive

      It was useless even 3 years ago, so it can probably safely go away:
      https://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg02427.html

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 06ac27f683c52890a6d174adba8c92354fa1eceb
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Fri Jun 12 14:33:02 2015 +0200

      audio: remove LOG_TO_MONITOR along with default_mon

      Setting QEMU_AUDIO_LOG_TO_MONITOR=1 can crash qemu (if qemu tries to log
      to the monitor before it's being initialized), and also nothing else in
      qemu logs to the monitor.

      This log to monitor feature was the last thing that used the default_mon
      variable, so I removed it too (as using it can cause problems).

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 65eb1e6b4c1c4f66deff9cdf9bfbdea267c59343
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 9 12:51:36 2015 +0200

      MAINTAINERS: remove malc from audio

      email bounces, with a appearently permanent error:
      "av1474@comtv.ru mail receiving disabled, rejecting"

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 81ebb07c56a28aa7ca47c38eb44690025a9dd6b9
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:55 2015 +0200

      sdlaudio: do not allow multiple instances

      Since SDL uses a lot of global data, we can't create independent
      instances of sdl audio backend.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d1f52a1d704de2252bc48c64ca4d46086cb249a2
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:54 2015 +0200

      coreaudio: do not use global variables where possible

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 191e1f0acd32360b917fa54a52389b97d9b52b6f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:52 2015 +0200

      dsoundaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49dd6d0d33e1a59b4055713079e64062bc5092b5
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:53 2015 +0200

      paaudio: fix possible resource leak

      qpa_audio_init did not clean up resources properly if the initialization
      failed. This hopefully fixes it.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f2dcc6cec285938967446d412b0477e02e26f3ca
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:51 2015 +0200

      wavaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4045a85ad1aadb1a56038ed3358e2093ba88f91f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:50 2015 +0200

      ossaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 765b37da3f2824afd45b38c038af44da42b956f6
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:48 2015 +0200

      alsaaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9a644c4b4dfc7ebe7994bfa568cbeaa1847ca5ff
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:49 2015 +0200

      paaudio: do not use global variables

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5706db1deb061ee9affdcea81e59c4c2cad7c41e
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:47 2015 +0200

      audio: expose drv_opaque to init_out and init_in

      Currently the opaque pointer returned by audio_driver's init is only
      exposed to the driver's fini, but not to audio_pcm_ops. This way if
      someone wants to share a variable with the driver and the pcm, he must
      use global variables. This patch fixes it by adding a third parameter to
      audio_pcm_op's init_out and init_in.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 307119e7d948bcdb5918fd762153deda471e695b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 10 09:07:35 2015 +0200

      only enable dsound in case the header file is present

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f3e3b083d4c266ea864ae3c83da49d4086857679
  Merge: 8aeaa05 67251a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 15 10:43:06 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer core and image format patches

      # gpg: Signature made Fri Jun 12 16:08:53 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (25 commits)
        block: Fix reopen flag inheritance
        block: Add BlockDriverState.inherits_from
        block: Add list of children to BlockDriverState
        queue.h: Add QLIST_FIX_HEAD_PTR()
        block: Drain requests before swapping nodes in bdrv_swap()
        block: Move flag inheritance to bdrv_open_inherit()
        block: Use QemuOpts in bdrv_open_common()
        block: Use macro for cache option names
        vmdk: Use bdrv_open_image()
        quorum: Use bdrv_open_image()
        check-qdict: Test cases for new functions
        qdict: Add qdict_{set,copy}_default()
        qdict: Add qdict_array_entries()
        iotests: Add tests for overriding BDRV_O_PROTOCOL
        block: driver should override flags in bdrv_open()
        block: Change bitmap truncate conditional to assertion
        block: record new size in bdrv_dirty_bitmap_truncate
        raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size
        vmdk: Use vmdk_find_index_in_cluster everywhere
        vmdk: Fix index_in_cluster calculation in vmdk_co_get_block_status
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3cec7cc22f95ce31565e8e2c03b06a2f7ae8bc6f
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:46 2015 +0200

      audio: remove winwave audio driver

      DirectSound should be a superior choice on Windows.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 14382605da6bda74516f275695bd3345bc54c464
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:45 2015 +0200

      audio: remove fmod backend

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0bac111167e33838fa869cacd16f92e5899252b3
  Author: Kővágó, Zoltán <dirty.ice.hu@gmail.com>
  Date:   Wed Jun 3 23:03:44 2015 +0200

      audio: remove esd backend

      ESD is no longer developed and replaced by PulseAudio.

      Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 79cb1f1d698da5e1e183863aa3c8a91b2e750664
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Apr 20 16:15:20 2015 +0100

      linux-user: Use abi_ulong for TARGET_ELF_PAGESTART

      TARGET_ELF_PAGESTART is required to use abi_ulong to correctly handle
      addresses for different target bits width.
      This patch fixes a problem when running a 64-bit user mode application
      on 32-bit host machines.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 8be656b87c6bb1b9f8af3ff78094413d71e4443a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed May 6 23:47:32 2015 +0200

      linux-user: Allocate thunk size dynamically

      We store all struct types in an array of static size without ever
      checking whether we overrun it. Of course some day someone (like me
      in another, ancient ALSA enabling patch set) will run into the limit
      without realizing it.

      So let's make the allocation dynamic. We already know the number of
      structs that we want to allocate, so we only need to pass the variable
      into the respective piece of code.

      Also, to ensure we don't accidently overwrite random memory, add some
      asserts to sanity check whether a thunk is actually part of our array.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 8aeaa055f5d3d4e87bf870892ba301eae57bdc1d
  Merge: 0a2df85 2db33f8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 18:04:14 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri Jun 12 15:57:47 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        qemu-iotests: expand test 093 to support group throttling
        throttle: Update throttle infrastructure copyright
        throttle: add the name of the ThrottleGroup to BlockDeviceInfo
        throttle: acquire the ThrottleGroup lock in bdrv_swap()
        throttle: Add throttle group support
        throttle: Add throttle group infrastructure tests
        throttle: Add throttle group infrastructure
        throttle: Extract timers from ThrottleState into a separate structure
        raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size
        Revert "iothread: release iothread around aio_poll"

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 67251a311371c4d22e803f151f47fe817175b6c3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 9 18:54:04 2015 +0200

      block: Fix reopen flag inheritance

      When reopening an image, the block layer already takes care to reopen
      bs->file as well with recalculated inherited flags. The same must happen
      for any other child (most notably missing before this patch: backing
      files).

      If bs->file (or any other child) didn't originally inherit from bs, e.g.
      because it was created separately and then only referenced, it must not
      inherit flags on reopen either, so check the inherited_from field before
      propagation the reopen down.

      VMDK already reopened its extents manually; this code can now be
      dropped.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bddcec3745b0220d4a7eda700950812a94398668
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 9 18:47:50 2015 +0200

      block: Add BlockDriverState.inherits_from

      Currently, the block layer assumes that any block node can have only one
      parent, and if it has a parent, that it inherits some options/flags from
      this parent.

      This is not true any more: With references used in block device
      creation, a single node can be used by multiple parents, or it can be
      created separately and not inherit flags from any parent.

      To handle reopens correctly, a node must know from which parent it
      inherited options. This patch adds the information to BlockDriverState.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 6e93e7c41fdfdee3068770cae79380e1d986b76a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Apr 8 13:49:41 2015 +0200

      block: Add list of children to BlockDriverState

      This allows iterating over all children of a given BDS, not only
      including bs->file and bs->backing_hd, but also driver-specific
      ones like VMDK extents or Quorum children.

      For bdrv_swap(), the list of children of the swapped BDS stays at that
      BDS (because that's where the pointers stay as well). The list head
      moves and pointers to it must be fixed up therefore.

      The list of children in the parent of the swapped BDS is not affected by
      the swap. The contents of the BDS objects is swapped, so the existing
      pointer in the parent automatically points to the newly swapped in BDS.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit ae81693004fd95f7013e42811944707a92948d9a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 10 13:47:35 2015 +0200

      queue.h: Add QLIST_FIX_HEAD_PTR()

      If the head of a list has been moved to a different memory location, the
      le_prev link in the first list entry has to be fixed up. Provide a macro
      that implements this fixup.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 6ee4ce1ee75a651c246d926c2302281b51981f6d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jun 10 13:33:17 2015 +0200

      block: Drain requests before swapping nodes in bdrv_swap()

      bdrv_swap() requires that there are no requests in flight on either of
      the two devices. The request coroutine would work on the wrong
      BlockDriverState object (with bs->opaque even being interpreted as a
      different type potentially) and all sorts of bad things would result
      from this.

      The currently existing callers mostly ensure that there is no I/O
      pending on nodes that are swapped. In detail, this is:

      1. Live snapshots. This goes through qmp_transaction(), which calls
         bdrv_drain_all() before doing anything. The command is executed
         synchronously, so no new I/O can be issued concurrently.

      2. snapshot=on in bdrv_open(). We're in the middle of opening the image
         (both the original image and its temporary overlay), so there can't
         be any I/O in flight yet.

      3. Mirroring. bdrv_drain() is already used on the source device so that
         the mirror doesn't miss anything. However, the main loop runs between
         that and the bdrv_swap() (which is actually a bug, being addressed in
         another series), so there is a small window in which new I/O might be
         issued that would be in flight during bdrv_swap().

      It is safer to just drain the request queue of both devices in
      bdrv_swap() instead of relying on callers to do the right thing.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f3930ed0bb1945b59da8e591072b5c79606d0760
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Apr 8 13:43:47 2015 +0200

      block: Move flag inheritance to bdrv_open_inherit()

      Instead of letting every caller of bdrv_open() determine the right flags
      for its child node manually and pass them to the function, pass the
      parent node and the role of the newly opened child (like backing file,
      protocol layer, etc.).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 18edf289a8951f3a48caff3b5fe17f2d414c2924
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 17:12:56 2015 +0200

      block: Use QemuOpts in bdrv_open_common()

      Instead of manually parsing options and then deleting them from the
      options QDict, just use QemuOpts like most other places that deal with
      block device options.

      More options will be added there and then QemuOpts is a lot more
      manageable than open-coding everything.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 54861b9280e95dd16c062b26a9d0adfe3608c63c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 16:55:00 2015 +0200

      block: Use macro for cache option names

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit a646836784a0fc50fee6f9a0d3fb968289714128
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 15:35:59 2015 +0200

      vmdk: Use bdrv_open_image()

      Besides standardising on a single interface for opening child nodes,
      this patch allows the user to specify options to individual extent
      nodes. Overriding file names isn't possible with this yet, so it's of
      limited usefulness, but still a step forward.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>

  commit ea6828d81b34d42f407e8de28694d2751ee660a2
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jan 21 18:49:28 2015 +0100

      quorum: Use bdrv_open_image()

      Besides standardising on a single interface for opening child nodes,
      this simplifies the .bdrv_open() implementation of the quorum block
      driver by using block layer functionality for handling BlockdevRefs.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit ef1919df26b9b094aa41733466b134111fcdbd36
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 28 17:37:55 2015 +0200

      check-qdict: Test cases for new functions

      This adds test cases for the following new QDict functions:

      * qdict_array_entries()
      * qdict_set_default_str()
      * qdict_copy_default()

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 7990d2c99c974ae8e3c3f719d8321ddc6eac93bc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Jan 19 21:22:45 2015 +0100

      qdict: Add qdict_{set,copy}_default()

      In the block layer functions that determine options for a child block
      device, it's a common pattern to either copy options from the parent's
      options or to set a default string if the option isn't explicitly set
      yet for the child. Provide convenience functions so that it becomes a
      one-liner for each option.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bd50530a9f40f6560a03caeaaddd451e2ce90ed8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Jan 21 17:15:44 2015 +0100

      qdict: Add qdict_array_entries()

      This counts the entries in a flattened array in a QDict without
      actually splitting the QDict into a QList.

      bdrv_open_image() doesn't take a QList, but rather a QDict and a key
      prefix string, so this is more convenient for block drivers which have a
      dynamically sized list of child nodes (e.g. Quorum) and are to be
      converted to using bdrv_open_image() as the standard interface for
      opening child nodes.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0a2df857a7038c75379cc575de5d4be4c0ac629e
  Merge: 9faffeb fafa4d5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 15:39:05 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri Jun 12 13:57:20 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        qmp/hmp: add rocker device support
        rocker: bring link up/down on PHY enable/disable
        rocker: update tests using hw-derived interface names
        rocker: Add support for phys name
        iohandler: Change return type of qemu_set_fd_handler to "void"
        event-notifier: Always return 0 for posix implementation
        xen_backend: Remove unused error handling of qemu_set_fd_handler
        oss: Remove unused error handling of qemu_set_fd_handler
        alsaaudio: Remove unused error handling of qemu_set_fd_handler
        main-loop: Drop qemu_set_fd_handler2
        Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler
        tap: Drop tap_can_send
        net/socket: Drop net_socket_can_send
        netmap: Drop netmap_can_send
        l2tpv3: Drop l2tpv3_can_send
        stubs: Add qemu_set_fd_handler

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a68197ff5b11f5a58d48e485d16a36758aeca7f4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Mar 19 14:53:17 2015 -0400

      iotests: Add tests for overriding BDRV_O_PROTOCOL

      This adds tests for overriding the qemu-internal BDRV_O_PROTOCOL flag by
      explicitly specifying a block driver. As one test must be run over the
      NBD protocol while the other must not, this patch adds two separate
      iotests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 53a295131274c87914c97053e2ca00f19a9c2efa
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Mar 19 14:53:16 2015 -0400

      block: driver should override flags in bdrv_open()

      The BDRV_O_PROTOCOL flag should have an impact only if no driver is
      specified explicitly. Therefore, if bdrv_open() is called with an
      explicit block driver argument (either through the options QDict or
      through the drv parameter) and that block driver is a protocol block
      driver, BDRV_O_PROTOCOL should be set; if it is a format block driver,
      BDRV_O_PROTOCOL should be unset.

      While there was code to unset the flag in case a format block driver
      has been selected, it only followed the bdrv_fill_options() function
      call whereas the flag in fact needs to be adjusted before it is used
      there.

      With that change, BDRV_O_PROTOCOL will always be set if the BDS should
      be a protocol driver; if the driver has been specified explicitly, the
      new code will set it; and bdrv_fill_options() will only "probe" a
      protocol driver if BDRV_O_PROTOCOL is set. The probing after
      bdrv_fill_options() cannot select a protocol driver.

      Thus, bdrv_open_image() to open BDS.file is never called if a protocol
      BDS is about to be created. With that change in turn it is impossible to
      call bdrv_open_common() with a protocol drv and file != NULL, which
      allows us to remove the bdrv_swap() call.

      This change breaks a test case in qemu-iotest 051:
      "-drive file=t.qcow2,file.driver=qcow2" now works because the explicitly
      specified "qcow2" overrides the BDRV_O_PROTOCOL which is automatically
      set for the "file" BDS (and the filename is just passed down).
      Therefore, this patch removes that test case.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06207b0ff596aa4bb192d1fafc593847ed888e39
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Jun 10 13:24:54 2015 -0400

      block: Change bitmap truncate conditional to assertion

      This is an artifact of an older version that had both all-bitmap and
      single-bitmap truncate functions, and some info got lost in the shuffle.

      Bitmaps can only be frozen during a backup operation, and a backup
      operation should prevent a resize operation, so just assert that this
      cannot happen.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5270b6a0d0cf41e49d634007ace40f5dfc381940
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jun 8 16:49:15 2015 -0400

      block: record new size in bdrv_dirty_bitmap_truncate

      ce1ffea8 neglected to update the BdrvDirtyBitmap structure
      itself for internal consistency. It's currently not an issue,
      but for migration and persistence series this will cause headaches.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8684454e152ca2e100f4b59d80de2be27186206
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 9 10:45:16 2015 +0200

      raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size

      Image files with an unaligned image size have a final hole that starts
      at EOF, i.e. in the middle of a sector. Currently, *pnum == 0 is
      returned when checking the status of this sector. In qemu-img, this
      triggers an assertion failure.

      In order to fix this, one type for the sector that contains EOF must be
      found. Treating a hole as data is safe, so this patch rounds the
      calculated number of data sectors up, so that a partial sector at EOF is
      treated as a full data sector.

      This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1229394

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Cole Robinson <crobinso@redhat.com>

  commit 90df601f06de14f062d2e8dc1bc57f0decf86fd1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:02:57 2015 +0800

      vmdk: Use vmdk_find_index_in_cluster everywhere

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 61f0ed1d54601b91b8195c1a30d7046f83283b40
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:02:56 2015 +0800

      vmdk: Fix index_in_cluster calculation in vmdk_co_get_block_status

      It has the similar issue with b1649fae49a8. Since the calculation
      is repeated for a few times already, introduce a function so it can be
      reused.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bc85ef265a0118d044ff62ae217c186cb08e0866
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:19 2015 +0200

      qcow2: Add DEFAULT_L2_CACHE_CLUSTERS

      If a relatively large cluster size is chosen, the default of 1 MB L2
      cache is not really appropriate. In this case, unless overridden by the
      user, the default cache size should not be determined by its size in
      bytes but by the number of L2 tables (clusters) it is supposed to
      contain.

      Note that without this patch, MIN_L2_CACHE_SIZE will effectively take
      over the same role. However, providing space for just two L2 tables is
      not enough to be the default.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a4291eafc597c0944057930acf3e51d899f79c2e
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:18 2015 +0200

      iotests: qcow2 COW with minimal L2 cache size

      This adds a test case to test 103 for performing a COW operation in a
      qcow2 image using an L2 cache with minimal size (which should be at
      least two clusters so the COW can access both source and destination
      simultaneously).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 57e216695948a79d9ced82fc217a37cce70fd986
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jun 1 18:09:17 2015 +0200

      qcow2: Set MIN_L2_CACHE_SIZE to 2

      The L2 cache must cover at least two L2 tables, because during COW two
      L2 tables are accessed simultaneously.

      Reported-by: Alexander Graf <agraf@suse.de>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Tested-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9aa711d75030356f1e179b9f71780da5fd1a45bb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 19 10:46:13 2015 +0000

      qemu-iotests: Fix 128 if sudo required

      If passwordless "sudo" works, use it in the qemu-io cmd.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ff793890faeb119c8dad53b7ed614407ff7b027a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 12:01:41 2015 -0400

      iotests: remove assertIsNotNone call

      RHEL6 doesn't have Python 2.7, so replace this call with
      assertNotEqual(x, None) which will work just as well.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9faffeb7772fddcb5d3fb2dbdcfe7e8a38f01637
  Merge: 4cb618a d218b28
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 14:31:13 2015 +0100

      Merge remote-tracking branch 'remotes/aurel/tags/pull-sh4-next-20150612' into staging

      sh4 linux-user cpu and hwcap
      misc optimizations and cleanup
      convert r2d to new MMIO accessor style

      # gpg: Signature made Fri Jun 12 11:28:43 2015 BST using RSA key ID 1DDD8C9B
      # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
      # gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
      # gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

      * remotes/aurel/tags/pull-sh4-next-20150612:
        target-sh4: remove dead code
        target-sh4: factorize fmov implementation
        target-sh4: split out Q and M from of SR and optimize div1
        target-sh4: optimize negc using add2 and sub2
        target-sh4: optimize subc using sub2
        target-sh4: optimize addc using add2
        target-sh4: Split out T from SR
        target-sh4: use bit number for SR constants
        sh4/r2d: convert to new MMIO accessor style
        linux-user: Add HWCAP for SH4
        linux-user: Default sh4 to sh7785

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2db33f88d2b340c049c576ad75d442e4b6ffe768
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:48 2015 +0200

      qemu-iotests: expand test 093 to support group throttling

      This patch improves the test by attaching a different number of drives
      to the VM and putting them in the same throttling group. The test
      verifies that the I/O is evenly distributed among all members of the
      group, and that the limits are enforced.

      By default the test is repeated 3 times with 1, 2 and 3 drives, but
      the maximum number of simultaneous drives is configurable.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 513df1da5c658878191b579ebcddd985adcd4122.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a291d5d9b9940e1b07319041afc2c4b9285b9c48
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:47 2015 +0200

      throttle: Update throttle infrastructure copyright

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 07dcd4ed02f0110b13b3140f477b761b8bb8e270.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b8fe1694e506362706cde65d1bf55b23e62b150e
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:46 2015 +0200

      throttle: add the name of the ThrottleGroup to BlockDeviceInfo

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 172df91f09c69c6f0440a697bbd1b3f95b077ee4.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit db6283385cb708b9d589e5b57e96eab4afd0269e
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:45 2015 +0200

      throttle: acquire the ThrottleGroup lock in bdrv_swap()

      bdrv_swap() touches the fields of a BlockDriverState that are
      protected by the ThrottleGroup lock. Although those fields end up in
      their original place, they are temporarily swapped in the process,
      so there's a chance that an operation on a member of the same group
      happening on a different thread can try to use them.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: d92dc40d7c4f1fc5cda5cbbf4ffb7a4670b79d17.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 76f4afb40fa076ed23fe0ab42c7a768ddb71123f
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:44 2015 +0200

      throttle: Add throttle group support

      The throttle group support use a cooperative round robin scheduling
      algorithm.

      The principles of the algorithm are simple:
      - Each BDS of the group is used as a token in a circular way.
      - The active BDS computes if a wait must be done and arms the right
        timer.
      - If a wait must be done the token timer will be armed so the token
        will become the next active BDS.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: f0082a86f3ac01c46170f7eafe2101a92e8fde39.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1fee955f9cc5903b3c7f79bbd90929aefad583a6
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:43 2015 +0200

      throttle: Add throttle group infrastructure tests

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: ba7b9dc7fca43efbb31d5f3aad91a8dbdbea635b.1433779731.git.berto@igalia.com
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2ff1f2e3a39daf4a401a8904d00b29ea8c450463
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 18:17:42 2015 +0200

      throttle: Add throttle group infrastructure

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 2fdb4de17210b733a13eb472c33cd08b45f8fd21.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0e5b0a2d54f4dca2f6d1a676da8ec089dc143001
  Author: Benoît Canet <benoit.canet@nodalink.com>
  Date:   Mon Jun 8 18:17:41 2015 +0200

      throttle: Extract timers from ThrottleState into a separate structure

      Group throttling will share ThrottleState between multiple bs.
      As a consequence the ThrottleState will be accessed by multiple aio
      context.

      Timers are tied to their aio context so they must go out of the
      ThrottleState structure.

      This commit paves the way for each bs of a common ThrottleState to
      have its own timer.

      Signed-off-by: Benoit Canet <benoit.canet@nodalink.com>
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 6cf9ea96d8b32ae2f8769cead38f68a6a0c8c909.1433779731.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f4a769abaa51badea666093077c50c568c35de17
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Jun 9 10:55:08 2015 +0200

      raw-posix: Fix .bdrv_co_get_block_status() for unaligned image size

      Image files with an unaligned image size have a final hole that starts
      at EOF, i.e. in the middle of a sector. Currently, *pnum == 0 is
      returned when checking the status of this sector. In qemu-img, this
      triggers an assertion failure.

      In order to fix this, one type for the sector that contains EOF must be
      found. Treating a hole as data is safe, so this patch rounds the
      calculated number of data sectors up, so that a partial sector at EOF is
      treated as a full data sector.

      This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1229394

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1433840108-9996-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da5e1de95bb235330d7724316e7a29239d1359d5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Jun 3 10:15:33 2015 +0100

      Revert "iothread: release iothread around aio_poll"

      This reverts commit a0710f7995f914e3044e5899bd8ff6c43c62f916.

      In qemu-devel email message <556DBF87.2020908@de.ibm.com>, Christian
      Borntraeger writes:

        Having many guests all with a kernel/ramdisk (via -kernel) and
        several null block devices will result in hangs. All hanging
        guests are in partition detection code waiting for an I/O to return
        so very early maybe even the first I/O.

        Reverting that commit "fixes" the hangs.

      Reverting this commit for the 2.4 release.  More time is needed to
      investigate and correct this patch.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fafa4d508b42a70a59a6bd647a2c0cfad86246c3
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:21 2015 -0700

      qmp/hmp: add rocker device support

      Add QMP/HMP support for rocker devices.  This is mostly for debugging purposes
      to see inside the device's tables and port configurations.  Some examples:

      (qemu) info rocker sw1
      name: sw1
      id: 0x0000013512005452
      ports: 4

      (qemu) info rocker-ports sw1
                  ena/    speed/ auto
            port  link    duplex neg?
           sw1.1  up     10G  FD  No
           sw1.2  up     10G  FD  No
           sw1.3  !ena   10G  FD  No
           sw1.4  !ena   10G  FD  No

      (qemu) info rocker-of-dpa-flows sw1
      prio tbl hits key(mask) --> actions
      2    60       pport 1 vlan 1 LLDP src 00:02:00:00:02:00 dst 01:80:c2:00:00:0e
      2    60       pport 1 vlan 1 ARP src 00:02:00:00:02:00 dst 00:02:00:00:03:00
      2    60       pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:00:02 proto 58
      3    50       vlan 2 dst 33:33:ff:00:00:02 --> write group 0x32000001 goto tbl 60
      2    60       pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:03:00 proto 58
      3    50  1    vlan 2 dst 33:33:ff:00:03:00 --> write group 0x32000001 goto tbl 60
      2    60       pport 2 vlan 2 ARP src 00:02:00:00:03:00 dst 00:02:00:00:02:00
      3    50  2    vlan 2 dst 00:02:00:00:02:00 --> write group 0x02000001 goto tbl 60
      2    60  1    pport 2 vlan 2 IP src 00:02:00:00:03:00 dst 00:02:00:00:02:00 proto 1
      3    50  2    vlan 1 dst 00:02:00:00:03:00 --> write group 0x01000002 goto tbl 60
      2    60  1    pport 1 vlan 1 IP src 00:02:00:00:02:00 dst 00:02:00:00:03:00 proto 1
      2    60       pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:00:01 proto 58
      3    50       vlan 1 dst 33:33:ff:00:00:01 --> write group 0x31000000 goto tbl 60
      2    60       pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:02:00 proto 58
      3    50  1    vlan 1 dst 33:33:ff:00:02:00 --> write group 0x31000000 goto tbl 60
      1    60  173  pport 2 vlan 2 LLDP src <any> dst 01:80:c2:00:00:0e --> write group 0x02000000
      1    60  6    pport 2 vlan 2 IPv6 src <any> dst <any> --> write group 0x02000000
      1    60  174  pport 1 vlan 1 LLDP src <any> dst 01:80:c2:00:00:0e --> write group 0x01000000
      1    60  174  pport 2 vlan 2 IP src <any> dst <any> --> write group 0x02000000
      1    60  6    pport 1 vlan 1 IPv6 src <any> dst <any> --> write group 0x01000000
      1    60  181  pport 2 vlan 2 ARP src <any> dst <any> --> write group 0x02000000
      1    10  715  pport 2 --> apply new vlan 2 goto tbl 20
      1    60  177  pport 1 vlan 1 ARP src <any> dst <any> --> write group 0x01000000
      1    60  174  pport 1 vlan 1 IP src <any> dst <any> --> write group 0x01000000
      1    10  717  pport 1 --> apply new vlan 1 goto tbl 20
      1    0   1432 pport 0(0xffff) --> goto tbl 10

      (qemu) info rocker-of-dpa-groups sw1
      id (decode) --> buckets
      0x32000001 (type L2 multicast vlan 2 index 1) --> groups [0x02000001,0x02000000]
      0x02000001 (type L2 interface vlan 2 pport 1) --> pop vlan out pport 1
      0x01000002 (type L2 interface vlan 1 pport 2) --> pop vlan out pport 2
      0x02000000 (type L2 interface vlan 2 pport 0) --> pop vlan out pport 0
      0x01000000 (type L2 interface vlan 1 pport 0) --> pop vlan out pport 0
      0x31000000 (type L2 multicast vlan 1 index 0) --> groups [0x01000002,0x01000000]

      [Added "query-" prefixes to rocker.json commands as suggested by Eric
      Blake <eblake@redhat.com>.
      --Stefan]

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1433985681-56138-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5ff1547b756a820bc7b695fe393b25d82467d1fe
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:20 2015 -0700

      rocker: bring link up/down on PHY enable/disable

      When the OS driver enables/disables the port, go ahead and set the port's
      link status to up/down in response to the change.  This more closely
      emulates real hardware when the PHY for the port is brought up/down
      and the PHY negotiates carrier (link status) with link partner.  In
      the case of qemu, the virtual rocker device can't really do link
      negotiation with the link partner as that requires signally over a
      physical medium (the wire), so just pretend the negotiation was
      successful and bring the link up when the port is enabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1433985681-56138-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 73da0232098a69d06ce0d49ad8751b7c5e8b9448
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Wed Jun 10 18:21:19 2015 -0700

      rocker: update tests using hw-derived interface names

      With previous patch to support phy name attribute for each port, the OS
      can name port interfaces using the hw-derived name.  So update rocker
      tests to use the new hw-derived interface names.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1433985681-56138-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 773495364ffbfc6a4d1e13e24e932f96409ba1d3
  Author: David Ahern <dsahern@gmail.com>
  Date:   Wed Jun 10 18:21:18 2015 -0700

      rocker: Add support for phys name

      Add ROCKER_TLV_CMD_PORT_SETTINGS_PHYS_NAME to port settings. This attribute
      exports the port name to the guest OS allowing it to name interfaces with
      sensible defaults.

      Mostly done by Scott for phys_id support; adapted to phys_name by David.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: David Ahern <dsahern@gmail.com>
      Message-id: 1433985681-56138-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f4d248bdc33167ab9e91b1470ef47a61dffd0b38
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:24 2015 +0800

      iohandler: Change return type of qemu_set_fd_handler to "void"

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-14-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1e354528bdaf9671ffc94e531e6967233abe7b8f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:23 2015 +0800

      event-notifier: Always return 0 for posix implementation

      qemu_set_fd_handler cannot fail, let's always return 0.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-13-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6b5166f8a82888638bb9aba9dc49aa7fa25f292f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:22 2015 +0800

      xen_backend: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-12-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b027a538c6790bcfc93ef7f4819fe3e581445959
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:21 2015 +0800

      oss: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-11-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit be93f216278d84d283187c95cef16c0b60b711b8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:20 2015 +0800

      alsaaudio: Remove unused error handling of qemu_set_fd_handler

      The function cannot fail, so the check is superfluous.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-10-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6484e422479c93f28e3f8a68258b0eacd3b31e6d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:19 2015 +0800

      main-loop: Drop qemu_set_fd_handler2

      All users are converted to qemu_set_fd_handler now, drop
      qemu_set_fd_handler2 and IOHandlerRecord.fd_read_poll.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-9-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 82e1cc4bf91a2e1c3b62297b10b0ab1d93adfc45
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:18 2015 +0800

      Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler

      Done with following Coccinelle semantic patch, plus manual cosmetic changes in
      net/*.c.

          @@
          expression E1, E2, E3, E4;
          @@
          -   qemu_set_fd_handler2(E1, NULL, E2, E3, E4);
          +   qemu_set_fd_handler(E1, E2, E3, E4);

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-8-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a90a7425cf592a3afeff3eaf32f543b83050ee5c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:17 2015 +0800

      tap: Drop tap_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be sent to peer when it arrives. If the device can't
      receive, it will be queued to incoming_queue, and when the device status
      changes, this queue will be flushed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-7-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6e99c631f116221d169ea53953d91b8aa74d297a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:16 2015 +0800

      net/socket: Drop net_socket_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be sent to peer when it arrives. If the device can't
      receive, it will be queued to incoming_queue, and when the device status
      changes, this queue will be flushed.

      If the peer is not ready, disable the read poll until send completes.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e8dd1d9c396104f0fac4b39a701143df49df2a74
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:15 2015 +0800

      netmap: Drop netmap_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be copied from s->fd to s->iov when it arrives. If the
      device can't receive, it will be queued to incoming_queue, and when the
      device status changes, this queue will be flushed.

      Also remove the qemu_can_send_packet() check in netmap_send. If it's
      true, we are good; if it's false, the qemu_sendv_packet_async would
      return 0 and read poll will be disabled until netmap_send_completed is
      called.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 95b1416ae93106923f733941e52dfe55c4318643
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:14 2015 +0800

      l2tpv3: Drop l2tpv3_can_send

      This callback is called by main loop before polling s->fd, if it returns
      false, the fd will not be polled in this iteration.

      This is redundant with checks inside read callback. After this patch,
      the data will be copied from s->fd to s->msgvec when it arrives. If the
      device can't receive, it will be queued to incoming_queue, and when the
      device status changes, this queue will be flushed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0bc12c4f7e8b5ff0f83908bdef0c247f1ca1a9d8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Jun 4 14:45:12 2015 +0800

      stubs: Add qemu_set_fd_handler

      Some qemu_set_fd_handler2 stub callers will be converted to
      call qemu_set_fd_handler, add this stub for them before making the
      change.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1433400324-7358-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4cb618abc1818586c08011ff0a84a015787b1672
  Merge: a4ef02f 6773f9b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 12:49:40 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150612' into staging

      MIPS patches 2015-06-12

      Changes:
      * improve dp8393x network card and rc4030 chipset emulation
      * support misaligned R6 and MSA memory accesses
      * support MIPS eXtended and Large Physical Addressing
      * add Config5.FRE bit and ERETNC instruction (Config5.LLB)
      * support ememsize on MALTA

      # gpg: Signature made Fri Jun 12 09:38:11 2015 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

      * remotes/lalrae/tags/mips-20150612: (29 commits)
        target-mips: enable XPA and LPA features
        target-mips: remove misleading comments in translate_init.c
        target-mips: add MTHC0 and MFHC0 instructions
        target-mips: add CP0.PageGrain.ELPA support
        target-mips: support Page Frame Number Extension field
        target-mips: extend selected CP0 registers to 64-bits in MIPS32
        target-mips: correct MFC0 for CP0.EntryLo in MIPS64
        net/dp8393x: fix hardware reset
        net/dp8393x: correctly reset in_use field
        net/dp8393x: add load/save support
        net/dp8393x: add PROM to store MAC address
        net/dp8393x: QOM'ify
        net/dp8393x: use dp8393x_ prefix for all functions
        net/dp8393x: do not use old_mmio accesses
        net/dp8393x: always calculate proper checksums
        dma/rc4030: convert to QOM
        dma/rc4030: use trace events instead of custom logging
        dma/rc4030: document register at offset 0x210
        dma/rc4030: do not use old_mmio accesses
        dma/rc4030: use AddressSpace and address_space_rw in users
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4ef02fd9b3d12b105b56942166c8364ade9be0f
  Merge: d8e3b72 4fa3dd1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 12 11:06:03 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150612' into staging

      migration/next for 20150612

      # gpg: Signature made Fri Jun 12 05:56:21 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150612: (21 commits)
        Remove unneeded memset
        Rename RDMA structures to make destination clear
        Teach analyze-migration.py about section footers
        Add a protective section footer
        Disable section footers on older machine types
        Merge section header writing
        Move loadvm_handlers into MigrationIncomingState
        Move copy out of qemu_peek_buffer
        Create MigrationIncomingState
        qemu_ram_foreach_block: pass up error value, and down the ramblock name
        Split header writing out of qemu_savevm_state_begin
        Add qemu_get_counted_string to read a string prefixed by a count byte
        migration: Use normal VMStateDescriptions for Subsections
        migration: create savevm_state
        migration: Remove duplicated assignment of SETUP status
        rdma: Fix qemu crash when IPv6 address is used for migration
        arch_init: Clean up the duplicate variable 'len' defining in ram_load()
        migration: reduce include files
        migration: Add myself to the copyright list of both files
        migration: move savevm.c inside migration/
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d218b28d28b8f4de297bfd35c082b22f153cf0df
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: remove dead code

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91b4d29f4eecab14c5f8888ecd7b3a740ad80b7c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: factorize fmov implementation

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 1d565b21e1aecbb0da6589f3c4ea83c9c788ad63
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: split out Q and M from of SR and optimize div1

      Splitting Q and M out of SR, it's possible to optimize div1 by using
      TCG code instead of an helper.

      At the same time removed the now unused gen_copy_bit_i32 function.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 60eb27fe4951fbe6cf5e24cc3d6df7e97c43a909
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize negc using add2 and sub2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit d0f44a55fa321e042bd6b2a0fa25ac48864b7a25
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize subc using sub2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit a2368e01c95a093d250a0e5d3cef53dddf642f1e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: optimize addc using add2

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 34086945254c035a03e01e472d99e4524a2f2416
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: Split out T from SR

      In preparation for more efficient setting of this field.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 5ed9a259c164bb9fd2a6fe8a363a4bda2e4a5461
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:28:56 2015 +0200

      target-sh4: use bit number for SR constants

      Use the bit number for SR constants instead of using a bit mask. This
      make possible to also use the constants for shifts.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 563807520ff19e6ed2d40695f543f1fba7ba432f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:16:43 2015 +0200

      sh4/r2d: convert to new MMIO accessor style

      The documentation is clear to use 16-bit accesses for all registers.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e42fd944f02dda893fc8773959d6db75f2a49367
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat May 23 15:06:54 2015 -0700

      linux-user: Add HWCAP for SH4

      Only exposing FPU and LLSC as the only features
      supported by the translator.

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 91c45a38f282b970f443f8e9d6bdb6ffaa00dfbf
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat May 23 15:06:53 2015 -0700

      linux-user: Default sh4 to sh7785

      Signed-off-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 7a4dfd1e4a741991df1acf31672b391648e0aa0c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 13:04:17 2014 +0200

      virtio-vga: add vgabios configuration

      Add seavgabios configuration for virtio-vga,
      hook up the new vgabios in the makefiles.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a94f0c5ca2f0e3dba4a64f40c9d2e1149017d81d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:28:48 2014 +0200

      virtio-vga: add '-vga virtio' support

      Some convinience fluff:  Add support for '-vga virtio', also add
      virtio-vga to the list of vga cards so '-device virtio-vga' will
      turn off the default vga.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c5d4dac86b61070c078a7b35e25f56d2c8bff508
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:25:45 2014 +0200

      virtio-vga: add virtio gpu device with vga compatibility

      This patch adds a virtio-vga device.  It is simliar to virtio-gpu-pci,
      but it also adds in vga compatibility, so guests without native
      virtio-gpu support can drive the device in vga mode.  It is compatible
      with stdvga.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9eafb62d47ac1c8c2d431e1b4829445444ccc2ee
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:20:34 2014 +0200

      virtio-gpu-pci: add virtio pci support

      This patch adds virtio-gpu-pci, which is the pci proxy for the virtio
      gpu device.  With this patch in place virtio-gpu is functional.  You
      need a linux guest with a virtio-gpu driver though, and output will
      appear pretty late in boot, once the kernel initialized drm and fbcon.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2c84167b4efa4a0e81946ef624e96005396e14b2
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Mar 17 08:56:18 2015 +0100

      virtio-gpu: fix error message

      iov limit was raised, but the error message still has the old limit ...

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6773f9b687e0a8ab4b638ef88d075fb233fb7669
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:33:43 2015 +0100

      target-mips: enable XPA and LPA features

      Enable XPA in MIPS32R5-generic and LPA in MIPS64R6-generic.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 28b027d5b63c7550c7390041d6dd50948c8f55b8
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:33:35 2015 +0100

      target-mips: remove misleading comments in translate_init.c

      PABITS are not hardcoded to 36 bits and we do not model 59 PABITS (which is
      the architectural limit) in QEMU.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 5204ea79ea739b557f47fc4db96c94edcb33a5d6
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Sep 11 16:28:17 2014 +0100

      target-mips: add MTHC0 and MFHC0 instructions

      Implement MTHC0 and MFHC0 instructions. In MIPS32 they are used to access
      upper word of extended to 64-bits CP0 registers.

      In MIPS64, when CP0 destination register specified is the EntryLo0 or
      EntryLo1, bits 1:0 of the GPR appear at bits 31:30 of EntryLo0 or
      EntryLo1. This is to compensate for RI and XI, which were shifted to bits
      63:62 by MTC0 to EntryLo0 or EntryLo1. Therefore creating separate
      functions for EntryLo0 and EntryLo1.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit e117f52636d04502fab28bd3abe93347c29f39a5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 14 10:09:38 2015 +0100

      target-mips: add CP0.PageGrain.ELPA support

      CP0.PageGrain.ELPA enables support for large physical addresses. This field
      is encoded as follows:
      0: Large physical address support is disabled.
      1: Large physical address support is enabled.

      If this bit is a 1, the following changes occur to coprocessor 0 registers:
      - The PFNX field of the EntryLo0 and EntryLo1 registers is writable and
        concatenated with the PFN field to form the full page frame number.
      - Access to optional COP0 registers with PA extension, LLAddr, TagLo is
        defined.

      P5600 can operate in 32-bit or 40-bit Physical Address Mode. Therefore if
      XPA is disabled (CP0.PageGrain.ELPA = 0) then assume 32-bit Address Mode.
      In MIPS64 assume 36 as default PABITS (when CP0.PageGrain.ELPA = 0).

      env->PABITS value is constant and indicates maximum PABITS available on
      a core, whereas env->PAMask is calculated from env->PABITS and is also
      affected by CP0.PageGrain.ELPA.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit cd0d45c40133ef8b409aede5ad8a99aeaf6a70fe
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Sep 11 16:28:16 2014 +0100

      target-mips: support Page Frame Number Extension field

      Update tlb->PFN to contain PFN concatenated with PFNX. PFNX is 0 if large
      physical address is not supported.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 284b731a6ae47b9ebabb9613e753c4d83cf75dd3
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Jun 9 17:14:13 2015 +0100

      target-mips: extend selected CP0 registers to 64-bits in MIPS32

      Extend EntryLo0, EntryLo1, LLAddr and TagLo from 32 to 64 bits in MIPS32.

      Introduce gen_move_low32() function which moves low 32 bits from 64-bit
      temp to GPR; it sign extends 32-bit value on MIPS64 and truncates on
      MIPS32.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit b435f3f3d174721382b55bbd0c785ec50c1796a9
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Mar 20 12:06:10 2015 +0000

      target-mips: correct MFC0 for CP0.EntryLo in MIPS64

      CP0.EntryLo bits 31:30 have to be cleared.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 4fa3dd17dc29c316726f0d4a354a4d895e130c73
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Apr 20 16:57:21 2015 +0100

      Remove unneeded memset

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit a97270ad5d6dd0382ecb4568674226c8463e59fb
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Apr 20 16:57:16 2015 +0100

      Rename RDMA structures to make destination clear

      RDMA has two data types that are named confusingly;
         RDMALocalBlock (pointed to indirectly by local_ram_blocks)
         RDMARemoteBlock (pointed to by block in RDMAContext)

      RDMALocalBlocks, as the name suggests is a data strucuture that
      represents the RDMAable RAM Blocks on the current side of the migration
      whichever that is.

      RDMARemoteBlocks is always the shape of the RAMBlocks on the
      destination, even on the destination.

      Rename:
           RDMARemoteBlock -> RDMADestBlock
           context->'block' -> context->dest_blocks

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 73d9a7961ab1b083fb2095413a3bd091e35f4369
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:53 2015 +0100

      Teach analyze-migration.py about section footers

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f68945d42bab700d95b87f62e0898606ce2421ed
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:52 2015 +0100

      Add a protective section footer

      Badly formatted migration streams can go undetected or produce
      misleading errors due to a lock of checking at the end of sections.
      In particular a section that adds an extra 0x00 at the end
      causes what looks like a normal end of stream and thus doesn't produce
      any errors, and something that ends in a 0x01..0x04 kind of look
      like real section headers and then fail when the section parser tries
      to figure out which section they are.  This is made worse by the
      choice of 0x00..0x04 being small numbers that are particularly common
      in normal section data.

      This patch adds a section footer consisting of a marker (0x7e - ~)
      followed by the section-id that was also sent in the header.  If
      they mismatch then it throws an error explaining which section was
      being loaded.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 37fb569c0198cba58e3e1bdf6b9702c8248b89dd
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:51 2015 +0100

      Disable section footers on older machine types

      The next patch adds section footers; but we don't want to
      break migration compatibility so disable them on older
      machine types

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit ce39bfc9186005d222a78db4a7fbdc83e2d62481
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue May 19 12:29:50 2015 +0100

      Merge section header writing

      The header writing for device sections is open coded in
      a few places, merge it into one.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1a8f46f8d61ef885ff9d0bda251e4e9830c932ef
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:16 2015 +0100

      Move loadvm_handlers into MigrationIncomingState

      In postcopy we need the loadvm_handlers to be used in a couple
      of different instances of the loadvm loop/routine, and thus
      it can't be local any more.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7c1e52ba6f3994dc127118f491258ce84d0beb52
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:15 2015 +0100

      Move copy out of qemu_peek_buffer

      qemu_peek_buffer currently copies the data it reads into a buffer,
      however a future patch wants access to the buffer without the copy,
      hence rework to remove the copy to the layer above.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit bca7856ae8220d9f15ff0f44b97397529e26a552
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:14 2015 +0100

      Create MigrationIncomingState

      There are currently lots of pieces of incoming migration state scattered
      around, and postcopy is adding more, and it seems better to try and keep
      it together.

      allocate MIS in process_incoming_migration_co

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e3807054e20fb3b94d18cb751c437ee2f43b6fac
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:13 2015 +0100

      qemu_ram_foreach_block: pass up error value, and down the ramblock name

      check the return value of the function it calls and error if it's non-0
      Fixup qemu_rdma_init_one_block that is the only current caller,
        and rdma_add_block the only function it calls using it.

      Pass the name of the ramblock to the function; helps in debugging.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f796baa1b3efcf105ba3a465f797e05ac2b3dcfc
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:12 2015 +0100

      Split header writing out of qemu_savevm_state_begin

      Split qemu_savevm_state_begin to:
        qemu_savevm_state_header   That writes the initial file header.
        qemu_savevm_state_begin    That sets up devices and does the first
                                   device pass.

      Used later in postcopy.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b3af1bc9d21e6bec7dfd283d91b465c9f815b6d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu May 21 13:24:11 2015 +0100

      Add qemu_get_counted_string to read a string prefixed by a count byte

      and use it in loadvm_state and ram_load.

      Where ever it's used, check the return and error if it failed.

      Minor: ram_load was using a 257 byte array for its string, the
             maximum length is 255 bytes + 0 terminator, so fix to 256

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 5cd8cadae8db905afcbf877cae568c27d1d55a8a
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Sep 23 14:09:54 2014 +0200

      migration: Use normal VMStateDescriptions for Subsections

      We create optional sections with this patch.  But we already have
      optional subsections.  Instead of having two mechanism that do the
      same, we can just generalize it.

      For subsections we just change:

      - Add a needed function to VMStateDescription
      - Remove VMStateSubsection (after removal of the needed function
        it is just a VMStateDescription)
      - Adjust the whole tree, moving the needed function to the corresponding
        VMStateDescription

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0163a2e025cda6acb33e100d296965671ace17d9
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 13 13:37:04 2015 +0200

      migration: create savevm_state

      This way, we will put savevm global state here, instead of lots of variables.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit e45a1ebfc65fb23be8cddb684d97eaa92725484d
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Wed May 20 17:14:28 2015 +0200

      migration: Remove duplicated assignment of SETUP status

      We assign the MIGRATION_STATUS_SETUP status in two places.  Just in
      succession.  Just remove the second one.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 5b61d5752156dcbbe2bf1366c877a676ed9f8f51
  Author: Padmanabh Ratnakar <padmanabh.ratnakar@avagotech.com>
  Date:   Wed Jun 3 04:44:10 2015 +0530

      rdma: Fix qemu crash when IPv6 address is used for migration

      Qemu crashes when IPv6 address is specified for migration and access
      to any RDMA uverbs device available on the system is blocked using cgroups.
      Fix the crash by checking the return value of ibv_open_device routine.

      Signed-off-by: Meghana Cheripady <meghana.cheripady@avagotech.com>
      Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@avagotech.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 5ee6926582cca64238967b2d00d870265cdb10b8
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri May 15 17:00:03 2015 +0800

      arch_init: Clean up the duplicate variable 'len' defining in ram_load()

      There are two places that define 'len' variable, It's OK for compiling,
      but makes it difficult for reading.

      Remove the local one which defined in the inside 'while' loop.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7205c9ec525fe375dd34c0f116c36dc4aab4c0f7
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 13:54:36 2015 +0200

      migration: reduce include files

      To make changes easier, with the copy, I maintained almost all include
      files.  Now I remove the unnecessary ones on this patch.  This compiles
      on linux x64 with all architectures configured, and cross-compiles for
      windows 32 and 64 bits.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 76cc7b587f1cd1679821e034a2d9974af9bc7d2b
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 13:20:21 2015 +0200

      migration: Add myself to the copyright list of both files

      If anyone feels like adding himself to the list, just sent me a patch.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c3049a56d69f1ee7e85b5100ba5d0e3dc69a14f1
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Fri May 8 12:49:01 2015 +0200

      migration: move savevm.c inside migration/

      Now, everything is in place.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 56e93d26b85bac76b93211393163c2ebcdee9481
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu May 7 19:33:31 2015 +0200

      migration: move ram stuff to migration/ram

      For historic reasons, ram migration have been on arch_init.c.  Just
      split it into migration/ram.c, the same that happened with block.c.

      There is only code movement, no changes altogether.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 795dc6e46d953d70b4b7ddd3f4956f8f4b9d8565
  Author: Mao Chuan Li <maochuan@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:36 2015 +0800

      watchdog: Add new Virtual Watchdog action INJECT-NMI

      This patch allows QEMU to inject a NMI into a guest when the
      watchdog expires.

      Signed-off-by: Mao Chuan Li <maochuan@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      CC: Eric Blake <eblake@redhat.com>
      CC: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f9a535e089abcbc7ac99db83c8c6e4644e395b12
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:35 2015 +0800

      nmi: Implement inject_nmi() for non-monitor context use

      Let's introduce a general "inject_nmi()" function that doesn't rely on the cpu
      index of the monitor, but uses cpu index 0 as default (except for x86).
      This function can then later be used from a non-monitor context.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      CC: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d67f5fe63caa0f707fa91c760508c340e050b6f0
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:34 2015 +0800

      s390x/watchdog: diag288 migration support

      Add vmstate structure to keep state and data during migration.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 8fc639af4b62930671b6988c1f7eedf9e7c9f7bc
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Jun 11 13:55:26 2015 +0200

      s390x/kvm: diag288 instruction interception and handling

      Intercept the diag288 requests from kvm guests, and hand the
      requested command to the diag288 watchdog device for further
      handling.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 188f24c2c149bcb0088c6317e99e09afc007de34
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Feb 5 18:28:32 2015 +0800

      s390x/watchdog: introduce diag288 watchdog device

      This patch introduces a new diag288 watchdog device that will, just like
      other watchdogs, monitor a guest and take corresponding actions when it
      detects that the guest is not responding.

      diag288 is s390x specific. The wiring to s390x KVM will be done in
      separate patches.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [split out qemu-option.hx base changes]

  commit d7933ef3ac81149a51ba43ddac9fe70405008aba
  Author: Xu Wang <gesaint@linux.vnet.ibm.com>
  Date:   Thu Jun 11 17:32:05 2015 +0200

      watchdog: change option wording to allow for more watchdogs

      We will introduce a new watchdog for s390x. Lets adopt
      qemu-options.hx to allow more watchdog devices.

      Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [split out qemu-option.hx base changes]

  commit d8e3b729cf452d2689c8669f1ec18158db29fd5a
  Merge: afa25c4 4ebc736
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 15:33:38 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, acpi, virtio

      Most notably this includes virtio 1 patches
      Still not all devices converted, and not fully spec compliant,
      so disabled by default.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu Jun 11 12:53:08 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (42 commits)
        i386/acpi-build: fix PXB workarounds for unsupported BIOSes
        i386/acpi-build: more traditional _UID and _HID for PXB root buses
        vhost-scsi: move qdev properties into vhost-scsi.c
        virtio-9p-device: move qdev properties into virtio-9p-device.c
        virtio-serial-bus: move qdev properties into virtio-serial-bus.c
        virtio-rng: move qdev properties into virtio-rng.c
        virtio-scsi: move qdev properties into virtio-scsi.c
        virtio-net.h: Remove unsed DEFINE_VIRTIO_NET_PROPERTIES
        virtio-net: move qdev properties into virtio-net.c
        virtio-input: emulated devices [pci]
        virtio-input: core code & base class [pci]
        pci: add PCI_CLASS_INPUT_*
        virtio-pci: fill VirtIOPCIRegions early.
        virtio-pci: drop identical virtio_pci_cap
        virtio-pci: move cap type to VirtIOPCIRegion
        virtio-pci: move virtio_pci_add_mem_cap call to virtio_pci_modern_region_map
        virtio-pci: add virtio_pci_modern_region_map()
        virtio-pci: add virtio_pci_modern_regions_init()
        virtio-pci: add struct VirtIOPCIRegion for virtio-1 regions
        virtio-balloon: switch to virtio_add_feature
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit afa25c4bb5bd0732dca4aa0691fd4682d242925f
  Merge: 0b70743 08d49df
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 14:40:25 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150611-1' into staging

      sdl2: fix crash in handle_windowevent() when restoring the screen size

      # gpg: Signature made Thu Jun 11 08:57:38 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150611-1:
        sdl2: fix crash in handle_windowevent() when restoring the screen size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b70743d4f4f260b2fe6ed53fecc6bc6cda13910
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Thu Jun 11 09:44:40 2015 +0100

      hw/vfio/platform: replace g_malloc0_n by g_new0

      g_malloc0_n() is introduced since glib-2.24 while QEMU currently
      requires glib-2.22. This may cause a link error on some distributions.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 169b71331eaff7a28e3d4fabe8733e7db91f01aa
  Merge: 39e16a5 5a9259a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 12:12:58 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150611-1' into staging

      spice: fix segfault in qemu_spice_create_update, ui_info tweaks.

      # gpg: Signature made Thu Jun 11 08:48:49 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150611-1:
        spice: ui_info tweaks
        spice-display: fix segfault in qemu_spice_create_update

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ebc736e9938a7e88ecc785734b17145bf802a56
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 11 02:37:59 2015 +0200

      i386/acpi-build: fix PXB workarounds for unsupported BIOSes

      The patch

        apci: fix PXB behaviour if used with unsupported BIOS

      uses the following condition to see if a "PXB mem/IO chunk" has *not* been
      configured by the BIOS:

        (!range_base || range_base > range_limit)

      When this condition evaluates to true, said patch *omits* the
      corresponding entry from the _CRS.

      Later on the patch checks for the opposite condition (with the intent of
      *adding* entries to the _CRS if the "PXB mem/IO chunks" *have* been
      configured). Unfortunately, the condition was negated incorrectly: only
      the first ! operator was removed, which led to the nonsensical expression

        (range_base || range_base > range_limit)

      leading to bogus entries in the _CRS, and causing BSOD in Windows Server
      2012 R2 when it runs on OVMF.

      The correct negative of the condition seen at the top is

        (range_base && range_base <= range_limit)

      Fix the expressions.

      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c96d9286a6d70452e5fa4f1e3f840715e325be95
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Jun 11 02:37:58 2015 +0200

      i386/acpi-build: more traditional _UID and _HID for PXB root buses

      The ACPI specification permits the _HID and _UID objects to evaluate to
      strings. (See "6.1.5 _HID (Hardware ID)" and "6.1.12 _UID (Unique ID)" in
      the ACPI v6.0 spec.)

      With regard to related standards, the UEFI specification can also express
      a device address composed from string _HID and _UID identifiers, inside
      the Expanded ACPI Device Path Node. (See "9.3.3 ACPI Device Path", Table
      49, in the UEFI v2.5 spec.)

      However, numeric (integer) contents for both _HID and _UID are more
      traditional. They are recommended by the UEFI spec for size reasons:

        [...] the ACPI Device Path node is smaller and should be used if
        possible to reduce the size of device paths that may potentially be
        stored in nonvolatile storage [...]

      External tools support them better (for example the --acpi_hid and
      --acpi_uid options of "efibootmgr" only take numeric identifiers).
      Finally, numeric _HID and _UID contents are existing practice in the QEMU
      source.

      This patch was tested with a Fedora 20 LiveCD and a preexistent Windows
      Server 2012 R2 guest. Using "acpidump" and "iasl" in the Fedora guest, we
      get, in the SSDT:

      > Scope (\_SB)
      > {
      >   Device (PC04)
      >   {
      >     Name (_UID, 0x04)  // _UID: Unique ID
      >     Name (_HID, EisaId ("PNP0A03") /* PCI Bus */)  // _HID: Hardware ID

      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 39e16a5b708358202e8d2252e3d84863666dc9e5
  Merge: 0e12e61 060ab76
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 11 11:18:11 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150611-1' into staging

      gtk: don't exit early in case gtk init fails

      # gpg: Signature made Thu Jun 11 10:38:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150611-1:
        gtk: don't exit early in case gtk init fails

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 060ab76356fff6a420bc881a574c40a5dda086af
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jun 5 13:07:58 2015 +0200

      gtk: don't exit early in case gtk init fails

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>

  commit bd8f1ebce430eb6c1dd92e34baf7bc35aa600464
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:49 2015 +0200

      net/dp8393x: fix hardware reset

      Documentation is not clear of what happens when doing a hardware reset,
      but firmware expect all registers to be zero unless specified otherwise.

      This fixes reboot on MIPS Magnum.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 409b52bfe199d8106dadf7c5ff3d88d2228e89b5
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:48 2015 +0200

      net/dp8393x: correctly reset in_use field

      Don't write more than the field width, which is always 16 bit.
      Fixes network in NetBSD 5.1/arc

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1670735dd7087224cf8fabd37c78fc2aa1f0b22f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:47 2015 +0200

      net/dp8393x: add load/save support

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 89ae0ff9b73ee74c9ba707a09a07ad77b9fdccb4
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:46 2015 +0200

      net/dp8393x: add PROM to store MAC address

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 104655a5c818ea8de1329cef50d1cc8defc524f3
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:45 2015 +0200

      net/dp8393x: QOM'ify

      Signed-off-by: Laurent Vivier <laurent@vivier.eu>
      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3df5de64f06f6b288b1cf30ce2bad7878a96454b
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:44 2015 +0200

      net/dp8393x: use dp8393x_ prefix for all functions

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 84689cbb97d2f8c7bb1ebe069f887eaaaddb0902
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:43 2015 +0200

      net/dp8393x: do not use old_mmio accesses

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f2f62c4db244f392381c9061c4185ced98f9be57
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:42 2015 +0200

      net/dp8393x: always calculate proper checksums

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d791d60f1cf944f578aa26ca9f8903ce5dda1c78
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:41 2015 +0200

      dma/rc4030: convert to QOM

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 95c357bc461b00785284403bf56567657d42e915
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:40 2015 +0200

      dma/rc4030: use trace events instead of custom logging

      Remove also unneeded debug logs.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit dc6e3e1e1aef2e6b2ed2ddf80c9559c91f685ecd
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:39 2015 +0200

      dma/rc4030: document register at offset 0x210

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b421f3f52aed306ecc69221a13fac22d03905956
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:38 2015 +0200

      dma/rc4030: do not use old_mmio accesses

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit dd8205130bab277a27889b6d3c0c6c7651585732
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:37 2015 +0200

      dma/rc4030: use AddressSpace and address_space_rw in users

      Now that rc4030 internally uses an AddressSpace for DMA handling, make its root
      memory region public. This is especially usefull for dp8393x netcard, which now
      uses well known QEMU types and methods.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit a3d586f704609a45b6037534cb2f34da5dfd8895
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:36 2015 +0200

      dma/rc4030: create custom DMA address space

      Add a new memory region in system address space where DMA address space
      definition (the 'translation table') belongs, so we can update on the fly
      the DMA address space.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 9b1d21c53b73c8f8f79e4aae69c4eb7a5270d6d4
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Wed Jun 3 22:45:35 2015 +0200

      mips jazz: compile only in 64 bit

      Remove now useless device models from other MIPS configurations

      We're now compiling 12 files less than before.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit ce9782f40ac16660ea9437bfaa2c9c34d5ed8110
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Jun 4 17:00:31 2015 +0100

      target-mips: add ERETNC instruction and Config5.LLB bit

      ERETNC is identical to ERET except that an ERETNC will not clear the LLbit
      that is set by execution of an LL instruction, and thus when placed between
      an LL and SC sequence, will never cause the SC to fail.

      Presence of ERETNC is denoted by the Config5.LLB.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit adc370a48fd26b92188fa4848dfb088578b1936c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:24 2015 +0100

      target-mips: Misaligned memory accesses for MSA

      MIPS SIMD Architecture vector loads and stores require misalignment support.
      MSA Memory access should work as an atomic operation. Therefore, it has to
      check validity of all addresses for a vector store access if it is spanning
      into two pages.

      Separating helper functions for each data format as format is known in
      translation.
      To use mmu_idx from cpu_mmu_index() instead of calculating it from hflag.
      Removing save_cpu_state() call in translation because it is able to use
      cpu_restore_state() on fault as GETRA() is passed.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      [leon.alrae@imgtec.com: remove unused do_* functions]
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 3b4afc9e75ab1a95f33e41f462921093f8a109c4
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:23 2015 +0100

      softmmu: Add probe_write()

      Probe for whether the specified guest write access is permitted.
      If it is not permitted then an exception will be taken in the same
      way as if this were a real write access (and we will not return).
      Otherwise the function will return, and there will be a valid
      entry in the TLB for this access.

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit be3a8c53b4f18bcc51a462d977cc61a0f46ebb1c
  Author: Yongbok Kim <yongbok.kim@imgtec.com>
  Date:   Mon Jun 1 12:13:22 2015 +0100

      target-mips: Misaligned memory accesses for R6

      Release 6 requires misaligned memory access support for all ordinary memory
      access instructions (for example, LW/SW, LWC1/SWC1).
      However misaligned support is not provided for certain special memory accesses
      such as atomics (for example, LL/SC).

      Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 71c199c81d290b2077ee7cf5400332a342de3a97
  Author: Paul Burton <paul.burton@imgtec.com>
  Date:   Mon May 25 14:21:04 2015 +0100

      mips_malta: provide ememsize env variable to kernels

      Commit 94c2b6aff43c (mips_malta: support up to 2GiB RAM) provided
      support for using over 256MB of RAM with the MIPS Malta board, including
      capping the memsize variable that QEMUs pseudo-bootloader provides to
      the kernel at 256MB in order to match YAMON. It didn't however provide
      the ememsize variable which kernels supporting memory outside of the
      unmapped address spaces (ie. EVA or highmem) may use to determine the
      true size of the RAM present in the system.

      Set ememsize to the size of RAM so that such kernels may use all
      available memory without the user having to manually specifying its size
      & location.

      Signed-off-by: Paul Burton <paul.burton@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 7c979afd11b09a16634699dd6344e3ba10c9677e
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 21 16:06:28 2015 +0100

      target-mips: add Config5.FRE support allowing Status.FR=0 emulation

      This relatively small architectural feature adds the following:

      FIR.FREP: Read-only. If FREP=1, then Config5.FRE and Config5.UFE are
                available.

      Config5.FRE: When enabled all single-precision FP arithmetic instructions,
                   LWC1/LWXC1/MTC1, SWC1/SWXC1/MFC1 cause a Reserved Instructions
                   exception.

      Config5.UFE: Allows user to write/read Config5.FRE using CTC1/CFC1
                   instructions.

      Enable the feature in MIPS64R6-generic CPU.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit eab9944c7801525737626fa45cddaf00932dd2c8
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Tue Apr 21 16:06:27 2015 +0100

      target-mips: move group of functions above gen_load_fpr32()

      Move the "Tests" group of functions so that gen_load_fpr32() and
      gen_store_fpr32() can use generate_exception().

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 5a9259a0b5d6f9424f94539cd9c715b1d166d90c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:21:50 2015 +0100

      spice: ui_info tweaks

      Use the new dpy_ui_info_supported function.
      Clarifies the control flow.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c6e484707f28b3e115e64122a0570f6b3c585489
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 9 21:08:47 2015 +0200

      spice-display: fix segfault in qemu_spice_create_update

      Although it is pretty unusual the stride for the guest image and the
      mirror image maintained by spice-display can be different.  So use
      separate variables for them.

      https://bugzilla.redhat.com/show_bug.cgi?id=1163047

      Cc: qemu-stable@nongnu.org
      Reported-by: perrier vincent <clownix@clownix.net>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0e12e61ff9a3407d123d0dbc4d945aec98d60fdf
  Merge: 3974c9d 62232bf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 18:13:58 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150610-1' into staging

      stdvga: factor out mmio subregion init
      virtio-gpu: add virtio gpu core code, 2d mode

      # gpg: Signature made Wed Jun 10 10:03:11 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150610-1:
        virtio-gpu/2d: add virtio gpu core code
        virtio: update headers, add virtio-gpu (2d)
        stdvga: factor out mmio subregion init
        stdvga: pass VGACommonState instead of PCIVGAState
        stdvga: fix offset in pci_vga_ioport_read

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21549a4642e1f1b438ffc31dd9dc35f134b10e5b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:36 2015 +0800

      vhost-scsi: move qdev properties into vhost-scsi.c

      As only one place in vhost-scsi.c uses DEFINE_VHOST_SCSI_PROPERTIES,
      there is no need to expose it. Inline it into vhost-scsi.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 83a84878da2e00b4d350bd90d6775c1f6320e7b4
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:35 2015 +0800

      virtio-9p-device: move qdev properties into virtio-9p-device.c

      As only one place in virtio-9p-device.c uses
      DEFINE_VIRTIO_9P_PROPERTIES, there is no need to expose it. Inline it
      into virtio-9p-device.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 448777c411b80df0263eb00b9df2f829cdc7cc9b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:34 2015 +0800

      virtio-serial-bus: move qdev properties into virtio-serial-bus.c

      As only one place in virtio-serial-bus.c uses
      DEFINE_VIRTIO_SERIAL_PROPERTIES, there is no need to expose it. Inline
      it into virtio-serial-bus.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fe704809b974d8dd8e020b4d3f48ede338a886fe
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:33 2015 +0800

      virtio-rng: move qdev properties into virtio-rng.c

      As only one place in virtio-rng.c uses DEFINE_VIRTIO_RNG_PROPERTIES,
      there is no need to expose it. Inline it into virtio-rng.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0c63237a90f37fffe8a8016f24f61bb228653e86
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:32 2015 +0800

      virtio-scsi: move qdev properties into virtio-scsi.c

      As only one place in virtio-scsi.c uses DEFINE_VIRTIO_SCSI_PROPERTIES
      and DEFINE_VIRTIO_SCSI_FEATURES, there is no need to expose them. Inline
      them into virtio-scsi.c to avoid wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit db58c063e159f02f0232d1557f0930fd32a6580f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:31 2015 +0800

      virtio-net.h: Remove unsed DEFINE_VIRTIO_NET_PROPERTIES

      Remove unsed DEFINE_VIRTIO_NET_PROPERTIES in virtio-net.h and delete a
      space typo.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 87108bb26ce04637980c0897caeabee8901e72c9
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Wed Jun 10 23:04:30 2015 +0800

      virtio-net: move qdev properties into virtio-net.c

      As only one place in virtio-net.c uses DEFINE_VIRTIO_NET_FEATURES,
      there is no need to expose it. Inline it into virtio-net.c to avoid
      wrongly use.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 710e2d90da1a16807f7885d37b203ce739fdc53a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:42 2015 +0200

      virtio-input: emulated devices [pci]

      This patch adds virtio-pci support for the emulated virtio-input
      devices.  Using them is as simple as adding "-device virtio-tablet-pci"
      to your command line.  If you want add multiple devices but don't want
      waste a pci slot for each you can compose a multifunction device this way:

      qemu -device virtio-keyboard-pci,addr=0d.0,multifunction=on \
           -device virtio-tablet-pci,addr=0d.1,multifunction=on

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f958c8aa138718b8126a300d6faece522f7674b8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:41 2015 +0200

      virtio-input: core code & base class [pci]

      This patch adds the virtio-pci support bits for virtio-input-device.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ffaa05037134d48e3ccd7ebbf2d58db26590b96d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:40 2015 +0200

      pci: add PCI_CLASS_INPUT_*

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6ce27a593ab39ac28baebc3045901925046bebd
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:39 2015 +0200

      virtio-pci: fill VirtIOPCIRegions early.

      Initialize the modern bar and the VirtIOPCIRegion fields early, in
      realize.  Also add a size field to VirtIOPCIRegion and variables for
      pci bars to VirtIOPCIProxy.

      This allows virtio-pci subclasses to change things before the
      device_plugged callback applies them.  virtio-vga will use that to
      arrange regions in a way that virtio-vga is compatible to both stdvga
      (in vga mode) and virtio-gpu-pci (in pci mode).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cc52ea90f835aa66d431db712b22f8b15bec2e46
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:38 2015 +0200

      virtio-pci: drop identical virtio_pci_cap

      Now the three struct virtio_pci_caps are identical,
      lets drop two of them ;)

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fc004905c5b4b7568aad50087c156a5f4dfae1a7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:37 2015 +0200

      virtio-pci: move cap type to VirtIOPCIRegion

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 54790d71e4adcfaae95dac3c7019b10721e609de
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:36 2015 +0200

      virtio-pci: move virtio_pci_add_mem_cap call to virtio_pci_modern_region_map

      Also fill offset and length automatically,
      from VirtIOPCIRegion->offset and region size.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a3cc2e81592aba6d818005c078b94b16ba47a02c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:35 2015 +0200

      virtio-pci: add virtio_pci_modern_region_map()

      Add function to map modern virtio regions.
      Add offset to VirtIOPCIRegion.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1141ce2190c85daacfa9b874476651ed0f7dc6df
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:34 2015 +0200

      virtio-pci: add virtio_pci_modern_regions_init()

      Add init function for the modern pci regions,
      move over the init code.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 588255ad5021f06789f438f7b045015c54e30841
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:33 2015 +0200

      virtio-pci: add struct VirtIOPCIRegion for virtio-1 regions

      For now just place the MemoryRegion there,
      following patches will add more.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 40de55affda76392627e68d3b1ba5a6a11c492bc
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:32 2015 +0200

      virtio-balloon: switch to virtio_add_feature

      This was missed during the conversion of feature bit manipulation.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit fbdc6892dd8a842a3d86b8315ff56399e0387b74
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:31 2015 +0200

      virtio_balloon: header update

      add modern header

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 975acc0ae6d60260859884a9235ae3c62e2969a2
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 12:34:30 2015 +0200

      virtio-pci: correctly set host notifiers for modern bar

      Currently, during host notifier set. We only add eventfd for legacy
      bar, this is not correct since:

      - Non-transitional device does not have legacy bar, so qemu will crash
        since proxy->bar was not initialized.
      - Modern device uses modern bar and notify cap to notify the device,
        we should add eventfd for proxy->notify.

      So this patch fixes the above two issues by adding eventfd based on
      whether legacy or modern device were supported.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4e93a68eb369b2f7adbef7a4f6afd7a30a0ed927
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:29 2015 +0200

      virtio-pci: make modern bar 64bit + prefetchable

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 23c5e3977502a1b57fa2d8cf8cf4b5c9e45f0d1f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:28 2015 +0200

      virtio-pci: change & document virtio pci bar layout.

      This patch adds variables for the pci bars (to get rid of the magic
      numbers in the code) and moves the modern virtio bar to region 4 so
      regions 2+3 are kept free.  virtio-vga wants use them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8aca0d75869f8ad0aa0032c50d8c85dcad65302f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:27 2015 +0200

      virtio-pci: make QEMU_VIRTIO_PCI_QUEUE_MEM_MULT smaller

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit e266d421490e0ae83044bbebb209b2d3650c0ba6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jun 4 12:34:26 2015 +0200

      virtio-pci: add flags to enable/disable legacy/modern

      Add VIRTIO_PCI_FLAG_DISABLE_LEGACY and VIRTIO_PCI_FLAG_DISABLE_MODERN
      for VirtIOPCIProxy->flags.  Also add properties for them.  They can be
      used to disable modern (virtio 1.0) or legacy (virtio 0.9) modes.

      By default only legacy is advertized, modern will be turned on by
      default once all remaining spec compilance issues are addressed.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 54c720d49d3f9741b52ac95c65a5cc990254a5d8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:25 2015 +0200

      virtio-pci: switch to modern accessors for 1.0

      virtio 1.0 config space is in LE format for all
      devices, use modern wrappers when accessed through
      the 1.0 BAR.

      Reported-by: Rusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit adfb743c90c7aa5e92907ce875e4f35747ee1963
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:24 2015 +0200

      virtio: add modern config accessors

      virtio 1.0 defines config space as LE,
      as opposed to pre-1.0 which was native endian.

      Add API for transports to execute word/dword accesses in
      little endian format - will be useful for mmio
      and pci (byte access is also wrapped, for completeness).

      For simplicity, we still keep config in host native
      endian format, byteswap to LE on guest access.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8f059081d93f1802480059d1d49fe5c1d32f60c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:23 2015 +0200

      virtio: generation counter support

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit dfb8e184db758bff275f94f7aa634300886cfe21
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:22 2015 +0200

      virtio-pci: initial virtio 1.0 support

      This is somewhat functional.  With this, and linux driver from my tree,
      I was able to use virtio net as virtio 1.0 device for light browsing.

      At the moment, dataplane and vhost code is
      still missing.

      Based on Cornelia's virtio 1.0 patchset:
          Date: Thu, 11 Dec 2014 14:25:02 +0100
          From: Cornelia Huck <cornelia.huck@de.ibm.com>
          To: virtualization@lists.linux-foundation.org, qemu-devel@nongnu.org
          Cc: rusty@rustcorp.com.au, thuth@linux.vnet.ibm.com, mst@redhat.com,
          Cornelia Huck <cornelia.huck@de.ibm.com>
          Subject: [PATCH RFC v6 00/20] qemu: towards virtio-1 host support
          Message-Id: <1418304322-7546-1-git-send-email-cornelia.huck@de.ibm.com>

      which is itself still missing some core bits.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit c17bef33601737e24a3d53259ddb6db28ac4d6d2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:21 2015 +0200

      linux-headers: add virtio_pci

      Easier than duplicating code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9a2ba82302bea7faf3b9579f9168b89c73ae34ad
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:20 2015 +0200

      vhost: 64 bit features

      Make sure that all vhost interfaces use 64 bit features, as the virtio
      core does, and make sure to use ULL everywhere possible to be on the
      safe side.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b1506132001eee6b11cf23b5968cd66ec141a9ed
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Jun 4 12:34:19 2015 +0200

      vhost_net: add version_1 feature

      Add VERSION_1 to list of features that we should
      test at the backend.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit df91055db5c9cee93d70ca8c08d72119a240b987
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:18 2015 +0200

      virtio-net: enable virtio 1.0

      virtio-net (non-vhost) now should have everything in place to support
      virtio 1.0: let's enable the feature bit for it.

      Note that VIRTIO_F_VERSION_1 is technically a transport feature; once
      every device is ready for virtio 1.0, we can move setting this
      feature bit out of the individual devices.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit bb9d17f831fa8e70494eab8421d83a542e3d8508
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:17 2015 +0200

      virtio-net: support longer header

      virtio-1 devices always use num_buffers in the header, even if
      mergeable rx buffers have not been negotiated.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6a3cddb22d3f0f729e267d45f350ae31bdebbcf
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:16 2015 +0200

      virtio-net: no writeable mac for virtio-1

      Devices operating as virtio 1.0 may not allow writes to the mac
      address in config space.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0b352fd680e1ca7827ddea47b5e9b603320913b6
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:15 2015 +0200

      virtio: allow to fail setting status

      virtio-1 allow setting of the FEATURES_OK status bit to fail if
      the negotiated feature bits are inconsistent: let's fail
      virtio_set_status() in that case and update virtio-ccw to post an
      error to the guest.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6c0196d702e8482a17638ee79f45ce27cdd1ef5d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:14 2015 +0200

      virtio: disallow late feature changes for virtio-1

      For virtio-1 devices, the driver must not attempt to set feature bits
      after it set FEATURES_OK in the device status. Simply reject it in
      that case.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit f5a5628cf0b65b223fa0c9031714578dfac4cf04
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:13 2015 +0200

      dataplane: allow virtio-1 devices

      Handle endianness conversion for virtio-1 virtqueues correctly.

      Note that dataplane now needs to be built per-target.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit ab223c9518e8c7eb542ef3133de1a34475b69790
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:12 2015 +0200

      virtio: allow virtio-1 queue layout

      For virtio-1 devices, we allow a more complex queue layout that doesn't
      require descriptor table and rings on a physically-contigous memory area:
      add virtio_queue_set_rings() to allow transports to set this up.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3c185597c86b8cd0a07c46e7a5bd5aac28bb7200
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Jun 4 12:34:11 2015 +0200

      virtio: endianness checks for virtio 1.0 devices

      Add code that checks for the VERSION_1 feature bit in order to make
      decisions about the device's endianness. This allows us to support
      transitional devices.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3974c9d8ccfccbd81edc9df271fcae7082f3921d
  Merge: eed8a8f 5efed5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 16:52:34 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-fw_cfg-20150610-1' into staging

      fw_cfg: drop write support, qemu cmdline support, bugfixes.
      bios-tables-test: fix smbios test.

      # gpg: Signature made Wed Jun 10 07:29:53 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-fw_cfg-20150610-1:
        bios-tables-test: handle false-positive smbios signature matches
        fw_cfg: insert fw_cfg file blobs via qemu cmdline
        fw_cfg: prohibit insertion of duplicate fw_cfg file names
        fw_cfg: prevent selector key conflict
        fw_cfg: remove support for guest-side data writes
        fw_cfg: fix FW_CFG_BOOT_DEVICE update on ppc and sparc
        fw_cfg: add fw_cfg_modify_i16 (update) method
        QemuOpts: increase number of vm_config_groups

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit eed8a8f572e659c85f8711d79c20da95021e06e2
  Merge: e015fe0 7a8d15d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 15:46:39 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150609.0' into staging

      Initial VFIO platform device support, v2 (Eric Auger, et al.)

      # gpg: Signature made Tue Jun  9 15:25:40 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150609.0:
        hw/vfio/platform: calxeda xgmac device
        hw/vfio/platform: add irq assignment
        hw/vfio/platform: vfio-platform skeleton

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e015fe008a3a8901913248cdb50c62dba795c588
  Merge: b041114 9f7c594
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jun 10 15:10:14 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/CVE-2015-3209-pcnet-tx-buffer-fix-pull-request' into staging

      # gpg: Signature made Wed Jun 10 15:04:11 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/CVE-2015-3209-pcnet-tx-buffer-fix-pull-request:
        pcnet: force the buffer access to be in bounds during tx

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f7c594c006289ad41169b854d70f5da6e400a2a
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Sun May 24 10:53:44 2015 +0200

      pcnet: force the buffer access to be in bounds during tx

      4096 is the maximum length per TMD and it is also currently the size of
      the relay buffer pcnet driver uses for sending the packet data to QEMU
      for further processing. With packet spanning multiple TMDs it can
      happen that the overall packet size will be bigger than sizeof(buffer),
      which results in memory corruption.

      Fix this by only allowing to queue maximum sizeof(buffer) bytes.

      This is CVE-2015-3209.

      [Fixed 3-space indentation to QEMU's 4-space coding standard.
      --Stefan]

      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Reported-by: Matt Tait <matttait@google.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 24bfa207efb9b9d591552eefc1f414ff33ef0eac
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 23:05:58 2015 -0400

      vhost: put log correctly in vhost_dev_start()

      We allocate an dummy log even if the size is zero. So we should put it
      unconditionally too.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 62232bf48456bda4058ceae05851bc58c1032338
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Sep 10 14:12:28 2014 +0200

      virtio-gpu/2d: add virtio gpu core code

      This patch adds the core code for virtio gpu emulation,
      covering 2d support.

      Written by Dave Airlie and Gerd Hoffmann.

      Signed-off-by: Dave Airlie <airlied@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 53476e07d299b7fc33fa480db6bd9a6b1e2e8a97
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri May 22 15:37:33 2015 +0200

      virtio: update headers, add virtio-gpu (2d)

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 220869e12d96bfb0b44d8e47394587c30e9a093f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:50:46 2015 +0200

      stdvga: factor out mmio subregion init

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf45ec6a52af77ec2cdfe229b6f496a29b8f7886
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:09:49 2015 +0200

      stdvga: pass VGACommonState instead of PCIVGAState

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 24cdff7c8278849747035f9554f8c538beabf949
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 09:03:54 2015 +0200

      stdvga: fix offset in pci_vga_ioport_read

      Simliar to pci_vga_ioport_write.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5efed5a172881f601ac3c57c22ec5c5721f895be
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon May 18 08:47:24 2015 -0400

      bios-tables-test: handle false-positive smbios signature matches

      It has been reported that sometimes the .rodata section of SeaBIOS,
      containing the constant string against which the SMBIOS signature
      ends up being compared, also falls within the guest f-segment. In
      that case, the test obviously fails, unless we continue searching
      for the *real* SMBIOS entry point.

      Rather than stopping at the first match for the SMBIOS signature
      ("_SM_") in the f-segment (0xF0000-0xFFFFF), continue scanning
      until either a valid entry point table is found, or the f-segment
      has been exhausted.

      Reported-by: Bruce Rogers <brogers@suse.com>
      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Tested-by: Bruce Rogers <brogers@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 81b2b81062612ebeac4cd5333a3b15c7d79a5a3d
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:53 2015 -0400

      fw_cfg: insert fw_cfg file blobs via qemu cmdline

      Allow user supplied files to be inserted into the fw_cfg
      device before starting the guest. Since fw_cfg_add_file()
      already disallows duplicate fw_cfg file names, qemu will
      exit with an error message if the user supplies multiple
      blobs with the same fw_cfg file name, or if a blob name
      collides with a fw_cfg name programmatically added from
      within the QEMU source code. A warning message will be
      printed if the fw_cfg item name does not begin with the
      prefix "opt/", which is recommended for external, user
      provided blobs.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0eb973f91521c6bcb6399d25327711d083f6eb10
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:52 2015 -0400

      fw_cfg: prohibit insertion of duplicate fw_cfg file names

      Exit with an error (instead of simply logging a trace event)
      whenever the same fw_cfg file name is added multiple times via
      one of the fw_cfg_add_file[_callback]() host-side API calls.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0f9b214139d11ef058fa0f1c11c89e94fa6ef95d
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:51 2015 -0400

      fw_cfg: prevent selector key conflict

      Enforce a single assignment of data for each distinct selector key.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 023e3148567ac898c7258138f8e86c3c2bb40d07
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Wed Apr 29 11:21:50 2015 -0400

      fw_cfg: remove support for guest-side data writes

      From this point forward, any guest-side writes to the fw_cfg
      data register will be treated as no-ops. This patch also removes
      the unused host-side API function fw_cfg_add_callback(), which
      allowed the registration of a callback to be executed each time
      the guest completed a full overwrite of a given fw_cfg data item.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 48779e501810c5046ff8af7b9cf9c99bec2928a1
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon Jun 8 14:10:45 2015 -0400

      fw_cfg: fix FW_CFG_BOOT_DEVICE update on ppc and sparc

      On ppc, sparc, and sparc64, the value of the FW_CFG_BOOT_DEVICE 16bit
      fw_cfg entry is repeatedly modified from a series of callbacks, which
      currently results in the previous value's dynamically allocated memory
      being leaked.

      This patch switches updating to the new fw_cfg_modify_i16() call, which
      does not cause memory leaks.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1edd34b638f73d39a175fbc4f9ad5c97800d7470
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Mon Jun 8 14:10:44 2015 -0400

      fw_cfg: add fw_cfg_modify_i16 (update) method

      Allow the ability to modify the value of an existing 16-bit integer
      fw_cfg item.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1ceaefbd0d09642fcff05c6b8da49ad8fbc050cb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri May 29 14:37:54 2015 +0200

      QemuOpts: increase number of vm_config_groups

      Adding the fw_cfg cmd line support patch by
      Gabriel L. Somlo hits the limit.

      Fix this by making the array larger.

      Cc: Gabriel L. Somlo <somlo@cmu.edu>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b0411142f482df92717f8b4a3b746081a62b724f
  Merge: 44ee94e 36e60ef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 15:29:34 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150609' into staging

      Collected TCG patches

      # gpg: Signature made Tue Jun  9 15:06:18 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150609:
        tcg/optimize: rename tcg_constant_folding
        tcg/optimize: fold constant test in tcg_opt_gen_mov
        tcg/optimize: fold temp copies test in tcg_opt_gen_mov
        tcg/optimize: remove opc argument from tcg_opt_gen_mov
        tcg/optimize: remove opc argument from tcg_opt_gen_movi
        tcg: fix dead computation for repeated input arguments
        tcg: fix register allocation with two aliased dead inputs
        tcg: Handle MO_AMASK in tcg_dump_ops
        tcg: Mask TCGMemOp appropriately for indexing

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7a8d15d7702444be715b6ae32574659483c0c158
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 9 09:00:07 2015 +0100

      hw/vfio/platform: calxeda xgmac device

      The platform device class has become abstract. This patch introduces
      a calxeda xgmac device that derives from it.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 36e60ef6ac5d8a262d0fbeedfdb2b588514cb1ea
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:27 2015 +0200

      tcg/optimize: rename tcg_constant_folding

      The tcg_constant_folding folding ends up doing all the optimizations
      (which is a good thing to avoid looping on all ops multiple time), so
      make it clear and just rename it tcg_optimize.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-6-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 97a79eb70dd35a24fda87d86196afba5e6f21c5d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Fri Jun 5 11:19:18 2015 +0200

      tcg/optimize: fold constant test in tcg_opt_gen_mov

      Most of the calls to tcg_opt_gen_mov are preceeded by a test to check if
      the source temp is a constant. Fold that into the tcg_opt_gen_mov
      function.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433495958-9508-1-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 5365718a9afeeabde3784d82a542f8ad909b18cf
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:25 2015 +0200

      tcg/optimize: fold temp copies test in tcg_opt_gen_mov

      Each call to tcg_opt_gen_mov is preceeded by a test to check if the
      source and destination temps are copies. Fold that into the
      tcg_opt_gen_mov function.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-4-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8d6a91602ea824ef4435ea38fd475387eecc098c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:24 2015 +0200

      tcg/optimize: remove opc argument from tcg_opt_gen_mov

      We can get the opcode using the TCGOp pointer. It needs to be
      dereferenced, but it's anyway done a few lines below to write
      the new value.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ebd27391b00cdafc81e0541a940686137b3b48df
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:53:23 2015 +0200

      tcg/optimize: remove opc argument from tcg_opt_gen_movi

      We can get the opcode using the TCGOp pointer. It needs to be
      dereferenced, but it's anyway done a few lines below to write
      the new value.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447607-31184-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c19f47bf5e8fe3dbd10206a52d0e6e348f803933
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:47:08 2015 +0200

      tcg: fix dead computation for repeated input arguments

      When the same temp is used twice or more as an input argument to a TCG
      instruction, the dead computation code doesn't recognize the second use
      as a dead temp. This is because the temp is marked as live in the same
      loop where dead inputs are checked.

      The fix is to split the loop in two parts. This avoid emitting a move
      and using a register for the movcond instruction when used as "move if
      true" on x86-64. This might bring more improvements on RISC TCG targets
      which don't have outputs aliased to inputs.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447228-29425-3-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7e1df267a7e8b39fc0cf1d84d2afc2e88ccbfeac
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Thu Jun 4 21:47:07 2015 +0200

      tcg: fix register allocation with two aliased dead inputs

      For TCG ops with two outputs registers (add2, sub2, div2, div2u), when
      the same input temp is used for the two inputs aliased to the two
      outputs, and when these inputs are both dead, the register allocation
      code wrongly assigned the same register to the same output.

      This happens for example with sub2 t1, t2, t3, t3, t4, t5, when t3 is
      not used anymore after the TCG op.  In that case the same register is
      used for t1, t2 and t3.

      The fix is to look for already allocated aliased input when allocating
      a dead aliased input and check that the register is not already
      used.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Message-Id: <1433447228-29425-2-git-send-email-aurelien@aurel32.net>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 59c4b7e8dfab0cdc41434fedbf2686222f541e57
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jun 1 14:38:56 2015 -0700

      tcg: Handle MO_AMASK in tcg_dump_ops

      Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Tested-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 2b7ec66f025263a5331f37d5ad78a625496fd7bd
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri May 29 09:16:51 2015 -0700

      tcg: Mask TCGMemOp appropriately for indexing

      The addition of MO_AMASK means that places that used inverted masks
      need to be changed to use positive masks, and places that failed to
      mask the intended bits need updating.

      Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Tested-by: Yongbok Kim <yongbok.kim@imgtec.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 44ee94e4862603c2b1b21718effc5f17b39f43bc
  Merge: b781a60 6028ef0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 11:07:41 2015 +0100

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150609' into staging

      s390x/virtio-ccw: migration and virtio for 2.4

      1. Migration fixups
      2. virtio 9pfs

      # gpg: Signature made Tue Jun  9 09:00:05 2015 BST using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150609:
        s390x/migration: add comment about floating point migration
        s390x/kvm: always ignore empty vcpu interrupt state
        virtio-ccw/migration: Migrate config vector for virtio devices
        virtio-ccw: add support for 9pfs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b781a60b1054e06de6733b75dd1489afff9c3276
  Merge: ee09f84 8190483
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 9 10:05:29 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-06-09' into staging

      Error reporting patches

      # gpg: Signature made Tue Jun  9 06:42:15 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-06-09:
        vhost-user: Improve -netdev/netdev_add/-net/... error reporting
        QemuOpts: Convert qemu_opt_foreach() to Error
        QemuOpts: Drop qemu_opt_foreach() parameter abort_on_failure
        blkdebug: Simplify passing of Error through qemu_opts_foreach()
        QemuOpts: Convert qemu_opts_foreach() to Error
        QemuOpts: Drop qemu_opts_foreach() parameter abort_on_failure
        vl: Fail right after first bad -object
        vl: Print -device help at most once
        vl: Report failure to sandbox at most once

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08d49df0dbaacc220a099dbfb644e1dc0eda57be
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Jun 8 11:12:15 2015 +0200

      sdl2: fix crash in handle_windowevent() when restoring the screen size

      The Ctrl-Alt-u keyboard shortcut restores the screen to its original
      size. In the SDL2 UI this is done by destroying the window and
      creating a new one. The old window emits SDL_WINDOWEVENT_HIDDEN when
      it's destroyed, but trying to call SDL_GetWindowFromID() from that
      event's window ID returns a null pointer. handle_windowevent() assumes
      that the pointer is never null so it results in a crash.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 6028ef075791913228c36f10cb270f1f52e9f076
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Jun 8 12:21:24 2015 +0200

      s390x/migration: add comment about floating point migration

      commit 46c804def4bd ("s390x: move fpu regs into a subsection
      of the vmstate") moved the fprs into a subsection and bumped
      the version number. This will allow to not transfer fprs in
      the future if necessary. Add a comment to mark the return true
      as intentional.

      CC: Juan Quintela <quintela@redhat.com>
      CC: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Message-Id: <1433758884-2997-1-git-send-email-borntraeger@de.ibm.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>

  commit 8190483196148f765c65785876f7b893d64b6cdd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 14:17:16 2015 +0100

      vhost-user: Improve -netdev/netdev_add/-net/... error reporting

      When -netdev vhost-user fails, it first reports a specific error, then
      one or more generic ones, like this:

          $ qemu-system-x86_64 -netdev vhost-user,id=foo,chardev=xxx
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: chardev "xxx" not found
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: No suitable chardev found
          qemu-system-x86_64: -netdev vhost-user,id=foo,chardev=xxx: Device 'vhost-user' could not be initialized

      With the command line, the messages go to stderr.  In HMP, they go to
      the monitor.  In QMP, the last one becomes the error reply, and the
      others go to stderr.

      Convert net_init_vhost_user() and its helpers to Error.  This
      suppresses the unwanted unspecific error messages, and makes the
      specific error the QMP error reply.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 71df1d833776647fc12f5bbcd6d6fe4c5e931094
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 08:40:25 2015 +0100

      QemuOpts: Convert qemu_opt_foreach() to Error

      Retain the function value for now, to permit selective conversion of
      its callers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1640b200d53e3d981f12a192fe84b7bb7958c065
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 07:45:10 2015 +0100

      QemuOpts: Drop qemu_opt_foreach() parameter abort_on_failure

      When the argument is non-zero, qemu_opt_foreach() stops on callback
      returning non-zero, and returns that value.

      When the argument is zero, it doesn't stop, and returns the callback's
      value from the last iteration.

      The two callers that pass zero could just as well pass one:

      * qemu_spice_init()'s callback add_channel() either returns zero or
        exit()s.

      * config_write_opts()'s callback config_write_opt() always returns
        zero.

      Drop the parameter, and always stop.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8809cfc38e4e93884d664bb00108fc71b423f589
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:38:42 2015 +0100

      blkdebug: Simplify passing of Error through qemu_opts_foreach()

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit 28d0de7a4fb721b06de72970bd163f5183c2188b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:35:14 2015 +0100

      QemuOpts: Convert qemu_opts_foreach() to Error

      Retain the function value for now, to permit selective conversion of
      its callers.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit a4c7367f7dd9348f94dc4298571ed515b8160a27
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 11:07:24 2015 +0100

      QemuOpts: Drop qemu_opts_foreach() parameter abort_on_failure

      When the argument is non-zero, qemu_opts_foreach() stops on callback
      returning non-zero, and returns that value.

      When the argument is zero, it doesn't stop, and returns the bit-wise
      inclusive or of all the return values.  Funky :)

      The callers that pass zero could just as well pass one, because their
      callbacks can't return anything but zero:

      * qemu_add_globals()'s callback qdev_add_one_global()

      * qemu_config_write()'s callback config_write_opts()

      * main()'s callbacks default_driver_check(), drive_enable_snapshot(),
        vnc_init_func()

      Drop the parameter, and always stop.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Kevin Wolf <kwolf@redhat.com>

  commit 8122928a52248e28513c79d9b9929c6d20c866ea
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:08:36 2015 +0100

      vl: Fail right after first bad -object

      Failure to create an object with -object is a fatal error.  However,
      we delay the actual exit until all -object are processed.  On the one
      hand, this permits detection of genuine additional errors.  On the
      other hand, it can muddy the waters with uninteresting additional
      errors, e.g. when a later -object tries to reference a prior one that
      failed.

      We generally stop right on the first bad option, so do that for
      -object as well.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 8416abb3b0f42132fc6346c439ec543635075135
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 13:02:03 2015 +0100

      vl: Print -device help at most once

      We print it once for each -device help.  Not helpful.  Stop after the
      first one.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 092b21aa7edf7962248e731cddaf5350d268e333
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 12:59:43 2015 +0100

      vl: Report failure to sandbox at most once

      It's reported once per -sandbox on.  Stop on the first failure, like
      we do for other options.

      Not fixed: "-sandbox on -sandbox off" should leave the sandbox off.
      It doesn't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 38559979bf0095a586f61bc9e028df36673f21a1
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 8 09:25:26 2015 -0600

      hw/vfio/platform: add irq assignment

      This patch adds the code requested to assign interrupts to
      a guest. The interrupts are mediated through user handled
      eventfds only.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 0ea2730bef0b764ce87f5d6859f9b1eac6069250
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Jun 8 09:25:25 2015 -0600

      hw/vfio/platform: vfio-platform skeleton

      Minimal VFIO platform implementation supporting register space
      user mapping but not IRQ assignment.

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Tested-by: Vikram Sethi <vikrams@codeaurora.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ee09f84e6bf5383a23c9624115c26b72aa1e076c
  Merge: 2e29dd7 24a3142
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 8 15:57:41 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      * KVM error improvement from Laurent
      * CONFIG_PARALLEL fix from Mirek
      * Atomic/optimized dirty bitmap access from myself and Stefan
      * BUILD_DIR convenience/bugfix from Peter C
      * Memory leak fix from Shannon
      * SMM improvements (though still TCG only) from myself and Gerd, acked by mst

      # gpg: Signature made Fri Jun  5 18:45:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (62 commits)
        update Linux headers from kvm/next
        atomics: add explicit compiler fence in __atomic memory barriers
        ich9: implement SMI_LOCK
        q35: implement TSEG
        q35: add test for SMRAM.D_LCK
        q35: implement SMRAM.D_LCK
        q35: add config space wmask for SMRAM and ESMRAMC
        q35: fix ESMRAMC default
        q35: implement high SMRAM
        hw/i386: remove smram_update
        target-i386: use memory API to implement SMRAM
        hw/i386: add a separate region that tracks the SMRAME bit
        target-i386: create a separate AddressSpace for each CPU
        vl: run "late" notifiers immediately
        qom: add object_property_add_const_link
        vl: allow full-blown QemuOpts syntax for -global
        pflash_cfi01: add secure property
        pflash_cfi01: change to new-style MMIO accessors
        pflash_cfi01: change big-endian property to BIT type
        target-i386: wake up processors that receive an SMI
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e29dd7c44db30e3d3c108ab2a622cbdac6d16f0
  Merge: 0daba1f 0ba9888
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 8 14:07:32 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Jun  5 20:59:07 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        macio: remove remainder_len DBDMA_io property
        macio: update comment/constants to reflect the new code
        macio: switch pmac_dma_write() over to new offset/len implementation
        macio: switch pmac_dma_read() over to new offset/len implementation
        fdc-test: Test state for existing cases more thoroughly
        fdc: Fix MSR.RQM flag
        fdc: Disentangle phases in fdctrl_read_data()
        fdc: Code cleanup in fdctrl_write_data()
        fdc: Use phase in fdctrl_write_data()
        fdc: Introduce fdctrl->phase
        fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()
        fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0daba1f037ab85be7a9ff7ee37ba6b644c5e7977
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Jun 5 11:05:03 2015 +0200

      machine: Drop use of DEFAULT_RAM_SIZE in help text

      As of commit 076b35b5a (machine: add default_ram_size to machine
      class) we no longer have a global default ram size, but instead
      machine specific defaults.  When invoking qemu --help we don't know
      which machine you selected, so we can't tell the user the default RAM
      size in the help text anymore now.

      Thus I don't see an easy way to expose the default ram size to the
      user in the help text.  The easiest option IMHO is to just drop this
      piece of information.

      Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>
      Acked-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Acked-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Message-id: 1433495103-62084-1-git-send-email-agraf@suse.de
      [PMM: rewrapped long commit message lines]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 779cec4d20907cbccb26fbf5f5c19c6cdee33eff
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jun 8 10:44:30 2015 +0200

      monitor: Fix QMP ABI breakage around "id"

      Commit 65207c5 accidentally dropped a line of code we need along with
      a comment that became wrong then.  This made QMP reject "id":

          {"execute": "system_reset", "id": "1"}
          {"error": {"class": "GenericError", "desc": "QMP input object member 'id' is unexpected"}}

      Put the lost line right back, so QMP again accepts and returns "id",
      as promised by the ABI:

          {"execute": "system_reset", "id": "1"}
          {"return": {}, "id": "1"}

      Reported-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Tested-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Tested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1433753070-12632-2-git-send-email-armbru@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 24a314269281a175b5540b3b6a8981ed2e8220e1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jun 4 16:38:29 2015 +0200

      update Linux headers from kvm/next

      This is kvm.git commit 05ff30bb56c6b3d3000519d6e02ed35678ddae3b.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3bbf572345c65813f86a8fc434ea1b23beb08e16
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jun 3 14:21:20 2015 +0200

      atomics: add explicit compiler fence in __atomic memory barriers

      __atomic_thread_fence does not include a compiler barrier; in the
      C++11 memory model, fences take effect in combination with other
      atomic operations.  GCC implements this by making __atomic_load and
      __atomic_store access memory as if the pointer was volatile, and
      leaves no trace whatsoever of acquire and release fences in the
      compiler's intermediate representation.

      In QEMU, we want memory barriers to act on all memory, but at the same
      time we would like to use __atomic_thread_fence for portability reasons.
      Add compiler barriers manually around the __atomic_thread_fence.

      Message-Id: <1433334080-14912-1-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 11e66a15a084cb0820dba13f4ea3b15b0512fd39
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed May 6 10:58:30 2015 +0200

      ich9: implement SMI_LOCK

      Add write mask for the smi enable register, so we can disable write
      access to certain bits.  Open all bits on reset.  Disable write access
      to GBL_SMI_EN when SMI_LOCK (in ich9 lpc pci config space) is set.
      Write access to SMI_LOCK itself is disabled too.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bafc90bdc594a4d04db846bd8712bdcec59678a8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Apr 20 10:55:09 2015 +0200

      q35: implement TSEG

      TSEG provides larger amounts of SMRAM than the 128 KB available with
      legacy SMRAM and high SMRAM.

      Route access to tseg into nowhere when enabled, for both cpus and
      busmaster dma, and add tseg window to smram region, so cpus can access
      it in smm mode.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66e2ec2417e72edea1df5fb340b210100b0571b7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 15:11:36 2015 +0200

      q35: add test for SMRAM.D_LCK

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      [Fix compilation of the newly introduced test. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 68c77acfb18d28933f17b1c2a842bd936ce7223b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 14:03:22 2015 +0200

      q35: implement SMRAM.D_LCK

      Once the SMRAM.D_LCK bit has been set by the guest several bits in SMRAM
      and ESMRAMC become readonly until the next machine reset.  Implement
      this by updating the wmask accordingly when the guest sets the lock bit.
      As the lock it itself is locked down too we don't need to worry about
      the guest clearing the lock bit.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b66a67d7519cb7f980885af5391b1103c42e9b6d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 15 16:48:12 2015 +0200

      q35: add config space wmask for SMRAM and ESMRAMC

      Not all bits in SMRAM and ESMRAMC can be changed by the guest.
      Add wmask defines accordingly and set them in mch_reset().

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7744752402d11cebe4c1d4079dcd40d3145eb37b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 15 16:43:24 2015 +0200

      q35: fix ESMRAMC default

      The cache bits in ESMRAMC are hardcoded to 1 (=disabled) according to
      the q35 mch specs.  Add and use a define with this default.

      While being at it also update the SMRAM default to use the name (no code
      change, just makes things a bit more readable).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 64130fa4a1514ae7a580b8d46290a11784770600
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 17:13:01 2015 +0200

      q35: implement high SMRAM

      When H_SMRAME is 1, low memory at 0xa0000 is left alone by
      SMM, and instead the chipset maps the 0xa0000-0xbffff window at
      0xfeda0000-0xfedbffff.  This affects both the "non-SMM" view controlled
      by D_OPEN and the SMM view controlled by G_SMRAME, so add two new
      MemoryRegions and toggle the enabled/disabled state of all four
      in mch_update_smram.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3de70c0899db2712a5ae321093aa6173d6f76706
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:14:28 2015 +0200

      hw/i386: remove smram_update

      It's easier to inline it now that most of its work is done by the CPU
      (rather than the chipset) through /machine/smram and the memory API.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f809c605122df291bbb9004dc487bde0969134b5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:12:25 2015 +0200

      target-i386: use memory API to implement SMRAM

      Remove cpu_smm_register and cpu_smm_update.  Instead, each CPU
      address space gets an extra region which is an alias of
      /machine/smram.  This extra region is enabled or disabled
      as the CPU enters/exits SMM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fe6567d5fddfb7501a352c5e080a9eecf7b89177
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:10:22 2015 +0200

      hw/i386: add a separate region that tracks the SMRAME bit

      This region is exported at /machine/smram.  It is "empty" if
      SMRAME=0 and points to SMRAM if SMRAME=1.  The CPU will
      enable/disable it as it enters or exits SMRAM.

      While touching nearby code, the existing memory region setup was
      slightly inconsistent.  The smram_region is *disabled* in order to open
      SMRAM (because the smram_region shows the low VRAM instead of the RAM
      at 0xa0000).  Because SMRAM is closed at startup, the smram_region must
      be enabled when creating the i440fx or q35 devices.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2001d0cd6d55e5efa9956fa8ff8b89034d6a4329
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:11:09 2015 +0200

      target-i386: create a separate AddressSpace for each CPU

      Different CPUs can be in SMM or not at the same time, thus they
      will see different things where the chipset places SMRAM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 71cdd1cb914e24000273bbbfa5fb226cdb8ea265
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 14:01:06 2015 +0200

      vl: run "late" notifiers immediately

      If a machine_init_done notifier is added late, as part of a hot-plugged
      device, run it immediately.
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fb9e7e334b54350e8e3b62bd7892b78f63a9d848
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 18:29:00 2015 +0200

      qom: add object_property_add_const_link

      Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3751d7c43f795b45ffdb9429cfb09c6beea55c68
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 9 14:16:19 2015 +0200

      vl: allow full-blown QemuOpts syntax for -global

      -global does not work for drivers that have a dot in their name, such as
      cfi.pflash01.  This is just a parsing limitation, because such globals
      can be declared easily inside a -readconfig file.

      To allow this usage, support the full QemuOpts key/value syntax for -global
      too, for example "-global driver=cfi.pflash01,property=secure,value=on".
      The two formats do not conflict, because the key/value syntax does not have
      a period before the first equal sign.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f71e42a5c98722d6faa5be84a34fbad90d27dc04
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:09:43 2015 +0200

      pflash_cfi01: add secure property

      When this property is set, MMIO accesses are only allowed with the
      MEMTXATTRS_SECURE attribute.  This is used for secure access to UEFI
      variables stored in flash.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5aa113f0a2c245b0a77865e1dd2445bdd24c3ef8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:00:53 2015 +0200

      pflash_cfi01: change to new-style MMIO accessors

      This is a required step to implement read_with_attrs and write_with_attrs.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e98094221ec336fcfd0c72c66f280f1cabb16c72
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:53:29 2015 +0200

      pflash_cfi01: change big-endian property to BIT type

      Make this consistent with the secure property, added in the next patch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a9bad65d2c1f61af74ce2ff43238d4b20bf81c3a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 19 13:46:47 2015 +0200

      target-i386: wake up processors that receive an SMI

      An SMI should definitely wake up a processor in halted state!
      This lets OVMF boot with SMM on multiprocessor systems, although
      it halts very soon after that with a "CpuIndex != BspIndex"
      assertion failure.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4854f1384176d897747de236f426d020668fa3c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 30 12:02:46 2015 +0200

      target-i386: set G=1 in SMM big real mode selectors

      Because the limit field's bits 31:20 is 1, G should be 1.
      VMX actually enforces this, let's do it for completeness
      in QEMU as well.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9982f74bad70479939491b69522da047a3be5a0d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 11:40:41 2015 +0200

      target-i386: mask NMIs on entry to SMM

      QEMU is not blocking NMIs on entry to SMM.  Implementing this has to
      cover a few corner cases, because:

      - NMIs can then be enabled by an IRET instruction and there
      is no mechanism to _set_ the "NMIs masked" flag on exit from SMM:
      "A special case can occur if an SMI handler nests inside an NMI handler
      and then another NMI occurs. [...] When the processor enters SMM while
      executing an NMI handler, the processor saves the SMRAM state save map
      but does not save the attribute to keep NMI interrupts disabled.

      - However, there is some hidden state, because "If NMIs were blocked
      before the SMI occurred [and no IRET is executed while in SMM], they
      are blocked after execution of RSM."  This is represented by the new
      HF2_SMM_INSIDE_NMI_MASK bit.  If it is zero, NMIs are _unblocked_
      on exit from RSM.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3f7d84648607cc0fcb3812bb4b88978e2a7aa24f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:45:53 2015 +0200

      target-i386: Use correct memory attributes for ioport accesses

      In order to do this, stop using the cpu_in*/out* helpers, and instead
      access address_space_io directly.

      cpu_in* and cpu_out* remain for usage in the monitor, in qtest, and
      in Xen.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b216aa6c0fcbaa8ff4128969c14594896a5485a4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:39:37 2015 +0200

      target-i386: Use correct memory attributes for memory accesses

      These include page table walks, SVM accesses and SMM state save accesses.

      The bulk of the patch is obtained with

         sed -i 's/\(\<[a-z_]*_phys\(_notdirty\)\?\>(cs\)->as,/x86_\1,/'

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f794aa4a2fd772a3ec413c4e478cc23857cfee98
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 14:52:04 2015 +0200

      target-i386: introduce cpu_get_mem_attrs

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d7a0f71d9aac33e58d39fdbe4861d440af44fa8b
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:06 2015 +0200

      icount: print a warning if there is no more deadline in sleep=no mode

      While qemu is running in sleep=no mode, a warning will be printed
      when no timer deadline is set.
      As this mode is intended for getting deterministic virtual time, if no
      timer is set on the virtual clock this determinism is broken.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-4-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f1f4b57e88ff7c9cb20b074ff6106fd8f4397baa
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:05 2015 +0200

      icount: add sleep parameter to the icount option to set icount_sleep mode

      The 'sleep' parameter sets the icount_sleep mode, which is enabled by
      default. To disable it, add the 'sleep=no' parameter (or 'nosleep') to the
      qemu -icount option.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-3-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5045e9d912588a7421ab899ba510025722666fd1
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Fri May 29 17:14:04 2015 +0200

      icount: implement a new icount_sleep mode toggleing real-time cpu sleep

      When the icount_sleep mode is disabled, the QEMU_VIRTUAL_CLOCK runs at the
      maximum possible speed by warping the sleep times of the virtual cpu to the
      soonest clock deadline. The virtual clock will be updated only according
      the instruction counter.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Message-Id: <1432912446-9811-2-git-send-email-victor.clement@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ec05ec26f940564b1e07bf88857035ec27e21dd8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sun Mar 29 09:31:43 2015 +0200

      memory: use mr->ram_addr in "is this RAM?" assertions

      mr->terminates alone doesn't guarantee that we are looking at a RAM region.
      mr->ram_addr also has to be checked, in order to distinguish RAM and I/O
      regions.

      So, do the following:

      1) add a new define RAM_ADDR_INVALID, and test it in the assertions
      instead of mr->terminates

      2) IOMMU regions were not setting mr->ram_addr to a bogus value, initialize
      it in the instance_init function so that the new assertions would fire
      for IOMMU regions as well.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5f2cb94688bd0b2c88e0fc1ac3c4582965b7b106
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:19 2014 +0000

      memory: make cpu_physical_memory_sync_dirty_bitmap() fully atomic

      The fast path of cpu_physical_memory_sync_dirty_bitmap() directly
      manipulates the dirty bitmap.  Use atomic_xchg() to make the
      test-and-clear atomic.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-7-git-send-email-stefanha@redhat.com>
      [Only do xchg on nonzero words. - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03eebc9e3246b9b3f5925aa41f7dfd7c1e467875
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:18 2014 +0000

      memory: replace cpu_physical_memory_reset_dirty() with test-and-clear

      The cpu_physical_memory_reset_dirty() function is sometimes used
      together with cpu_physical_memory_get_dirty().  This is not atomic since
      two separate accesses to the dirty memory bitmap are made.

      Turn cpu_physical_memory_reset_dirty() and
      cpu_physical_memory_clear_dirty_range_type() into the atomic
      cpu_physical_memory_test_and_clear_dirty().

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-6-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 20015f72bda7d2f356c43580a5542a659afedf83
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:17 2014 +0000

      migration: move dirty bitmap sync to ram_addr.h

      The dirty memory bitmap is managed by ram_addr.h and copied to
      migration_bitmap[] periodically during live migration.

      Move the code to sync the bitmap to ram_addr.h where related code lives.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-5-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d114875b9a1c21162f69a12d72f69a22e7bab376
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:16 2014 +0000

      memory: use atomic ops for setting dirty memory bits

      Use set_bit_atomic() and bitmap_set_atomic() so that multiple threads
      can dirty memory without race conditions.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-4-git-send-email-stefanha@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 36546e5b803f6e363906607307f27c489441fd15
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:15 2014 +0000

      bitmap: add atomic test and clear

      The new bitmap_test_and_clear_atomic() function clears a range and
      returns whether or not the bits were set.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-3-git-send-email-stefanha@redhat.com>
      [Test before xchg; then a full barrier is needed at the end just like
       in the previous patch.  The barrier can be avoided if we did at least
       one xchg.  - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9f02cfc84b85929947b32fe1674fbc6a429f332a
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Dec 2 11:23:14 2014 +0000

      bitmap: add atomic set functions

      Use atomic_or() for atomic bitmaps where several threads may set bits at
      the same time.  This avoids the race condition between threads loading
      an element, bitwise ORing, and then storing the element.

      When setting all bits in a word we can avoid atomic ops and instead just
      use an smp_mb() at the end.

      Most bitmap users don't need atomicity so introduce new functions.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-Id: <1417519399-3166-2-git-send-email-stefanha@redhat.com>
      [Avoid barrier in the single word case, use full barrier instead of write.
       - Paolo]
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9460dee4b2258e3990906fb34099481c8334c267
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:41:32 2015 +0100

      memory: do not touch code dirty bitmap unless TCG is enabled

      cpu_physical_memory_set_dirty_lebitmap unconditionally syncs the
      DIRTY_MEMORY_CODE bitmap.  This however is unused unless TCG is
      enabled.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e87f7778b64d4a6a78e16c288c7fdc6c15317d5f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 15:21:39 2015 +0100

      exec: only check relevant bitmaps for cleanliness

      Most of the time, not all bitmaps have to be marked as dirty;
      do not do anything if the interesting ones are already dirty.
      Previously, any clean bitmap would have cause all the bitmaps to be
      marked dirty.

      In fact, unless running TCG most of the time bitmap operations need
      not be done at all, because memory_region_is_logging returns zero.
      In this case, skip the call to cpu_physical_memory_range_includes_clean
      altogether as well.

      With this patch, cpu_physical_memory_set_dirty_range is called
      unconditionally, so there need not be anymore a separate call to
      xen_modified_memory.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 72b47e79cef36ed6ffc718f10e21001d7ec2a66f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:48:25 2015 +0200

      exec: invert return value of cpu_physical_memory_get_clean, rename

      While it is obvious that cpu_physical_memory_get_dirty returns true even if
      a single page is dirty, the same is not true for cpu_physical_memory_get_clean;
      one would expect that it returns true only if all the pages are clean, but
      it actually looks for even one clean page.  (By contrast, the caller of that
      function, cpu_physical_memory_range_includes_clean, has a good name).

      To clarify, rename the function to cpu_physical_memory_all_dirty and return
      true if _all_ the pages are dirty.  This is the opposite of the previous
      meaning, because "all are 1" is the same as "not (any is 0)", so we have to
      modify cpu_physical_memory_range_includes_clean as well.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 58d2707e8713ef17b89b8b4c9ce586c76655a385
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:56:01 2015 +0100

      exec: pass client mask to cpu_physical_memory_set_dirty_range

      This cuts in half the cost of bitmap operations (which will become more
      expensive when made atomic) during migration on non-VRAM regions.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc377bcf617a48233a99a9fe0a26247c38b5cb76
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:20:35 2015 +0200

      translate-all: make less of tb_invalidate_phys_page_range depend on is_cpu_write_access

      is_cpu_write_access is only set if tb_invalidate_phys_page_range is called
      from tb_invalidate_phys_page_fast, and hence from notdirty_mem_write.
      However:

      - the code bitmap can be built directly in tb_invalidate_phys_page_fast
        (unconditionally, since is_cpu_write_access would always be passed as 1);

      - the virtual address is not needed to mark the page as "not containing
        code" (dirty code bitmap = 1), so we can also remove that use of
        is_cpu_write_access.  For calls of tb_invalidate_phys_page_range
        that do not come from notdirty_mem_write, the next call to
        notdirty_mem_write will notice that the page does not contain code
        anymore, and will fix up the TLB entry.

      The parameter needs to remain in order to guard accesses to cpu->mem_io_pc.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9564f52da7eb061326956ed9a468935e3352512d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:24:54 2015 +0200

      cputlb: remove useless arguments to tlb_unprotect_code_phys, rename

      These days modification of the TLB is done in notdirty_mem_write,
      so the virtual address and env pointer as unnecessary.

      The new name of the function, tlb_unprotect_code, is consistent with
      tlb_protect_code.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 358653391b0c0beaa0e3f9e28304e1918cd223b3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:20:35 2015 +0200

      translate-all: remove unnecessary argument to tb_invalidate_phys_range

      The is_cpu_write_access argument is always 0, remove it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1652b974766401743879d78f796f44b8929b0787
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 14:15:48 2015 +0200

      exec: move functions to translate-all.h

      Remove them from the sundry exec-all.h header, since they are only used by
      the TCG runtime in exec.c and user-exec.c.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 845b6214a309fa58a4405050bf8313e19fde5c91
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:45:53 2015 +0100

      exec: use memory_region_get_dirty_log_mask to optimize dirty tracking

      The memory API can now return the exact set of bitmaps that have to
      be tracked.  Use it instead of the in_migration variable.

      In the next patches, we will also use it to set only DIRTY_MEMORY_VGA
      or DIRTY_MEMORY_MIGRATION if necessary.  This can make a difference
      for dataplane, especially after the dirty bitmap is changed to use
      more expensive atomic operations.

      Of some interest is the change to stl_phys_notdirty.  When migration
      was introduced, stl_phys_notdirty was changed to effectively behave
      as stl_phys during migration.  In fact, if one looks at the function as it
      was in the beginning (commit 8df1cd0, physical memory access functions,
      2005-01-28), at the time the dirty bitmap was the equivalent of
      DIRTY_MEMORY_CODE nowadays; hence, the function simply should not touch
      the dirty code bits.  This patch changes it to do the intended thing.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 49dfcec40349245ad365964468b67e132c3cedc7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 11:35:19 2015 +0100

      ram_addr: tweaks to xen_modified_memory

      Invoke xen_modified_memory from cpu_physical_memory_set_dirty_range_nocode;
      it is akin to DIRTY_MEMORY_MIGRATION, so set it together with that bitmap.
      The remaining call from invalidate_and_set_dirty's "else" branch will go
      away soon.

      Second, fix the second argument to the function in the
      cpu_physical_memory_set_dirty_lebitmap call site.  That function is only used
      by KVM, but it is better to be clean anyway.

      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1bfbac4ee16e2ea95d087e0926727d9a113b483e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:57:21 2015 +0100

      kvm: remove special handling of DIRTY_MEMORY_MIGRATION in the dirty log mask

      One recent example is commit 4cc856f (kvm-all: Sync dirty-bitmap from
      kvm before kvm destroy the corresponding dirty_bitmap, 2015-04-02).
      Another performance problem is that KVM keeps tracking dirty pages
      after a failed live migration, which causes bad performance due to
      disallowing huge page mapping.

      Thanks to the previous patch, KVM can now stop hooking into
      log_global_start/stop.  This simplifies the KVM code noticeably.

      Reported-by: Wanpeng Li <wanpeng.li@linux.intel.com>
      Reported-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f6a5ef3e429f92f987678ea8c396aab4dc6aa19
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:57:21 2015 +0100

      memory: include DIRTY_MEMORY_MIGRATION in the dirty log mask

      The separate handling of DIRTY_MEMORY_MIGRATION, which does not
      call log_start/log_stop callbacks when it changes in a region's
      dirty logging mask, has caused several bugs.

      One recent example is commit 4cc856f (kvm-all: Sync dirty-bitmap from
      kvm before kvm destroy the corresponding dirty_bitmap, 2015-04-02).
      Another performance problem is that KVM keeps tracking dirty pages
      after a failed live migration, which causes bad performance due to
      disallowing huge page mapping.

      This patch removes the root cause of the problem by reporting
      DIRTY_MEMORY_MIGRATION changes via log_start and log_stop.
      Note that we now have to rebuild the FlatView when global dirty
      logging is enabled or disabled; this ensures that log_start and
      log_stop callbacks are invoked.

      This will also be used to make the setting of bitmaps conditional.
      In general, this patch lets users of the memory API ignore the
      global state of dirty logging if they handle dirty logging
      generically per region.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ea8cb1a8d98f5e3822a23a7cecdb4add0f29178b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 27 14:51:31 2015 +0200

      kvm: accept non-mapped memory in kvm_dirty_pages_log_change

      It is okay if memory is not mapped into the guest but has dirty logging
      enabled.  When this happens, KVM will not do anything and only accesses
      from the host will be logged.

      This can be triggered by iofuzz.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 677e7805cf95f3b2bca8baf0888d1ebed7f0c606
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:53:21 2015 +0100

      memory: track DIRTY_MEMORY_CODE in mr->dirty_log_mask

      DIRTY_MEMORY_CODE is only needed for TCG.  By adding it directly to
      mr->dirty_log_mask, we avoid testing for TCG everywhere a region is
      checked for the enabled/disabled state of dirty logging.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 42af3e3a02f6d0c38c46465b7f0311eabf532f77
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:30:19 2015 +0200

      ui/console: remove dpy_gfx_update_dirty

      dpy_gfx_update_dirty expects DIRTY_MEMORY_VGA logging to be always on,
      but that will not be the case soon.  Because it computes the memory
      region on the fly for every update (with memory_region_find), it cannot
      enable/disable logging by itself.

      We could always treat updates as invalidations if dirty logging is
      not enabled, assuming that the board will enable logging on the
      RAM region that includes the framebuffer.

      However, the function is unused, so just drop it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d55d42078bfb507743747b761673507b95a76620
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:46:52 2015 +0100

      framebuffer: check memory_region_is_logging

      framebuffer.c expects DIRTY_MEMORY_VGA logging to be always on, but that
      will not be the case soon.  Because framebuffer.c computes the memory
      region on the fly for every update (with memory_region_find), it cannot
      enable/disable logging by itself.

      Instead, always treat updates as invalidations if dirty logging is
      not enabled, assuming that the board will enable logging on the
      RAM region that includes the framebuffer.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b2dfd71c4843a762f2befe702adb249cf55baf66
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Apr 25 14:38:30 2015 +0200

      memory: prepare for multiple bits in the dirty log mask

      When the dirty log mask will also cover other bits than DIRTY_MEMORY_VGA,
      some listeners may be interested in the overall zero/non-zero value of
      the dirty log mask; others may be interested in the value of single bits.

      For this reason, always call log_start/log_stop if bits have respectively
      appeared or disappeared, and pass the old and new values of the dirty log
      mask so that listeners can distinguish the kinds of change.

      For example, KVM checks if dirty logging used to be completely disabled
      (in log_start) or is now completely disabled (in log_stop).  On the
      other hand, Xen has to check manually if DIRTY_MEMORY_VGA changed,
      since that is the only bit it cares about.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2d1a35bef0ed96b3f23535e459c552414ccdbafd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:50:57 2015 +0100

      memory: differentiate memory_region_is_logging and memory_region_get_dirty_log_mask

      For now memory regions only track DIRTY_MEMORY_VGA individually, but
      this will change soon.  To support this, split memory_region_is_logging
      in two functions: one that returns a given bit from dirty_log_mask,
      and one that returns the entire mask.  memory_region_is_logging gets an
      extra parameter so that the compiler flags misuse.

      While VGA-specific users (including the Xen listener!) will want to keep
      checking that bit, KVM and vhost check for "any bit except migration"
      (because migration is handled via the global start/stop listener
      callbacks).

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5299c0f2cf951c23ec681ff87e455d1cf4ec537b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 13:12:40 2015 +0200

      display: add memory_region_sync_dirty_bitmap calls

      These are strictly speaking only needed for KVM and Xen, but it's still
      nice to be consistent.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 74259ae55b15bff4ef7b26faa6431a3ff16d7c9d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:47:45 2015 +0100

      display: enable DIRTY_MEMORY_VGA tracking explicitly

      This will be required soon by the memory core.

      Tested-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 086f90e890fb25e7f12fbe72fe5a8078792398aa
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 22 12:43:24 2015 +0200

      g364fb: remove pointless call to memory_region_set_coalescing

      Coalescing work on MMIO, not RAM, thus this call has no effect.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dbddac6da01a13c9d5d162994a0a265173acecab
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:31:53 2015 +0100

      memory: the only dirty memory flag for users is DIRTY_MEMORY_VGA

      DIRTY_MEMORY_MIGRATION is triggered by memory_global_dirty_log_start
      and memory_global_dirty_log_stop, so it cannot be used with
      memory_region_set_log.

      Specify this in the documentation and assert it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6b4ad3b28d4a70ad93f287b50200b04766aeb0de
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Mon May 25 22:38:06 2015 -0700

      Makefile.target: set master BUILD_DIR

      make can be invoked in the individual build dirs to build an individual
      target or just a single file of a target. e.g.

      touch translate-all.c
      make -C microblazeel-softmmu translate-all.o

      There is however a small bug when using the pixman submodule.
      config-host.mak will ref BUILD_DIR for the pixman -I CFLAGS:

      grep BUILD_DIR config-host.mak
      QEMU_CFLAGS=-I$(SRC_PATH)/pixman/pixman -I$(BUILD_DIR)/pixman/pixman ...

      This causes a build failure as -I/pixman/pixman (BUILD_DIR=="") will
      not be found.

      BUILD_DIR is usually set by the top level Makefile. Just lazy-set it in
      Makefile.target to the parent directory.

      Granted, this will not work if the pixman submodule is not prebuilt,
      but it at least means you can do incremental partial builds once you
      have done your initial full build (or attempt) from the top level.

      The next step would be refactor make infrastructure to rebuild pixman
      on a submake like the one above.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Message-Id: <1432618686-16077-1-git-send-email-crosthwaite.peter@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit db94604b20278c1dc227a04e4c564d80230e6c3f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 21 15:12:29 2015 +0200

      exec: optimize phys_page_set_level

      phys_page_set_level is writing zeroes to a struct that has just been
      filled in by phys_map_node_alloc.  Instead, tell phys_map_node_alloc
      whether to fill in the page "as a leaf" or "as a non-leaf".

      memcpy is faster than struct assignment, which copies each bitfield
      individually.  A compiler bug (https://gcc.gnu.org/PR66391), and
      small memcpys like this one are special-cased anyway, and optimized
      to a register move, so just use the memcpy.

      This cuts the cost of phys_page_set_level from 25% to 5% when
      booting qboot.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e4afbf4fb4d026510700cb40bb72dea9aef14e3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 19 10:50:59 2015 +0000

      qemu-nbd: Switch to qemu_set_fd_handler

      Achieved by:

      - Remembering the server fd with a global variable, in order to access
        it from nbd_client_closed.

      - Checking nbd_can_accept() and updating server_fd handler whenever
        client connects or disconnects.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1432032670-15124-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dae02ba55a66cb3194a2410c7725734e5bc6166f
  Author: Laurent Vivier <lvivier@redhat.com>
  Date:   Mon May 18 21:06:47 2015 +0200

      ppc: add helpful message when KVM fails to start VCPU

      On POWER8 systems, KVM checks if VCPU is running on primary threads,
      and that secondary threads are offline. If this is not the case,
      ioctl() fails with errno set to EBUSY.

      QEMU aborts with a non explicit error message:
      $ ./qemu-system-ppc64 --nographic -machine pseries,accel=kvm
      error: kvm run failed Device or resource busy

      To help user to diagnose the problem, this patch adds an informative
      error message.

      There is no easy way to check if SMT is enabled before starting the VCPU,
      and as this case is the only one setting errno to EBUSY, we just check
      the errno value to display a message.

      Signed-off-by: Laurent Vivier <lvivier@redhat.com>
      Message-Id: <1431976007-20503-1-git-send-email-lvivier@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9157eee1b1c076ff3316361b760e891dda13e9bf
  Author: Miroslav Rezanina <mrezanin@redhat.com>
  Date:   Wed May 13 11:39:30 2015 +0200

      Move parallel_hds_isa_init to hw/isa/isa-bus.c

      Disabling CONFIG_PARALLEL cause removing parallel_hds_isa_init defined in
      parallel.c. This function is called during initialization of some boards so
      disabling CONFIG_PARALLEL cause build failure.

      This patch moves parallel_hds_isa_init to hw/isa/isa-bus.c so it is included
      in case of disabled CONFIG_PARALLEL. Build is successful but qemu will abort
      with "Unknown device" error when function is called.

      Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
      Message-Id: <1431509970-32154-1-git-send-email-mrezanin@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 00967f4e0bab246679d0ddc32fd31a7179345baf
  Merge: d6688ba 9814fed
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jun 5 12:04:41 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-06-05

      This time there are a lot of s390x TCG emulation bug fixes - almost all
      of them from Aurelien, who returned from nirvana :).

      # gpg: Signature made Fri Jun  5 00:39:27 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream: (34 commits)
        target-s390x: Only access allocated storage keys
        target-s390x: fix MVC instruction when areas overlap
        target-s390x: use softmmu functions for mvcp/mvcs
        target-s390x: support non current ASC in s390_cpu_handle_mmu_fault
        target-s390x: add a cpu_mmu_idx_to_asc function
        target-s390x: implement high-word facility
        target-s390x: implement load-and-trap facility
        target-s390x: implement miscellaneous-instruction-extensions facility
        target-s390x: implement LPDFR and LNDFR instructions
        target-s390x: implement TRANSLATE EXTENDED instruction
        target-s390x: implement TRANSLATE AND TEST instruction
        target-s390x: implement LOAD FP INTEGER instructions
        target-s390x: move SET DFP ROUNDING MODE to the correct facility
        target-s390x: move STORE CLOCK FAST to the correct facility
        target-s390x: change CHRL and CGHRL format to RIL-b
        target-s390x: fix CLGIT instruction
        target-s390x: fix exception for invalid operation code
        target-s390x: implement LAY and LAEY instructions
        target-s390x: move a few instructions to the correct facility
        target-s390x: detect tininess before rounding for FP operations
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ba98885a0e965a17df214ab12b819ef630d8a14
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:37 2015 +0100

      macio: remove remainder_len DBDMA_io property

      Since the block alignment code is now effectively independent of the DMA
      implementation, this variable is no longer required and can be removed.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-5-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit b01d44cd0623dec66e583d6cd2438451443261df
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:36 2015 +0100

      macio: update comment/constants to reflect the new code

      With the offset/len functions taking care of all of the alignment mapping
      in isolation from the DMA tranasaction, many comments are now unnecessary.
      Remove these and tidy up a few constants at the same time.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-4-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit ac58fe7b2c67a9be142beacd4c6ee51f3264d90f
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:35 2015 +0100

      macio: switch pmac_dma_write() over to new offset/len implementation

      In particular, this fixes a bug whereby chains of overlapping head/tail chains
      would incorrectly write over each other's remainder cache. This is the access
      pattern used by OS X/Darwin and fixes an issue with a corrupt Darwin
      installation in my local tests.

      While we are here, rename the DBDMA_io struct property remainder to
      head_remainder for clarification.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-3-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 0389b8f8c7688fe512e16bdc00c5f35d2d8df12c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Jun 4 22:59:34 2015 +0100

      macio: switch pmac_dma_read() over to new offset/len implementation

      For better handling of unaligned block device accesses.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1433455177-21243-2-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 9814fed0afa73f5c37f04e02ec17c915a5d59303
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jun 4 00:52:44 2015 +0200

      target-s390x: Only access allocated storage keys

      We allocate ram_size / PAGE_SIZE storage keys, so we need to make sure that
      we only access that many. Unfortunately the code can overrun this array by
      one, potentially overwriting unrelated memory.

      Fix it by limiting storage keys to their scope.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

  commit 068593deea6cc61b06243a33c7fcfadb1650b654
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:56 2015 +0200

      target-s390x: fix MVC instruction when areas overlap

      The MVC instruction and the memmove C funtion do not have the same
      semantic when memory areas overlap:

      MVC: When the operands overlap, the result is obtained as if the
      operands were processed one byte at a time and each result byte were
      stored immediately after fetching the necessary operand byte.

      memmove: Copying takes place as though the bytes in src are first copied
      into a temporary array that does not overlap src or dest, and the bytes
      are then copied from the temporary array to dest.

      The behaviour is therefore the same when the destination is at a lower
      address than the source, but not in the other case. This is actually a
      trick for propagating a value to an area. While the current code detects
      that and call memset in that case, it only does for 1-byte value. This
      trick can and is used for propagating two or more bytes to an area.

      In the softmmu case, the call to mvc_fast_memmove is correct as the
      above tests verify that source and destination are each within a page,
      and both in a different page. The part doing the move 8 bytes by 8 bytes
      is wrong and we need to check that if the source and destination
      overlap, they do with a distance of minimum 8 bytes before copying 8
      bytes at a time.

      In the user code, we should check check that the destination is at a
      lower address than source or than the end of the source is at a lower
      address than the destination before calling memmove. In the opposite
      case we fallback to the same code as the softmmu one. Note that l
      represents (length - 1).

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a3084e8055067b3fe8ed653a609021d2ab368564
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:55 2015 +0200

      target-s390x: use softmmu functions for mvcp/mvcs

      mvcp and mvcs helper get access to the physical memory by a call to
      mmu_translate for the virtual to real conversion and then using ldb_phys
      and stb_phys to physically access the data. In practice this is quite
      slow because it bypasses the QEMU softmmu TLB and because stb_phys calls
      try to invalidate the corresponding memory for each access.

      Instead use cpu_ldb_{primary,secondary} for the loads and
      cpu_stb_{primary,secondary} for the stores. Ideally this should be
      further optimized by a call to memcpy, but that already improves the
      boot time of a guest by a factor 1.8.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c255ac601231e8c53007e10d640722ac58eb77cc
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:54 2015 +0200

      target-s390x: support non current ASC in s390_cpu_handle_mmu_fault

      s390_cpu_handle_mmu_fault currently looks at the current ASC mode
      defined in PSW mask instead of the MMU index. This prevent emulating
      easily instructions using a specific ASC mode. Fix that by using the
      MMU index converted back to ASC using the just added cpu_mmu_idx_to_asc
      function.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4decd76d71d6972a59bf0a16d0dea0c83490d001
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:53 2015 +0200

      target-s390x: add a cpu_mmu_idx_to_asc function

      Use constants to define the MMU indexes, and add a function to do
      the reverse conversion of cpu_mmu_index.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1f12d855b6ec79a640fa6a74d12884f1646ecfe
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:52 2015 +0200

      target-s390x: implement high-word facility

      Besides RISBHG and RISBLG, all high-word instructions are not
      implemented. Fix that.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 782a8479522f8e4a596f968e4acad5c10b77e061
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:51 2015 +0200

      target-s390x: implement load-and-trap facility

      At the same time move the trap code from op_ct into gen_trap and use it
      for all new functions. The value needs to be stored back to register
      before the exception, but also before the brcond (as we don't use
      temp locals). That's why we can't use wout helper.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 375ee58bedcda359011fe7fa99e0647f66f9ffa0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:50 2015 +0200

      target-s390x: implement miscellaneous-instruction-extensions facility

      RISBGN is the same as RISBG, but without setting the condition code.
      CLT and CLGT are the same as CLRT and CLGRT, but using memory for the
      second operand.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit df46283ce7be962002a30140a91ffbb56832cc2d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:49 2015 +0200

      target-s390x: implement LPDFR and LNDFR instructions

      This complete the floating point support sign handling facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3f4de6756cd87b508b37c7ffa93f7b827832c4eb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:48 2015 +0200

      target-s390x: implement TRANSLATE EXTENDED instruction

      It is part of the basic zArchitecture instructions.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 54f007750978ffbb98ce933077e0d1741e0202b0
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:47 2015 +0200

      target-s390x: implement TRANSLATE AND TEST instruction

      It is part of the basic zArchitecture instructions. Allow it to be call
      from EXECUTE.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ed0bcecec105137567f461e5b57834e72c851855
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:46 2015 +0200

      target-s390x: implement LOAD FP INTEGER instructions

      This is needed to pass the gcc.c-torture/execute/ieee/20010114-2.c test
      in the gcc testsuite.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9182886d797a20925d801a3378ca5330c0d91dfb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:45 2015 +0200

      target-s390x: move SET DFP ROUNDING MODE to the correct facility

      It belongs to the DFP rounding facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f7c2114067cc32eb8d8f79b7374a641ec5f4eb72
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:44 2015 +0200

      target-s390x: move STORE CLOCK FAST to the correct facility

      STORE CLOCK FAST should be in the SCF facility.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 74266b4a5837b46477034a39acc2be3a3afba431
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:43 2015 +0200

      target-s390x: change CHRL and CGHRL format to RIL-b

      Change to match the PoP. In practice both format RIL-a and RIL-b have
      the same fields. They differ on the way we decode the fields, and it's
      done correctly in QEMU.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1dedb9b76f061c8da730002f6c21a1fa2b76b106
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:42 2015 +0200

      target-s390x: fix CLGIT instruction

      The COMPARE LOGICAL IMMEDIATE AND TRAP instruction should compare the
      numbers as unsigned, as its name implies.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 111d7f4a69751d333bac32526cd252add6b071d3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Wed Jun 3 23:09:41 2015 +0200

      target-s390x: fix exception for invalid operation code

      When an operation code is not recognized (ie invalid instruction) an
      operation exception should be generated instead of a specification
      exception. The latter is for valid opcode, with invalid operands or
      modifiers.

      This give a very basic GDB support in the guest, as it uses the invalid
      opcode 0x0001 to generate a trap.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1c7610a68795d66249c25166220324d4d0b9289
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:31 2015 +0200

      target-s390x: implement LAY and LAEY instructions

      This complete the general-instructions-extension facility, enable it.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      [agraf: remove facility bit]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 92892330e78ffca7bebf03f4f7161c5bbd6602d2
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:30 2015 +0200

      target-s390x: move a few instructions to the correct facility

      LY is part of the long-displacement facility.
      RISBHG and RISBLG are part of the high-word facility.
      STCMH is part of the z/Architecture.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4a33565f9f46145d8cc701ab623b18bf423c469e
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:26 2015 +0200

      target-s390x: detect tininess before rounding for FP operations

      The s390x floating point unit detects tininess before rounding, so set
      the softfloat fp_status up appropriately.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f821135cdd4df09b1362666ddfbdfd162b905b1f
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:25 2015 +0200

      target-s390x: silence NaNs for LOAD LENGTHENED and LOAD ROUNDED

      LOAD LENGTHENED and LOAD ROUNDED are considered as FP operations and
      thus need to convert input sNaN into corresponding qNaN.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2daea9c16ffe61377b6e5426d9c52014bf538df3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:24 2015 +0200

      target-s390x: define default NaN values

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 1f65958d9c21fd3b461f6b645e7884866313c1f3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:23 2015 +0200

      target-s390x: fix MMU index computation

      The cpu_mmu_index function wrongly looks at PSW P bit to determine the
      MMU index, while this bit actually only control the use of priviledge
      instructions. The addressing mode is detected by looking at the PSW ASC
      bits instead.

      This used to work more or less correctly up to kernel 3.6 as the kernel
      was running in primary space and userland in secondary space. Since
      kernel 3.7 the default is to run the kernel in home space and userland
      in primary space. While the current QEMU code seems to work it open some
      security issues, like accessing the lowcore memory in R/W mode from a
      userspace process once it has been accessed by the kernel (it is then
      cached by the QEMU TLB).

      At the same time change the MMU_USER_IDX value so that it matches the
      value used in recent kernels.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9bebf9863bd16cc824231ad71959a338dc1819ac
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 25 01:47:22 2015 +0200

      target-s390x: fix PSW value on dynamical exception from helpers

      runtime_exception computes the psw.addr value using the actual exception
      address and the instruction length computed by calling the get_ilen
      function. However as explained above the get_ilen code, it returns the
      actual instruction length, and not the ILC. Therefore there is no need to
      multiply the value by 2.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aa752a4afc2a4b7ede58a960a9d553b3fd9e6882
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Tue May 26 11:09:44 2015 +0200

      target-s390x: fix LOAD MULTIPLE instruction on page boundary

      When consecutive memory locations are on page boundary a page fault
      might occur when using the LOAD MULTIPLE instruction. In that case real
      hardware doesn't load any register.

      This is an important detail in case the base register is in the list
      of registers to be loaded. If a page fault occurs this register might be
      overwritten and when the instruction is later restarted the wrong
      base register value is useD.

      Fix this by first loading the first and last value from memory, hence
      triggering all possible page faults, and then the remaining registers.

      This fixes random segmentation faults seen in the guest.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b8ae94bd398ff772f40fb232887ecbcbd244c3d4
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:29 2015 +0200

      target-s390x: implement STPT helper

      Save the timer target value in the SPT helper, so that the STPT helper
      can compute the remaining time.

      This allow the Linux kernel to correctly do time accounting.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aa9e14e684506e8ddf02bd5cff720520827bf244
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:28 2015 +0200

      target-s390x: implement STCKC helper

      The STCKC instruction just returns the last written clock comparator
      value and KVM already provides the corresponding variable.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d9d55f1108f45c866098731d95fef88409ff1e94
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:27 2015 +0200

      target-s390x: streamline STCK helper

      Now that clock_value is only used in one place, we can inline it in
      the STCK helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c941f07485e56e4b2653048e166b720428307acb
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:26 2015 +0200

      target-s390x: simplify SCKC helper

      The clock comparator and the QEMU timer work the same way, triggering
      at a given time, they just differ by the origin and the scale. It is
      therefore possible to go from one to another without using the current
      clock value. This spares two calls to qemu_clock_get_ns, which probably
      return slightly different values, possibly reducing the accuracy.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 9cb32c442e11d16b747fa07e29dd29b5d8227b57
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 23:42:25 2015 +0200

      target-s390x: add a tod2time function

      Add a tod2time function similar to the time2tod one, instead of open
      coding the conversion.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a91a1b20a23424412a3e7bb184422ec30ae64453
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:40:00 2015 +0200

      target-s390x: remove unused helpers

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d30107814c8d02f1896bd57249aef1b5aaed38c9
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:39:59 2015 +0200

      target-s390x: optimize (negative-) abs computation

      Now that movcond exists, it's easy to write (negative-) absolute value
      using TCG code instead of an helper.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2aaa1940684a3bf2b381fd2a8ff26c287a05109d
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Mon May 18 15:39:58 2015 +0200

      target-s390x: fix CC computation for LOAD POSITIVE instructions

      LOAD POSITIVE instructions (LPR, LPGR and LPGFR) set the following
      condition code:
        0: Result zero; no overflow
        1: --
        2: Result greater than zero; no overflow
        3: Overflow

      The current code wrongly returns 1 instead of 2 in case of a result
      greater than 0. This patches fixes that. This fixes the marshalling of
      the value '0L' in Python.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee0d0be16819896cc6c8018cbe171a632b61489c
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sun May 17 01:28:03 2015 +0200

      target-s390x: fix CC computation for EX instruction

      Commit 7a6c7067f optimized CC computation by only saving cc_op before
      calling helpers as they either don't touch the CC or generate a new
      static value. This however doesn't work for the EX instruction as the
      helper changes or not the CC value depending on the actual executed
      instruction (e.g. MVC vs CLC).

      This patches force a CC computation before calling the helper. This
      fixes random memory corruption occuring in guests.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      [agraf: remove set_cc_static in op_ex as suggested by rth]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d6688ba17b934f20f5e8953dbaafc9408d8799c5
  Merge: 3b730f5 309750f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 18:32:44 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, acpi, virtio, tpm

      This includes pxb support by Marcel, as well as multiple enhancements all over
      the place.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu Jun  4 11:51:02 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (28 commits)
        vhost: logs sharing
        hw/acpi: piix4_pm_init(): take fw_cfg object no more
        hw/acpi: move "etc/system-states" fw_cfg file from PIIX4 to core
        hw/acpi: acpi_pm1_cnt_init(): take "disable_s3" and "disable_s4"
        pc-dimm: don't assert if pc-dimm alignment != hotpluggable mem range size
        docs: Add PXB documentation
        apci: fix PXB behaviour if used with unsupported BIOS
        hw/pxb: add numa_node parameter
        hw/pci: add support for NUMA nodes
        hw/pxb: add map_irq func
        hw/pci: inform bios if the system has extra pci root buses
        hw/pci: introduce PCI Expander Bridge (PXB)
        hw/pci: removed 'rootbus nr is 0' assumption from qmp_pci_query
        hw/acpi: remove from root bus 0 the crs resources used by other buses.
        hw/acpi: add _CRS method for extra root busses
        hw/apci: add _PRT method for extra PCI root busses
        hw/acpi: add support for i440fx 'snooping' root busses
        hw/pci: extend PCI config access to support devices behind PXB
        hw/i386: query only for q35/pc when looking for pci host bridge
        hw/pci: made pci_bus_num a PCIBusClass method
        ...

      Conflicts:
      	hw/i386/pc_piix.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3b730f570c5872ceea2137848f1d4554d4847441
  Merge: 2700a97 1de29ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 14:04:14 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-06-03

      Highlights this time around:

        - sPAPR: endian fixes, speedups, bug fixes, hotplug basics
        - add default ram size capability for machines (sPAPR defaults to 512MB now)

      # gpg: Signature made Wed Jun  3 22:59:09 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (40 commits)
        softmmu: support up to 12 MMU modes
        tcg: add TCG_TARGET_TLB_DISPLACEMENT_BITS
        tci: do not use CPUArchState in tcg-target.h
        Add David Gibson for sPAPR in MAINTAINERS file
        pseries: Enable in-kernel H_LOGICAL_CI_{LOAD, STORE} implementations
        spapr: override default ram size to 512MB
        machine: add default_ram_size to machine class
        spapr_pci: emit hotplug add/remove events during hotplug
        spapr_pci: enable basic hotplug operations
        pci: make pci_bar useable outside pci.c
        spapr_pci: create DRConnectors for each PCI slot during PHB realize
        spapr_pci: add dynamic-reconfiguration option for spapr-pci-host-bridge
        spapr_drc: add spapr_drc_populate_dt()
        spapr_events: event-scan RTAS interface
        spapr_events: re-use EPOW event infrastructure for hotplug events
        spapr_rtas: add ibm, configure-connector RTAS interface
        spapr: add rtas_st_buffer_direct() helper
        spapr_rtas: add get-sensor-state RTAS interface
        spapr_rtas: add set-indicator RTAS interface
        spapr_rtas: add get/set-power-level RTAS interfaces
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2700a976dba6b107365aa9af7fd927ffb3dd3b21
  Merge: 6fa6b31 de38528
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 12:49:15 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-06-03' into staging

      trivial patches for 2015-06-03

      # gpg: Signature made Wed Jun  3 14:07:47 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-06-03: (30 commits)
        configure: postfix --extra-cflags to QEMU_CFLAGS
        cadence_gem: Fix Rx buffer size field mask
        slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
        translate-all: delete prototype for non-existent function
        Add -incoming help text
        hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irq
        hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irq
        hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irq
        hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irq
        hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irq
        hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irq
        hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irq
        hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irq
        hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irq
        hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irq
        hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irq
        hw/i386/pc: Fix misusing qemu_allocate_irqs for single irq
        hw/intc/exynos4210_gic.c: Fix memory leak by adjusting order
        hw/arm/omap_sx1.c: Fix memory leak spotted by valgrind
        hw/ppc/e500.c: Fix memory leak
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 309750fad51f17d1ec6195c5d8ad7d741596ddb6
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Jun 4 05:28:46 2015 -0400

      vhost: logs sharing

      Currently we allocate one vhost log per vhost device. This is sub
      optimal when:

      - Guest has several device with vhost as backend
      - Guest has multiqueue devices

      In the above cases, we can avoid the memory allocation by sharing a
      single vhost log among all the vhost devices. This is done through:

      - Introducing a new vhost_log structure with refcnt inside.
      - Using a global pointer to vhost_log structure that will be used. And
        introduce helper to get the log with expected log size and helper to
      - drop the refcnt to the old log.
      - Each vhost device still keep track of a pointer to the log that was
        used.

      With above, if no resize happens, all vhost device will share a single
      vhost log. During resize, a new vhost_log structure will be allocated
      and made for the global pointer. And each vhost devices will drop the
      refcnt to the old log.

      Tested by doing scp during migration for a 2 queues virtio-net-pci.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6fa6b312765f698dc81b2c30e7eeb9683804a05b
  Merge: d2ceeb1 1b93c9a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 11:44:32 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue 2015-06-02

      # gpg: Signature made Tue Jun  2 20:21:17 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        arch_init: Drop target-x86_64.conf
        target-i386: Register QOM properties for feature flags
        apic: convert ->busdev.qdev casts to C casts
        target-i386: Fix signedness of MSR_IA32_APICBASE_BASE
        pc: Ensure non-zero CPU ref count after attaching to ICC bus

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6e7d82497dc8da7d420c8fa6632d759e08a18bc3
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:16 2015 +0200

      hw/acpi: piix4_pm_init(): take fw_cfg object no more

      This PIIX4 init function has no more reason to receive a pointer to the
      FwCfg object. Remove the parameter from the prototype, and update callers.

      As a result, the pc_init1() function no longer needs to save the return
      value of pc_memory_init() and xen_load_linux(), which makes it more
      similar to pc_q35_init().

      The return type & value of pc_memory_init() and xen_load_linux() are not
      changed themselves; maybe we'll need their return values sometime later.

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit e3845e7c47cc3eaf35305c9c0f9d55ca3840b49b
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:15 2015 +0200

      hw/acpi: move "etc/system-states" fw_cfg file from PIIX4 to core

      The acpi_pm1_cnt_init() core function is responsible for setting up the
      register block that will ultimately react to S3 and S4 requests (see
      acpi_pm1_cnt_write()). It makes sense to advertise this configuration to
      the guest firmware via an easy to parse fw_cfg file (ACPI is too complex
      for firmware to parse), and indeed PIIX4 does that. However, since
      acpi_pm1_cnt_init() is not specific to PIIX4, neither should be the fw_cfg
      file.

      This patch makes "etc/system-states" appear on all chipsets modified in
      the previous patch, not just PIIX4 (assuming they have fw_cfg at all).

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit 9a10bbb4e83b184faef6fa744396a6775283c0aa
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Wed Apr 29 15:20:14 2015 +0200

      hw/acpi: acpi_pm1_cnt_init(): take "disable_s3" and "disable_s4"

      This patch only modifies the function prototype and updates all chipset
      code that calls acpi_pm1_cnt_init() to pass in their own disable_s3 and
      disable_s4 settings. vt82c686 is assumed to be fixed "S3 and S4 enabled".

      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1204696
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>

  commit d2ceeb1d68ed8b005892408fcdb533f578aae081
  Merge: a67bfbb 94edf02
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jun 4 10:21:52 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150602' into staging

      target-arm queue:
       * more EL2 preparation patches
       * revert a no-longer-necessary workaround for old glib versions
       * add GICv2m support to virt board (MSI support)
       * pl061: fix wrong calculation of GPIOMIS register
       * support MSI via irqfd
       * remove a confusing v8_ prefix from some variable names
       * add dynamic sysbus device support to the virt board

      # gpg: Signature made Tue Jun  2 17:30:38 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150602: (22 commits)
        hw/arm/virt: change indentation in a15memmap
        hw/arm/virt: add dynamic sysbus device support
        hw/arm/boot: arm_load_kernel implemented as a machine init done notifier
        hw/arm/sysbus-fdt: helpers for platform bus nodes addition
        target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays
        arm_gicv2m: set kvm_gsi_direct_mapping and kvm_msi_via_irqfd_allowed
        kvm: introduce kvm_arch_msi_data_to_gsi
        pl061: fix wrong calculation of GPIOMIS register
        target-arm: Add the GICv2m to the virt board
        target-arm: Extend the gic node properties
        arm_gicv2m: Add GICv2m widget to support MSIs
        target-arm: Add GIC phandle to VirtBoardInfo
        Revert "target-arm: Avoid g_hash_table_get_keys()"
        target-arm: Add TLBI_VAE2{IS}
        target-arm: Add TLBI_ALLE2
        target-arm: Add TLBI_ALLE1{IS}
        target-arm: Add TTBR0_EL2
        target-arm: Add TPIDR_EL2
        target-arm: Add SCTLR_EL2
        target-arm: Add TCR_EL2
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b5d3b039221f056befb3715471fee1f68214815c
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Jun 3 17:10:43 2015 +0200

      pc-dimm: don't assert if pc-dimm alignment != hotpluggable mem range size

      Drop superfluous pc-dimm alignment on hot-pluggable mem
      range size assert, since it causes QEMU crash during hotplug
      when hotplugging pc-dimm with alignment bigger than
      an alignment of hot-pluggable mem range size.

      Instead allow pc_dimm_get_free_addr() find free address
      and bail out gracefully later in that function during
      checking if pc-dimm will fit in hot-pluggable mem range.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1de29aef17a7d70dbc04a7fe51e18942e3ebe313
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 09:18:23 2015 +0200

      softmmu: support up to 12 MMU modes

      At 8k per TLB (for 64-bit host or target), 8 or more modes
      make the TLBs bigger than 64k, and some RISC TCG backends do
      not like that.  On the affected hosts, cut the TLB size in
      half---there is still a measurable speedup on PPC with the
      next patch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1424436345-37924-3-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 006f8638c62bca2b0caf609485f47fa5e14d8a3c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 5 09:18:22 2015 +0200

      tcg: add TCG_TARGET_TLB_DISPLACEMENT_BITS

      This will be used to size the TLB when more than 8 MMU modes are
      used by the target.  Limitations come from the limited size of
      the immediate fields (which sometimes, as in the case of Aarch64,
      extend to instructions that shift the immediate).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1424436345-37924-2-git-send-email-pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5a58e884d1d9905a835de2889c8cd73327fe2a94
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue May 19 09:59:34 2015 +0200

      tci: do not use CPUArchState in tcg-target.h

      tcg-target.h does not use any QEMU-specific symbols, save for tci's usage
      of CPUArchState.  Pull that up to tcg/tcg.h.

      This will make it possible to include tcg-target.h in cpu-defs.h.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 085eb217dfb3ee12e7985c11f71f8a038394735a
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri May 8 10:11:00 2015 +1000

      Add David Gibson for sPAPR in MAINTAINERS file

      At Alex Graf's request I'm now acting as sub-maintainer for the sPAPR
      (-machine pseries) code.  This updates MAINTAINERS accordingly.

      While we're at it, change the label to mention pseries since that's the
      actual name of the machine type, even if most of the C files use the sPAPR
      name.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 026bfd89cb896c8a3460cc551cc4836219bd7ff9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu May 7 15:33:59 2015 +1000

      pseries: Enable in-kernel H_LOGICAL_CI_{LOAD, STORE} implementations

      qemu currently implements the hypercalls H_LOGICAL_CI_LOAD and
      H_LOGICAL_CI_STORE as PAPR extensions.  These are used by the SLOF firmware
      for IO, because performing cache inhibited MMIO accesses with the MMU off
      (real mode) is very awkward on POWER.

      This approach breaks when SLOF needs to access IO devices implemented
      within KVM instead of in qemu.  The simplest example would be virtio-blk
      using an iothread, because the iothread / dataplane mechanism relies on
      an in-kernel implementation of the virtio queue notification MMIO.

      To fix this, an in-kernel implementation of these hypercalls has been made,
      (kernel commit 99342cf "kvmppc: Implement H_LOGICAL_CI_{LOAD,STORE} in KVM"
      however, the hypercalls still need to be enabled from qemu.  This performs
      the necessary calls to do so.

      It would be nice to provide some warning if we encounter a problematic
      device with a kernel which doesn't support the new calls.  Unfortunately,
      I can't see a way to detect this case which won't either warn in far too
      many cases that will probably work, or which is horribly invasive.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a34944fe2e2457309bde74c1ffe3a1c60c6da018
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:58 2015 +1000

      spapr: override default ram size to 512MB

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Acked-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 076b35b5a56bca57c4aa41044ed304fe9c45d6c5
  Author: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:57 2015 +1000

      machine: add default_ram_size to machine class

      Machines types can have different requirement for default ram
      size. Introduce a member in the machine class and set the current
      default_ram_size to 128MB.

      For QEMUMachine types override the value during the registration of
      the machine and for MachineClass introduce the generic class init
      setting the default_ram_size.

      Add helpers [K,M,G,T,P,E]_BYTE for better readability and easy usage

      Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c5bc152bc399ae7ec8ac5227762e4320d0fd2d1c
  Author: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:56 2015 +1000

      spapr_pci: emit hotplug add/remove events during hotplug

      This uses extension of existing EPOW interrupt/event mechanism
      to notify userspace tools like librtas/drmgr to handle
      in-guest configuration/cleanup operations in response to
      device_add/device_del.

      Userspace tools that don't implement this extension will need
      to be run manually in response/advance of device_add/device_del,
      respectively.

      Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7454c7af91bdd60216e2b6eead827c012bb4d0d0
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:55 2015 +1000

      spapr_pci: enable basic hotplug operations

      This enables hotplug of PCI devices to a PHB. Upon hotplug we
      generate the OF-nodes required by PAPR specification and
      IEEE 1275-1994 "PCI Bus Binding to Open Firmware" for the
      device.

      We associate the corresponding FDT for these nodes with the DRC
      corresponding to the slot, which will be fetched via
      ibm,configure-connector RTAS calls by the guest as described by PAPR
      specification.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cf8c704d5a06e7b8327c65d19d0c342dc23fff84
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:54 2015 +1000

      pci: make pci_bar useable outside pci.c

      We need to work with PCI BARs to generate OF properties
      during PCI hotplug for sPAPR guests.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 62083979b0471ac07da6d94944bf12a9b18baa1f
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:53 2015 +1000

      spapr_pci: create DRConnectors for each PCI slot during PHB realize

      These will be used to support hotplug/unplug of PCI devices to the PCI
      bus associated with a particular PHB.

      We also set up device-tree properties in each PHBs initial FDT to
      describe the DRCs associated with them. This advertises to guests that
      each PHB is DR-capable device with physical hotpluggable slots, each
      managed by the corresponding DRC. This is necessary for allowing
      hotplugging of devices to it later via bus rescan or guest rpaphp
      hotplug module.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7619c7b00c90a39243f1229facde8c53a8fba921
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:52 2015 +1000

      spapr_pci: add dynamic-reconfiguration option for spapr-pci-host-bridge

      This option enables/disables PCI hotplug for a particular PHB.

      Also add machine compatibility code to disable it by default for machine
      types prior to pseries-2.4.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      [agraf: move commas for compat fields]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e4b798bb53447ba4608fc7e6ed91927bdb1c3d5d
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:51 2015 +1000

      spapr_drc: add spapr_drc_populate_dt()

      This function handles generation of ibm,drc-* array device tree
      properties to describe DRC topology to guests. This will by used
      by the guest to direct RTAS calls to manage any dynamic resources
      we associate with a particular DR Connector as part of
      hotplug/unplug.

      Since general management of boot-time device trees are handled
      outside of sPAPRDRConnector, we insert these values blindly given
      an FDT and offset. A mask of sPAPRDRConnector types is given to
      instruct us on what types of connectors entries should be generated
      for, since descriptions for different connectors may live in
      different parts of the device tree.

      Based on code originally written by Nathan Fontenot.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 79853e18d904b0a4bcef62701d48559688007c93
  Author: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:50 2015 +1000

      spapr_events: event-scan RTAS interface

      We don't actually rely on this interface to surface hotplug events, and
      instead rely on the similar-but-interrupt-driven check-exception RTAS
      interface used for EPOW events. However, the existence of this interface
      is needed to ensure guest kernels initialize the event-reporting
      interfaces which will in turn be used by userspace tools to handle these
      events, so we implement this interface here.

      Since events surfaced by this call are mutually exclusive to those
      surfaced via check-exception, we also update the RTAS event queue code
      to accept a boolean to mark/filter for events accordingly.

      Events of this sort are not currently generated by QEMU, but the interface
      has been tested by surfacing hotplug events via event-scan in place
      of check-exception.

      Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 31fe14d15d08d613ff38abb249911e98c7966b86
  Author: Nathan Fontenot <nfont@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:49 2015 +1000

      spapr_events: re-use EPOW event infrastructure for hotplug events

      This extends the data structures currently used to report EPOW events to
      guests via the check-exception RTAS interfaces to also include event types
      for hotplug/unplug events.

      This is currently undocumented and being finalized for inclusion in PAPR
      specification, but we implement this here as an extension for guest
      userspace tools to implement (existing guest kernels simply log these
      events via a sysfs interface that's read by rtas_errd, and current
      versions of rtas_errd/powerpc-utils already support the use of this
      mechanism for initiating hotplug operations).

      We also add support for queues of pending RTAS events, since in the
      case of hotplug there's chance for multiple events being in-flight
      at any point in time.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46503c2bc047bfe8c26440e17298fcbc59d7bbbe
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:48 2015 +1000

      spapr_rtas: add ibm, configure-connector RTAS interface

      This interface is used to fetch an OF device-tree nodes that describes a
      newly-attached device to guest. It is called multiple times to walk the
      device-tree node and fetch individual properties into a 'workarea'/buffer
      provided by the guest.

      The device-tree is generated by QEMU and passed to an sPAPRDRConnector during
      the initial hotplug operation, and the state of these RTAS calls is tracked by
      the sPAPRDRConnector. When the last of these properties is successfully
      fetched, we report as special return value to the guest and transition
      the device to a 'configured' state on the QEMU/DRC side.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ab316865db8ee97c53cd70c91b1b160c474102f8
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:47 2015 +1000

      spapr: add rtas_st_buffer_direct() helper

      This is similar to the existing rtas_st_buffer(), but for cases
      where the guest is not expecting a length-encoded byte array.
      Namely, for calls where a "work area" buffer is used to pass
      around arbitrary fields/data.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 886445a6ee808ee06533f9ecdf0f169c9ea83fbb
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu May 7 15:33:46 2015 +1000

      spapr_rtas: add get-sensor-state RTAS interface

      This interface allows a guest to read various platform/device sensors.
      initially, we only implement support necessary to support hotplug:
      reading of the dr-entity-sense sensor, which communicates the state of
      a hotplugged resource/device to the guest (EMPTY/PRESENT/UNUSABLE).

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8c8639df32f19d5ca9bf6a823ac83e298a188fd1
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu May 7 15:33:45 2015 +1000

      spapr_rtas: add set-indicator RTAS interface

      This interface allows a guest to control various platform/device
      sensors. Initially, we only implement support necessary to control
      sensors that are required for hotplug: DR connector indicators/LEDs,
      resource allocation state, and resource isolation state.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      this interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 094d20585ecdcd31959b1b88a390b4d2c4cfeab7
  Author: Nathan Fontenot <nfont@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:44 2015 +1000

      spapr_rtas: add get/set-power-level RTAS interfaces

      These interfaces manage the power domains that guest devices are
      assigned to and are used to power on/off devices. Currently we
      only utilize 1 power domain, the 'live-insertion' domain, which
      automates power management of plugged/unplugged devices, essentially
      making these calls no-ops, but the RTAS interfaces are still required
      by guest hotplug code and PAPR+.

      See docs/specs/ppc-spapr-hotplug.txt for a complete description of
      these interfaces.

      Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bbf5c878ab76a74f6277f99082c77bbdb1ad4c5b
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:43 2015 +1000

      spapr_drc: initial implementation of sPAPRDRConnector device

      This device emulates a firmware abstraction used by pSeries guests to
      manage hotplug/dynamic-reconfiguration of host-bridges, PCI devices,
      memory, and CPUs. It is conceptually similar to an SHPC device,
      complete with LED indicators to identify individual slots to physical
      physical users and indicate when it is safe to remove a device. In
      some cases it is also used to manage virtualized resources, such a
      memory, CPUs, and physical-host bridges, which in the case of pSeries
      guests are virtualized resources where the physical components are
      managed by the host.

      Guests communicate with these DR Connectors using RTAS calls,
      generally by addressing the unique DRC index associated with a
      particular connector for a particular resource. For introspection
      purposes we expose this state initially as QOM properties, and
      in subsequent patches will introduce the RTAS calls that make use of
      it. This constitutes to the 'guest' interface.

      On the QEMU side we provide an attach/detach interface to associate
      or cleanup a DeviceState with a particular sPAPRDRConnector in
      response to hotplug/unplug, respectively. This constitutes the
      'physical' interface to the DR Connector.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 11eec063f29733395846ba756ecd544876ef6839
  Author: Michael Roth <mdroth@linux.vnet.ibm.com>
  Date:   Thu May 7 15:33:42 2015 +1000

      docs: add sPAPR hotplug/dynamic-reconfiguration documentation

      This adds a general overview of hotplug/dynamic-reconfiguration
      for sPAPR/pSeries guest.

      As specified in PAPR+ v2.7.

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 730fce593bbaa9240a0be860616ac4366113194d
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:41 2015 +1000

      hw/ppc/spapr: Use error_report() instead of hw_error()

      hw_error() is designed for printing CPU-related error messages
      (e.g. it also prints a full CPU register dump). For error messages
      that are not directly related to CPU problems, a function like
      error_report() should be used instead.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 68fea5a0d7bac17fd74f0608ceed1d914eb0718e
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:40 2015 +1000

      hw/ppc/spapr: Fix error message when firmware could not be loaded

      When specifying a non-existing file with the "-bios" parameter, QEMU
      complained that it "could not find LPAR rtas". That's obviously a
      copy-n-paste bug from the code which loads the spapr-rtas.bin, it
      should complain about a missing firmware file instead.
      Additionally the error message was printed with hw_error() - which
      also dumps the whole CPU state. However, this does not make much
      sense here since the CPU is not running yet and thus the registers
      only contain zeroes. So let's use error_report() here instead.
      And while we're at it, let's also bail out if the firmware file
      had zero length.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit a1a45612433edb0eb65c468f7ed579cd92358818
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu May 7 15:33:39 2015 +1000

      pseries: Add pseries-2.4 machine type

      Now that 2.4 development has opened, create a new pseries machine type
      variant.  For now it is identical to the pseries-2.3 machine type, but
      a number of new features are coming that will need to set backwards
      compatibility options.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f9ce8e0aa3fb55ae7a8ea34d3169e73e87feb337
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu May 7 15:33:38 2015 +1000

      hw/ppc/spapr_iommu: Fix the check for invalid upper bits in liobn

      The check "liobn & 0xFFFFFFFF00000000ULL" in spapr_tce_find_by_liobn()
      is completely useless since liobn is only declared as an uint32_t
      parameter. Fix this by using target_ulong instead (this is what most
      of the callers of this function are using, too).

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit dea1b3ce756d7242d4212c22b7d6e6a896495154
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:37 2015 +1000

      spapr_iommu: Give unique QOM name to TCE table

      Useful for debugging.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ccf9ff8527a87ee485fbb6a0a73d28641cab5f60
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:36 2015 +1000

      spapr_pci: Rework device-tree rendering

      This replaces object_child_foreach() and callback with existing
      SPAPR_PCI_LIOBN() and spapr_tce_find_by_liobn() to make the code easier
      to read.

      This is a mechanical patch so no behaviour change is expected.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fae807a2b182a613798fe619f9069bd0bbe3dc6a
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:35 2015 +1000

      spapr_iommu: Make spapr_tce_find_by_liobn() public

      At the moment spapr_tce_find_by_liobn() is used by H_PUT_TCE/...
      handlers to find an IOMMU by LIOBN.

      We are going to implement Dynamic DMA windows (DDW), new code
      will go to a new file and we will use spapr_tce_find_by_liobn()
      there too so let's make it public.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46c5874e9cd752ed8ded31af03472edd8fc3efc1
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:34 2015 +1000

      spapr_pci: Make find_phb()/find_dev() public

      This makes find_phb()/find_dev() public and changed its names
      to spapr_pci_find_phb()/spapr_pci_find_dev() as they are going to
      be used from other parts of QEMU such as VFIO DDW (dynamic DMA window)
      or VFIO PCI error injection or VFIO EEH handling - in all these
      cases there are RTAS calls which are addressed to BUID+config_addr
      in IEEE1275 format.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d9d96a3cc7267880fbccb6bc4018fc31909fc930
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:33 2015 +1000

      spapr_iommu: Add separate trace points for PCI DMA operations

      This is to reduce VIO noise while debugging PCI DMA.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e1a01cb554412e8a9c25573126356596dc0c50f
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:32 2015 +1000

      spapr_pci: Define default DMA window size as a macro

      This gets rid of a magic constant describing the default DMA window size
      for an emulated PHB.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4290ca49eed5e239695ce85c925a770e4a7317a6
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:31 2015 +1000

      spapr_vio: Introduce a liobn number generating macros

      This introduces a macro which makes up a LIOBN from fixed prefix and
      VIO device address (@reg property).

      This is to keep LIOBN macros rendering consistent - the same macro for
      PCI has been added by the previous patch.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c8545818b331e9a32e5dd47f0aefbcf2b93e41da
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:30 2015 +1000

      spapr_pci: Introduce a liobn number generating macros

      We are going to have multiple DMA windows per PHB and we want them to
      migrate so we need a predictable way of assigning LIOBNs.

      This introduces a macro which makes up a LIOBN from fixed prefix,
      PHB index (unique PHB id) and window number.

      This introduces a SPAPR_PCI_DMA_WINDOW_NUM() to know the window number
      from LIOBN. It is used to distinguish the default 32bit windows from
      dynamic windows and avoid picking default DMA window properties from
      a wrong TCE table.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f1215ea702e6e6cb3876221cf1f7f60133e08c30
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:29 2015 +1000

      spapr_iommu: Make H_PUT_TCE_INDIRECT endian-safe

      PAPR is defined as big endian so TCEs need an adjustment so
      does this patch.

      This changes code to have ldq_be_phys() in one place.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 12fd28535891572be7aaf862a03019257dafa425
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu May 7 15:33:28 2015 +1000

      spapr_iommu: Disable in-kernel IOMMU tables for >4GB windows

      The existing KVM_CREATE_SPAPR_TCE ioctl only support 4G windows max as
      the window size parameter to the kernel ioctl() is 32-bit so
      there's no way of expressing a TCE window > 4GB.

      We are going to add huge DMA windows support so this will create small
      window and unexpectedly fail later.

      This disables KVM_CREATE_SPAPR_TCE for windows bigger that 4GB.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 421b1b27f6e9135ac8f01db219e0d8c0cefd7e71
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Thu Mar 19 15:14:18 2015 +1100

      spapr_pci: Fix unsafe signed/unsigned comparisons

      spapr_pci.c contains a number of expressions of the form (uval == -1) or
      (uval != -1), where 'uval' is an unsigned value.

      This mostly works in practice, because as long as the width of uval is
      greater or equal than that of (int), the -1 will be promoted to the
      unsigned type, which is the expected outcome.

      However, at least for the cases where uval is uint32_t, this would break
      on platforms where sizeof(int) > 4 (and a few such do exist), because then
      the uint32_t value would be promoted to the larger int type, and never be
      equal to -1.

      This patch fixes these errors.  The fixes for the (uint32_t) cases are
      necessary as described above.  I've made similar fixes to (uint64_t) and
      (hwaddr) cases.  Those are strictly theoretical, since I don't know of any
      platforms where sizeof(int) > 8, but hey, it's not that hard so we might
      as well be strictly C standard compliant.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 31ce0adb79655003465070fa90d7d20a5b8c2ff5
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon May 18 12:59:49 2015 +0200

      configure: Check for libfdt version 1.4.0

      Some recent patches require a function from libfdt version 1.4.0,
      so we should check for this version during the configure step
      already. Unfortunately, there does not seem to be a proper #define
      for the version number in the libfdt headers. So alternatively,
      we check for the availability of the required function
      fdt_get_property_by_offset() instead instead.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28f490b24af83a007937daacb9ea8bf7537f9084
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon May 18 12:59:48 2015 +0200

      dtc: Update dtc / libfdt submodule to version 1.4.0

      Since some recent patches require libfdt version 1.4.0,
      let's update the dtc submodule to this version.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 62e9cd771cc368a8fd0f152832b78c43557897a9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 08:46:15 2015 +0100

      macio: Convert to realize()

      Convert device models "macio-oldworld" and "macio-newworld".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 814550d73a94dcf9f2c9f8d2ee280226f1145388
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:12 2015 +0300

      docs: Add PXB documentation

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0f6dd8e1d514b8c24689499ed72ea89fd0d967f3
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:11 2015 +0300

      apci: fix PXB behaviour if used with unsupported BIOS

      PXB does not work with unsupported bioses, but should
      not interfere with normal OS operation.
      We don't ship them anymore, but it's reasonable
      to keep the work-around until we update the bios in qemu.

      Fix this by not adding PXB mem/IO chunks to _CRS
      if they weren't configured by BIOS.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0e79e51a7dcbd4fde5738d713b60f0fb0321f1af
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:10 2015 +0300

      hw/pxb: add numa_node parameter

      The pxb can be attach to and existing numa node by specifying
      numa_node option that equals the desired numa nodeid.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 6a3042b23bbb1fa92c00ea9267c830e7f2e99313
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:09 2015 +0300

      hw/pci: add support for NUMA nodes

      PCI root buses can be attached to a specific NUMA node.
      PCI buses are not attached by default to a NUMA node.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0639b00d055b313930c23c4d6c9ebfb4af61c00c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:08 2015 +0300

      hw/pxb: add map_irq func

      The bios does not index the pxb slot number when
      it computes the IRQ because it resides on bus 0
      and not on the current bus.
      However Qemu routes the irq through bus 0 and adds
      the pxb slot to the IRQ computation of the PXB device.

      Synchronize between bios and Qemu by canceling
      pxb's effect.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 2118196bb3795a43bf708c37bdcf4b3c33778ccb
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:07 2015 +0300

      hw/pci: inform bios if the system has extra pci root buses

      The bios looks for 'etc/extra-pci-roots' to decide if
      is going to scan further buses after bus 0 tree.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 40d14bef8012087ade60f254487d31db822a1a44
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:06 2015 +0300

      hw/pci: introduce PCI Expander Bridge (PXB)

      PXB is a "light-weight" host bridge whose purpose is to enable
      the main host bridge to support multiple PCI root buses
      for pc machines.

      As oposed to PCI-2-PCI bridge's secondary bus, PXB's bus
      is a primary bus and can be associated with a NUMA node
      (different from the main host bridge) allowing the guest OS
      to recognize the proximity of a pass-through device to
      other resources as RAM and CPUs.

      The PXB is composed from:
       - A primary PCI bus (can be associated with a NUMA node)
         Acts like a normal pci bus and from the functionality point
         of view is an "expansion" of the bus behind the
         main host bridge.
       - A pci-2-pci bridge behind the primary PCI bus where the actual
         devices will be attached.
       - A host-bridge PCI device
         Situated on the bus behind the main host bridge, allows
         the BIOS to configure the bus number and IO/mem resources.
         It does not have its own config/data register for configuration
         cycles, this being handled by the main host bridge.
      -  A host-bridge sysbus to comply with QEMU current design.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit cb2ed8b3c66284f226c523231e2c09e60bbb34bb
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:23:05 2015 +0300

      hw/pci: removed 'rootbus nr is 0' assumption from qmp_pci_query

      Use the newer pci_bus_num to correctly get the root bus number.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit dcdca29655f774568f30a82b7fe0190b4bd38802
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:04 2015 +0300

      hw/acpi: remove from root bus 0 the crs resources used by other buses.

      If multiple root buses are used, root bus 0 cannot use all the
      pci holes ranges. Remove the IO/mem ranges used by the other
      primary buses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit a43c6e276231e8040203940cb07be00387686e87
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:03 2015 +0300

      hw/acpi: add _CRS method for extra root busses

      Save the IO/mem/bus numbers ranges assigned to the extra root busses
      to be removed from the root bus 0 range.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 0d8935e3370e07f57651e43d2de9011d75c2a066
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:02 2015 +0300

      hw/apci: add _PRT method for extra PCI root busses

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit a4894206e3672f8a5e5443d72b705495e022b638
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:01 2015 +0300

      hw/acpi: add support for i440fx 'snooping' root busses

      If the machine has extra root busses that are snooping to
      the i440fx host bridge, we need to add them to
      acpi in order to be properly detected by guests.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 09e5b81922179b6c52b42fd27587e64b474036c7
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:23:00 2015 +0300

      hw/pci: extend PCI config access to support devices behind PXB

      PXB buses are assumed to be children of bus 0. Look for them
      while scanning the buses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ca6c18556c5e9c4aac12489b960c3e4601e183bf
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:22:59 2015 +0300

      hw/i386: query only for q35/pc when looking for pci host bridge

      Because of the PXB hosts we cannot simply query TYPE_PCI_HOST_BRIDGE anymore.
      On i386 arch we only have two pci hosts, so we can look only for them.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 602141d9974d726063907851528c89d617730156
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:22:58 2015 +0300

      hw/pci: made pci_bus_num a PCIBusClass method

      Refactoring it as a method of PCIBusClass will allow
      different implementations for subclasses.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ce6a28ee057da3e4a587dada369e33a8486b0066
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Jun 2 14:22:57 2015 +0300

      hw/pci: made pci_bus_is_root a PCIBusClass method

      Refactoring it as a method of PCIBusClass will allow
      different implementations for subclasses.

      Removed the assumption that the root bus does not
      have a parent device because is specific only
      to the default class implementation.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit 32d9ca15bac63e8a7bad6dc1a4ab624e6d6d3b0f
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jun 2 14:22:56 2015 +0300

      acpi: add implementation of aml_while() term

      Commit 68e6b0af7 (acpi: add aml_while() term) added
      the definition of aml_while without the actual implementation.
      Implement the term.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Laszlo Ersek <lersek@redhat.com>

  commit ca9b46bcecc0f06882eec1b152b71f93a066da79
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Wed May 13 17:21:36 2015 +0800

      acpi: add acpi_send_gpe_event() to rise sci for hotplug

      Add a new API named acpi_send_gpe_event() to send hotplug SCI.
      This API can be used by pci, cpu and memory hotplug.

      This patch is rebased on master.

      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit d5aaa1b0456033fc9ff723ac881ebe1b61360cca
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Jun 3 14:47:19 2015 +0200

      virtio: 64bit features fixups.

      Commit "019a3ed virtio: make features 64bit wide" missed a few changes,
      as I've noticed while trying to rebase the virtio-1 branch to latest
      master.  This patch adds them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 977ad992f14b29a7d4f18eaba42a705004545a64
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Jun 2 15:47:20 2015 +0200

      TPM: fix build with tpm disabled

      Failure was included on commit

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6652d0811c9463fbfb2d2d1cb2ec03f388145c5f
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Wed May 27 16:26:07 2015 +0800

      virtio-pci: don't try to mask or unmask vqs without notifiers

      We should validate the vq index against nvqs_with_notifiers. Otherwise we may
      try to mask or unmask vector for vqs without notifiers (e.g control vq). This
      will lead qemu abort on kvm_irqchip_commit_routes() when trying to boot win8.1
      guest.

      Fixes 851c2a75a6e80c8aa5e713864d98cfb512e7229b ("virtio-pci: speedup MSI-X
      masking and unmasking")

      Reported-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 557772f26b361ade84acecb366fe6fdd2d55a6d9
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon Jun 1 17:09:12 2015 +0300

      hw/q35: fix floppy controller definition in ich9

      In DSDT FDC0 declares the IO region as IO(Decode16, 0x03F2, 0x03F2, 0x00, 0x04).
      Use the same in lpc_ich9 initialization code.
      Now the floppy drive is detected correctly on Windows.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cb3d37a93cc59da400d27361fcda024d49210abd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 1 21:03:59 2015 +0200

      acpi: add missing ssdt

      commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
          TPM2 ACPI table support

      was missing a file, so build with iasl fails
      (build without iasl works since it uses the generated
       hex files).

      Reported-by: "Daniel P. Berrange" <berrange@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b853d4cbf2062813e84f9bb880feff8daf467e05
  Author: Sascha Silbe <silbe@linux.vnet.ibm.com>
  Date:   Tue Jun 2 18:51:00 2015 +0200

      s390x/kvm: always ignore empty vcpu interrupt state

      kvm_s390_vcpu_interrupt_pre_save() and
      kvm_s390_vcpu_interrupt_post_load() are essentially no-ops on hosts
      without KVM_CAP_S390_IRQ_STATE. Move the capability check after the
      check for saved IRQ state in kvm_s390_vcpu_interrupt_post_load() so that
      migration between hosts without KVM_CAP_S390_IRQ_STATE (including save /
      restore on the same host) continues to work.

      Fixes: 3cda44f7bae5 ("s390x/kvm: migrate vcpu interrupt state")
      Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 2a72ea5f66b3b87a975475bdc1cabacbbb402937
  Author: Jason J. Herne <jjherne@linux.vnet.ibm.com>
  Date:   Wed Jun 3 11:04:03 2015 -0400

      virtio-ccw/migration: Migrate config vector for virtio devices

      virtio_ccw_{save|load}_config are missing code to save and restore a vdev's
      config_vector value. This causes some virtio devices to become disabled
      following a migration.

      This patch fixes a bug whereby the qmp/hmp balloon command (virsh setmem)
      silently fails to update the guest's available memory because the device was not
      properly migrated.

      This will break compatibility, but vmstate_s390_cpu was bumped from
      version 2 to version 4 between v2.3.0 and v2.4.0 without a compat
      handler. Furthermore, there is no production environment yet so
      migration is fenced anyway between any relevant version of 2.3 and 2.4.

      Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Message-Id: <1433343843-803-1-git-send-email-jjherne@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit de6a92185e3ac25ba7d37f03e579b1fc72e70162
  Author: Pierre Morel <pmorel@linux.vnet.ibm.com>
  Date:   Wed May 27 13:11:59 2015 +0200

      virtio-ccw: add support for 9pfs

      This patch adds 9pfs support for virtio-ccw
      by registering the virtio_ccw_9p_info type
      and adding associated callbacks.

      Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit de3852877f1e452321352fdb7e678f079876a41b
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Jun 3 09:56:37 2015 +0100

      configure: postfix --extra-cflags to QEMU_CFLAGS

      It makes sense that extra-cflags should be appended after the normal
      CFLAGS so they don't get overridden by default behaviour. This way if
      you specify something like:

        ./configure --extra-cflags="-O0"

      You will see the requested behaviour.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2801339f2fb2534ccf01561d274398328bdd446d
  Author: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
  Date:   Fri May 29 11:52:35 2015 +0530

      cadence_gem: Fix Rx buffer size field mask

      This patch corrects the Rx buffer size field mask to mask bits 23 to 16
      to match Xilinx UG585 documentation.

      Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu May 28 14:12:26 2015 +0300

      slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)

      In this version I used mkdtemp(3) which is:

              _BSD_SOURCE
              || /* Since glibc 2.10: */
                  (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)

      (POSIX.1-2008), so should be available on systems we care about.

      While at it, reset the resulting directory name within smb structure
      on error so cleanup function wont try to remove directory which we
      failed to create.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit b6b099541d6cf3c50b0fb5af916fff0db6508805
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jun 1 09:53:55 2015 +0200

      translate-all: delete prototype for non-existent function

      Missed in commit 3a808cc40

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1597051b84b816c9608e1ee0947f8e6dc9876b56
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri May 29 19:52:52 2015 +0100

      Add -incoming help text

      The help/man text for

      -incoming defer

      didn't make it through the merge of the code that implemented it.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 26c8acb3f326166bf9dc60c3e8184f4b862e8451
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:11 2015 +0800

      hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 294972ce546107f2215b3b162994b47f08aab7a4
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:10 2015 +0800

      hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5429273615e7b412402a7b22738737c09ab9f488
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:09 2015 +0800

      hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c85fad022a5c23b835d7c78b653763ae1e3f6eb
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:08 2015 +0800

      hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a9c8a0d8d4217754648decc5921e4b0fcd00ce7f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:07 2015 +0800

      hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d4ef00af2598fef06affbd42608e570237a7b276
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:06 2015 +0800

      hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aaaee0b273082ee2836dcc2f61a878ee291a8d9b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:05 2015 +0800

      hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ca43b97b5f6fa57e79adc7f167b12d3e0545c7e1
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:04 2015 +0800

      hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b64127244d669c33a4ffdcc47e076559497785af
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:02 2015 +0800

      hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5105505e65ba6bc3e1dc549bcd0d1d33f3546e60
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:01 2015 +0800

      hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irq

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aff0d5e57a71260885d54c07cef5f4a486c8336b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:00 2015 +0800

      hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irq

      Since ich9_lpc_pm_init only requests one irq, so let it just call
      qemu_allocate_irq.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0b0cc076b78976b30360dd7c6ed994f864424779
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:26:59 2015 +0800

      hw/i386/pc: Fix misusing qemu_allocate_irqs for single irq

      Since pc_allocate_cpu_irq only requests one irq, so let it just call
      qemu_allocate_irq.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9ff7f5bddbe5814bafe5e798d2cf1087b58dc7b6
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:27:03 2015 +0800

      hw/intc/exynos4210_gic.c: Fix memory leak by adjusting order

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9f9b026dc60398224fb035eb27ae0ed083d2d66f
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 13:38:34 2015 +0800

      hw/arm/omap_sx1.c: Fix memory leak spotted by valgrind

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f19377bf234a3359b0a03844822e97de80ad4f30
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 20:39:43 2015 +0800

      hw/ppc/e500.c: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c18f855697ab6b64a895f37cf47fd7061ce9e798
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 28 20:39:42 2015 +0800

      hw/alpha/dp264.c: Fix memory leak spotted by valgrind

      valgrind complains about:
      ==7055== 58 bytes in 1 blocks are definitely lost in loss record 1,471 of 2,192
      ==7055==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==7055==    by 0x24410F: malloc_and_trace (vl.c:2556)
      ==7055==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DEFD7: g_strndup (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x650181A: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DF0CC: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x64DF188: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==7055==    by 0x242F81: qemu_find_file (vl.c:2121)
      ==7055==    by 0x217A32: clipper_init (dp264.c:105)
      ==7055==    by 0x2484DA: main (vl.c:4249)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bd4baf6eebff75c7e0c67a729d1bdb5b0b36fe72
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 25 14:47:25 2015 +0800

      vl: fix memory leak spotted by valgrind

      valgrind complains about:
      ==9276== 13 bytes in 1 blocks are definitely lost in loss record 1,046 of 3,673
      ==9276==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==9276==    by 0x2EAFBB: malloc_and_trace (vl.c:2556)
      ==9276==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==9276==    by 0x4A28BD: addr_to_string (vnc.c:123)
      ==9276==    by 0x4A29AD: vnc_socket_local_addr (vnc.c:139)
      ==9276==    by 0x4A9AFE: vnc_display_local_addr (vnc.c:3240)
      ==9276==    by 0x2EF4FE: main (vl.c:4321)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7df057bac3734ee3c2c052fd0807479602ab5583
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun May 24 13:20:14 2015 -0700

      device-tree: Make a common-obj

      There is no reason for device tree API to be built per-target.
      common-obj it. There is an extraneous inclusion of config.h that
      needs to be removed.

      Cc: Alexander Graf <agraf@suse.de>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d370dfa9f3703cf0af07d96d50ed567413e8ec65
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:07 2015 +0800

      hw/i386/acpi-build: decref after use

      valgrind complains about:
      ==16447== 48 bytes in 2 blocks are definitely lost in loss record 2,033 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x53EC3F: qint_from_int (qint.c:33)
      ==16447==    by 0x53B426: qmp_output_type_int (qmp-output-visitor.c:162)
      ==16447==    by 0x539257: visit_type_uint32 (qapi-visit-core.c:147)
      ==16447==    by 0x471D07: property_get_uint32_ptr (object.c:1651)
      ==16447==    by 0x47000C: object_property_get (object.c:822)
      ==16447==    by 0x472428: object_property_get_qobject (qom-qobject.c:37)
      ==16447==    by 0x25701A: build_append_pci_bus_devices (acpi-build.c:520)
      ==16447==    by 0x25902E: build_ssdt (acpi-build.c:1004)
      ==16447==    by 0x25A0A8: acpi_build (acpi-build.c:1420)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6e38a4ba7889083b65729db2144cdbcefbaa303a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:06 2015 +0800

      hw/ide/pci: Fix memory leak

      valgrind complains about:
      ==16447== 16 bytes in 2 blocks are definitely lost in loss record 1,304 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x3B4B44: bmdma_init (pci.c:464)
      ==16447==    by 0x3B547B: pci_piix_init_ports (piix.c:144)
      ==16447==    by 0x3B55D2: pci_piix_ide_realize (piix.c:164)
      ==16447==    by 0x3EAEC6: pci_qdev_realize (pci.c:1790)
      ==16447==    by 0x36C685: device_set_realized (qdev.c:1058)
      ==16447==    by 0x47179E: property_set_bool (object.c:1514)
      ==16447==    by 0x470098: object_property_set (object.c:837)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ba154cf4eb8636cdd3aa90f392ca9e77206ca39
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue May 26 09:46:05 2015 +0800

      hw/i386/pc_piix: Fix memory leak

      valgrind complains about:
      ==16447== 8 bytes in 1 blocks are definitely lost in loss record 552 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x24E622: pc_init1 (pc_piix.c:287)
      ==16447==    by 0x24E76A: pc_init_pci (pc_piix.c:310)
      ==16447==    by 0x2E9360: main (vl.c:4226)

      ==16447== 128 bytes in 1 blocks are definitely lost in loss record 2,569 of 3,310
      ==16447==    at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16447==    by 0x2E4FD7: malloc_and_trace (vl.c:2546)
      ==16447==    by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3)
      ==16447==    by 0x36FB47: qemu_extend_irqs (irq.c:55)
      ==16447==    by 0x36FBD3: qemu_allocate_irqs (irq.c:64)
      ==16447==    by 0x25BEB2: kvm_i8259_init (i8259.c:133)
      ==16447==    by 0x24E1F1: pc_init1 (pc_piix.c:219)
      ==16447==    by 0x24E76A: pc_init_pci (pc_piix.c:310)
      ==16447==    by 0x2E9360: main (vl.c:4226)

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5708b2b736ebec6e3af04b9b249faadf896791cd
  Author: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
  Date:   Tue May 26 05:25:41 2015 -0400

      docs/writing-qmp-commands: fix a typo

      s/interation/iteration

      Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b8981dc9aae25fa79e5f35609e63f50f078a572d
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Fri May 15 11:31:43 2015 +0200

      util: socket: Add missing localaddr and localport option for DGRAM socket

      The 'socket_optslist' structure does not contain the 'localaddr' and
      'localport' options that are parsed in case you are creating a
      'connect' type UDP character device.

      I've noticed it happening after commit f43e47dbf6de24db20ec9b588bb6cc762
      made qemu abort() after seeing the invalid option.

      A minimal reproducer for the case is:
      $ qemu-system-x86_64 -chardev udp,id=charrng0,host=127.0.0.1,port=1234,localaddr=,localport=1234
      qemu-system-x86_64: -chardev udp,id=charrng0,host=127.0.0.1,port=1234,localaddr=,localport=1234: Invalid parameter 'localaddr'
      Aborted (core dumped)

      Prior to the commit mentioned above the error would be printed but the
      value for localaddr and localport was simply ignored. I did not go
      through the code to find out when it was broken.

      Add the two fields so that the options can again be parsed correctly and
      qemu doesn't abort().

      Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1220252

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a2f533da00f7278788afcf10f325f636805077dc
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu May 14 22:33:39 2015 -0700

      microblaze: cpu: Delete MMAP_SHIFT definition

      Just fallback on the default of 12 like other architectures. This
      allows changing the system-mode-affecting definition of
      TARGET_PAGE_BITS without affecting microblaze linux-user.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 44f192f364b71683379e104157b15b0685d24394
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:15:28 2015 +0000

      iscsi: Remove pointless runtime check of macro value

      raw_bsd already has QEMU_BUILD_BUG_ON(BDRV_SECTOR_SIZE != 512), so iscsi
      should relax.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1b93c9a1040b3c12320cf55c6284882a2e6e8ff3
  Author: Ikey Doherty <michael.i.doherty@intel.com>
  Date:   Tue May 26 13:54:06 2015 +0100

      arch_init: Drop target-x86_64.conf

      The target-x86_64.conf sysconfig file has been empty and essentially ignored
      now for several years. This change removes the unused file to enable moving
      towards a stateless configuration.

      Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 38e5c119c2925812bd441450ab9e5e00fc79e662
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Mar 23 17:29:32 2015 -0300

      target-i386: Register QOM properties for feature flags

      This uses the feature name arrays to register QOM properties for feature
      flags. This simply adds properties that can be configured using -global,
      but doesn't change x86_cpu_parse_featurestr() to use them yet.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit be9f8a08727e46c790adb8caa8a4525a1e8e9e73
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Wed May 20 10:40:47 2015 +0800

      apic: convert ->busdev.qdev casts to C casts

      Use C casts to avoid accessing ICCDevice's qdev field
      directly.

      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 458cf469f4a1cb520b07092f5537c5a6d2389d23
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 29 16:31:12 2015 -0300

      target-i386: Fix signedness of MSR_IA32_APICBASE_BASE

      Existing definition triggers the following when using clang
      -fsanitize=undefined:

          hw/intc/apic_common.c:314:55: runtime error: left shift of 1048575 by 12
              places cannot be represented in type 'int'

      Fix it so we won't try to shift a 1 to the sign bit of a signed integer.

      Suggested-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0e3bd56294230ad0ee20fce587879c29a83a0d8b
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 17 17:46:36 2015 +0100

      pc: Ensure non-zero CPU ref count after attaching to ICC bus

      Setting the parent bus of a device increases its ref count, which we
      ultimately want to level out. However it is only safe to do so after the
      last reference to the device in local code, as qom-set or similar operations
      might decrease the ref count.

      Therefore move the object_unref() from pc_new_cpu() into its callers.

      The APIC operations on the last CPU in pc_cpus_init() are still potentially
      insecure, but that is beyond the scope of this code movement.

      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 4964e18e490f3ecad35c9e4cc9b613316a98755e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:38 2015 +0200

      fdc-test: Test state for existing cases more thoroughly

      This just adds a few additional checks of the MSR and interrupt pin to
      the already existing test cases.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-9-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 6cc8a11c84ddc18c64fc88d54c8e9dca24ada489
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:37 2015 +0200

      fdc: Fix MSR.RQM flag

      The RQM bit in MSR should be set whenever the guest is supposed to
      access the FIFO, and it should be cleared in all other cases. This is
      important so the guest can't continue writing/reading the FIFO beyond
      the length that it's suppossed to access (see CVE-2015-3456).

      Commit e9077462 fixed the CVE by adding code that avoids the buffer
      overflow; however it doesn't correct the wrong behaviour of the floppy
      controller which should already have cleared RQM.

      Currently, RQM stays set all the time and during all phases while a
      command is being processed. This is error-prone because the command has
      to explicitly clear the flag if it doesn't need data (and indeed, the
      two buggy commands that are the culprits for the CVE just forgot to do
      that).

      This patch clears RQM immediately as soon as all bytes that are expected
      have been received. If the the FIFO is used in the next phase, the flag
      has to be set explicitly there.

      It also clear RQM after receiving all bytes even if the phase transition
      immediately sets it again. While it's technically not necessary at the
      moment because the state between clearing and setting RQM is not
      observable by the guest, this is more explicit and matches how real
      hardware works. It will actually become necessary in qemu once
      asynchronous code paths are introduced.

      This alone should have been enough to fix the CVE, but now we have two
      lines of defense - even better.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit f6c2d1d8425fd0ca450d515b06821e2224d4b43c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:36 2015 +0200

      fdc: Disentangle phases in fdctrl_read_data()

      This commit makes similar improvements as have already been made to the
      write function: Instead of relying on a flag in the MSR to distinguish
      controller phases, use the explicit phase that we store now. Assertions
      of the right MSR flags are added.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit d275b33d76c8ed9d5a3dca22ea0fdec8d5a5c8e6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:35 2015 +0200

      fdc: Code cleanup in fdctrl_write_data()

      Factor out a few common lines of code, reformat, improve comments.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 5b0a25e8d2f15f89255c745c71d297b5b24d138c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:34 2015 +0200

      fdc: Use phase in fdctrl_write_data()

      Instead of relying on a flag in the MSR to distinguish controller phases,
      use the explicit phase that we store now. Assertions of the right MSR
      flags are added.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 85d291a08c91c07927bbbd29f72a27d3ad7478f3
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:33 2015 +0200

      fdc: Introduce fdctrl->phase

      The floppy controller spec describes three different controller phases,
      which are currently not explicitly modelled in our emulation. Instead,
      each phase is represented by a combination of flags in registers.

      This patch makes explicit in which phase the controller currently is.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 83a260135f13db8b5d7df72090864a5ebcef2845
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:32 2015 +0200

      fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()

      What callers really do with this function is to switch from execution
      phase (including data transfers) to result phase where the guest can
      read out one or more status bytes from the FIFO (the number depends on
      the command).

      Rename the function accordingly.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 07e415f2398d9cfb21cdd5ef902445032ba54556
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 21 15:19:31 2015 +0200

      fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()

      What all callers of fdctrl_reset_fifo() really want to do is to start
      the command phase, where writes to the data port initiate a new command.

      The function doesn't only clear the FIFO, but also sets up the state so
      that a new command can be received. Rename it to reflect this.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1432214378-31891-2-git-send-email-kwolf@redhat.com
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit a67bfbb9e41e089caec61384c625e8a61a5f270f
  Merge: 42d58e7 489653b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 18:23:28 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-02' into staging

      Monitor patches

      # gpg: Signature made Tue Jun  2 09:16:07 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-06-02: (21 commits)
        monitor: Change return type of monitor_cur_is_qmp() to bool
        monitor: Rename monitor_ctrl_mode() to monitor_is_qmp()
        monitor: Turn int command_mode into bool in_command_mode
        monitor: Drop do_qmp_capabilities()'s superfluous QMP check
        monitor: Unbox Monitor member mc and rename to qmp
        monitor: Rename monitor_control_read(), monitor_control_event()
        monitor: Rename handle_user_command() to handle_hmp_command()
        monitor: Limit QError use to command handlers
        monitor: Inline monitor_has_error() into its only caller
        monitor: Wean monitor_protocol_emitter() off mon->error
        monitor: Propagate errors through invalid_qmp_mode()
        monitor: Propagate errors through qmp_check_input_obj()
        monitor: Propagate errors through qmp_check_client_args()
        monitor: Drop unused "new" HMP command interface
        monitor: Use trad. command interface for HMP pcie_aer_inject_error
        monitor: Use traditional command interface for HMP device_add
        monitor: Use traditional command interface for HMP drive_del
        monitor: Convert client_migrate_info to QAPI
        monitor: Improve and document client_migrate_info protocol error
        monitor: Clean up after previous commit
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 42d58e7c6760cb9c55627c28ae538e27dcf2f144
  Merge: 3fc827d c25bbf1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 16:47:31 2015 +0100

      Merge remote-tracking branch 'remotes/sstabellini/tags/xen-15-06-02-tag' into staging

      XSA 128 129 130 131

      # gpg: Signature made Tue Jun  2 16:46:38 2015 BST using RSA key ID 70E1AE90
      # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

      * remotes/sstabellini/tags/xen-15-06-02-tag:
        xen/pt: unknown PCI config space fields should be read-only
        xen/pt: add a few PCI config space field descriptions
        xen/pt: mark reserved bits in PCI config space fields
        xen/pt: mark all PCIe capability bits read-only
        xen/pt: split out calculation of throughable mask in PCI config space handling
        xen/pt: correctly handle PM status bit
        xen/pt: consolidate PM capability emu_mask
        xen/MSI: don't open-code pass-through of enable bit modifications
        xen/MSI-X: limit error messages
        xen: don't allow guest to control MSI mask register
        xen: properly gate host writes of modified PCI CFG contents

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 94edf02c4c94781fa777c459fe86b52131b83cb6
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:14 2015 +0100

      hw/arm/virt: change indentation in a15memmap

      Re-indent in a15memmap after VIRT_PLATFORM_BUS introduction

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1433244554-12898-5-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5f7a5a0edc4a2f65293658eb540290ddf9a1988a
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:13 2015 +0100

      hw/arm/virt: add dynamic sysbus device support

      Allows sysbus devices to be instantiated from command line by
      using -device option. Machvirt creates a platform bus at init.
      The dynamic sysbus devices are attached to this platform bus device.

      The platform bus device registers a machine init done notifier
      whose role will be to bind the dynamic sysbus devices. Indeed
      dynamic sysbus devices are created after machine init.

      machvirt also registers a notifier that will build the device
      tree nodes for the platform bus and its children dynamic sysbus
      devices.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-4-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac9d32e39664e060cd1b538ff190980d57ad69e4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:12 2015 +0100

      hw/arm/boot: arm_load_kernel implemented as a machine init done notifier

      Device tree nodes for the platform bus and its children dynamic sysbus
      devices are added in a machine init done notifier. To load the dtb once,
      after those latter nodes are built and before ROM freeze, the actual
      arm_load_kernel existing code is moved into a notifier notify function,
      arm_load_kernel_notify. arm_load_kernel now only registers the
      corresponding notifier.

      Machine files that do not support platform bus stay unchanged. Machine
      files willing to support dynamic sysbus devices must call arm_load_kernel
      before sysbus-fdt arm_register_platform_bus_fdt_creator to make sure
      dynamic sysbus device nodes are integrated in the dtb.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-3-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c25bbf1545a53ac051f9e51d4140e397660c10ae
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: unknown PCI config space fields should be read-only

      ... by default. Add a per-device "permissive" mode similar to pciback's
      to allow restoring previous behavior (and hence break security again,
      i.e. should be used only for trusted guests).

      This is part of XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>)

  commit a88a3f887181605f4487a22bdfb7d87ffafde5d9
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: add a few PCI config space field descriptions

      Since the next patch will turn all not explicitly described fields
      read-only by default, those fields that have guest writable bits need
      to be given explicit descriptors.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 0ad3393ad032f76e88b4dbd04d36ad84dff75dd6
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: mark reserved bits in PCI config space fields

      The adjustments are solely to make the subsequent patches work right
      (and hence make the patch set consistent), namely if permissive mode
      (introduced by the last patch) gets used (as both reserved registers
      and reserved fields must be similarly protected from guest access in
      default mode, but the guest should be allowed access to them in
      permissive mode).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>

  commit 45ebe3916ab16f859ed930e92fbd52d84d5dcdaf
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: mark all PCIe capability bits read-only

      xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read-
      only to avoid unintended write-back (just a precaution, the field ought
      to be read-only in hardware).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 0e7ef22136955169a0fd03c4e41af95662352733
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: split out calculation of throughable mask in PCI config space handling

      This is just to avoid having to adjust that calculation later in
      multiple places.

      Note that including ->ro_mask in get_throughable_mask()'s calculation
      is only an apparent (i.e. benign) behavioral change: For r/o fields it
      doesn't matter > whether they get passed through - either the same flag
      is also set in emu_mask (then there's no change at all) or the field is
      r/o in hardware (and hence a write won't change it anyway).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>

  commit c4ff1e68c621928abc680266cad0a451686c403b
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: correctly handle PM status bit

      xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C
      nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS).

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit d61bb2482dc0c7426f451f23ba7e2748ae2cc06d
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/pt: consolidate PM capability emu_mask

      There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing
      PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local
      emu_mask variable - we can have the same effect by setting the field
      descriptor's emu_mask member suitably right away. Note that
      xen_pt_pmcsr_reg_write() is being retained in order to allow later
      patches to be less intrusive.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Ian Campbell <ian.campbell@citrix.com>

  commit d1d35cf4ffb6a60a356193397919e83306d0bb74
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:01 2015 +0000

      xen/MSI: don't open-code pass-through of enable bit modifications

      Without this the actual XSA-131 fix would cause the enable bit to not
      get set anymore (due to the write back getting suppressed there based
      on the OR of emu_mask, ro_mask, and res_mask).

      Note that the fiddling with the enable bit shouldn't really be done by
      qemu, but making this work right (via libxc and the hypervisor) will
      require more extensive changes, which can be postponed until after the
      security issue got addressed.

      This is a preparatory patch for XSA-131.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit b38ec5ee7a581776bbce0bdaecb397632c3c4791
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen/MSI-X: limit error messages

      Limit error messages resulting from bad guest behavior to avoid allowing
      the guest to cause the control domain's disk to fill.

      The first message in pci_msix_write() can simply be deleted, as this
      is indeed bad guest behavior, but such out of bounds writes don't
      really need to be logged.

      The second one is more problematic, as there guest behavior may only
      appear to be wrong: For one, the old logic didn't take the mask-all bit
      into account. And then this shouldn't depend on host device state (i.e.
      the host may have masked the entry without the guest having done so).
      Plus these writes shouldn't be dropped even when an entry is unmasked.
      Instead, if they can't be made take effect right away, they should take
      effect on the next unmasking or enabling operation - the specification
      explicitly describes such caching behavior. Until we can validly drop
      the message (implementing such caching/latching behavior), issue the
      message just once per MSI-X table entry.

      Note that the log message in pci_msix_read() similar to the one being
      removed here is not an issue: "addr" being of unsigned type, and the
      maximum size of the MSI-X table being 32k, entry_nr simply can't be
      negative and hence the conditonal guarding issuing of the message will
      never be true.

      This is XSA-130.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 7611dae8a69f0f1775ba1a9a942961c2aa10d88e
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen: don't allow guest to control MSI mask register

      It's being used by the hypervisor. For now simply mimic a device not
      capable of masking, and fully emulate any accesses a guest may issue
      nevertheless as simple reads/writes without side effects.

      This is XSA-129.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 5c83b2f5b4b956e91dd6e5711f14df7ab800aefb
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Jun 2 15:07:00 2015 +0000

      xen: properly gate host writes of modified PCI CFG contents

      The old logic didn't work as intended when an access spanned multiple
      fields (for example a 32-bit access to the location of the MSI Message
      Data field with the high 16 bits not being covered by any known field).
      Remove it and derive which fields not to write to from the accessed
      fields' emulation masks: When they're all ones, there's no point in
      doing any host write.

      This fixes a secondary issue at once: We obviously shouldn't make any
      host write attempt when already the host read failed.

      This is XSA-128.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 11d306b9df172faeeb3409deba4083dbe479b23c
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 12:29:11 2015 +0100

      hw/arm/sysbus-fdt: helpers for platform bus nodes addition

      This new C module will be used by ARM machine files to generate
      platform bus node and their dynamic sysbus device tree nodes.

      Dynamic sysbus device node addition is done in a machine init
      done notifier. arm_register_platform_bus_fdt_creator does the
      registration of this latter and is supposed to be called by
      ARM machine files that support platform bus and their dynamic
      sysbus. Addition of dynamic sysbus nodes is done only if the
      user did not provide any dtb.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1433244554-12898-2-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4771cd01daaccb2a8929fa04c88c608e378cf814
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 19:18:36 2015 +0100

      target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays

      The ARMCPRegInfo arrays v8_el3_no_el2_cp_reginfo and v8_el2_cp_reginfo
      are actually used on non-v8 CPUs as well. Remove the incorrect v8_
      prefix from their names.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1433182716-6400-1-git-send-email-peter.maydell@linaro.org

  commit 9718e4ae362d2f221ec028cdacefafc593ef1357
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      arm_gicv2m: set kvm_gsi_direct_mapping and kvm_msi_via_irqfd_allowed

      After introduction of kvm_arch_msi_data_to_gsi, kvm_gsi_direct_mapping
      now can be set on ARM. Also kvm_msi_via_irqfd_allowed can be set,
      depending on kernel irqfd support, hence enabling VIRTIO-PCI with
      vhost back-end.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1850b6b7d027bb4b45010a7d1da919267fff2cd4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      kvm: introduce kvm_arch_msi_data_to_gsi

      On ARM the MSI data corresponds to the shared peripheral interrupt (SPI)
      ID. This latter equals to the SPI index + 32. to retrieve the SPI index,
      matching the gsi, an architecture specific function is introduced.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b2ff2ceb8a45cbe51ca13a1a32fc5bdeec71815
  Author: Victor CLEMENT <victor.clement@openwide.fr>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      pl061: fix wrong calculation of GPIOMIS register

      The masked interrupt status register should be the state of the interrupt
      after masking.
      There should be a logical AND instead of a logical OR between the
      interrupt status and the interrupt mask.

      Signed-off-by: Victor CLEMENT <victor.clement@openwide.fr>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1433154824-6927-1-git-send-email-victor.clement@openwide.fr
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bd204e63a7ce9d1b5c5903c9033863b179194989
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      target-arm: Add the GICv2m to the virt board

      Add a GICv2m device to the virt board to enable MSIs on the generic PCI
      host controller.  We allocate 64 SPIs in the IRQ space for now (this can
      be increased/decreased later) and map the GICv2m right after the GIC in
      the memory map.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-5-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfd90a87155882d92a3efa6da9afc773fd8c6796
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      target-arm: Extend the gic node properties

      In preparation for adding the GICv2m which requires address specifiers
      and is a subnode of the gic, we extend the gic DT definition to specify
      the #address-cells and #size-cells properties and add an empty ranges
      property properties of the DT node, since this is required to add the
      v2m node as a child of the gic node.

      Note that we must also expand the irq-map to reference the gic with the
      right address-cells as a consequence of this change.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-4-git-send-email-christoffer.dall@linaro.org
      Suggested-by: Shanker Donthineni <shankerd@codeaurora.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 770c58f8d10b61e80a211d87df83670711631530
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:23 2015 +0100

      arm_gicv2m: Add GICv2m widget to support MSIs

      The ARM GICv2m widget is a little device that handles MSI interrupt
      writes to a trigger register and ties them to a range of interrupt lines
      wires to the GIC.  It has a few status/id registers and the interrupt wires,
      and that's about it.

      A board instantiates the device by setting the base SPI number and
      number SPIs for the frame.  The base-spi parameter is indexed in the SPI
      number space only, so base-spi == 0, means IRQ number 32.  When a device
      (the PCI host controller) writes to the trigger register, the payload is
      the GIC IRQ number, so we have to subtract 32 from that and then index
      into our frame of SPIs.

      When instantiating a GICv2m device, tell PCI that we have instantiated
      something that can deal with MSIs.  We rely on the board actually wiring
      up the GICv2m to the PCI host controller.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-3-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 747d009dcac37ce7372b58b21c168f0ad66cf7be
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add GIC phandle to VirtBoardInfo

      Instead of passing the GIC phandle around between functions, add it to
      the VirtBoardInfo just like we do for the clock_phandle.  We are about
      to add the v2m phandle as well, and it's easier not having to pass
      around a bunch of phandles, return multiple values from functions, etc.

      Reviewed-by: Eric Auger <eric.auger@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1432897270-7780-2-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57b6d95eb480d66c5bfa4e416d1fbcad0f84fdd2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      Revert "target-arm: Avoid g_hash_table_get_keys()"

      Since we now require GLib 2.22+ (commit f40685c), we don't have to
      work around lack of g_hash_table_get_keys() anymore.

      This reverts commit 82a3a11897308b606120f7235001e87809708f85.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1432749090-4698-1-git-send-email-armbru@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8742d49d6f2278d353a1623dfa8a5e237dbfd906
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_VAE2{IS}

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-11-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51da90140bba4333eeb9c1d8d8d8afc2ca790628
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_ALLE2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-10-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bdb9e2d66afbe0571dce48a9430c35ae4d6bbd32
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:22 2015 +0100

      target-arm: Add TLBI_ALLE1{IS}

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-9-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a57633c08fa861807a0713505785bd4d441d7df8
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TTBR0_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-8-git-send-email-edgar.iglesias@gmail.com
      [PMM: Switch to preferred opc1/crm order for 64-bit AArch32 cpregs;
       drop unneeded use of vmsa_ttbr_writefn]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff05f37babe7874f28dcead6e9e4f1904d35a13a
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TPIDR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-7-git-send-email-edgar.iglesias@gmail.com
      [PMM: reordered fields into preferred opc0/opc1/crn/crm/opc2 order]
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b9cb5323bb671a0f2bfecc36168d3a3763e90261
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add SCTLR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-6-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06ec4c8c9f9e21b7671c79296f3a47ab63d50067
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add TCR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-5-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 95f949ac3dc7d4a6ebee512a9d122db18210df64
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Add MAIR_EL2

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-4-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a903c449b41f105aadd5f762a7aede531b4950f0
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Tue Jun 2 14:56:21 2015 +0100

      target-arm: Break down TLB_LOCKDOWN

      Break down the overly broad wildcard definition of TLB_LOCKDOWN
      down to v7 level.

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-3-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3fc827d591679f3e262b9d1f8b34528eabfca8c0
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Fri May 29 16:43:13 2015 +1000

      target-arm: Correct check for non-EL3

      This fixes a compile warning from clang 3.5 (the assertion
      could never fire).

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1432881807-18164-2-git-send-email-edgar.iglesias@gmail.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: John Snow <jsnow@redhat.com>
      [PMM: added note in commit message that this is fixing a build warning]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25611aa12b4155937d076dbe7445daed62ee6043
  Merge: ef99b3e e63d114
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 11:25:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150602-1' into staging

      virtio-input: two small fixups

      # gpg: Signature made Tue Jun  2 09:32:51 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150602-1:
        virtio-input: make virtio devices follow usual naming convention
        virtio-input: const_le16 and const_le32 not build time constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ef99b3ee065d5c817fa0a50d95293e569bfb47fb
  Merge: b821cbe 9e47226
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jun 2 10:20:03 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc build fix

      My last pull breaks build on systems with iasl.
      Fix this up.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jun  1 20:41:08 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        acpi: add missing ssdt

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e63d114b8a81e22ff9295674ba64b21255d589ee
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jun 2 10:31:29 2015 +0200

      virtio-input: make virtio devices follow usual naming convention

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 16c9d46d32b39b147774ddd948dd2f9ad9049d02
  Author: Michael Mueller <mimu@linux.vnet.ibm.com>
  Date:   Mon Jun 1 15:51:56 2015 +0200

      virtio-input: const_le16 and const_le32 not build time constant

      As the implementation of const_le16 and const_le32 is not build time constant
      on big endian systems this need to be fixed.

        CC    hw/input/virtio-input-hid.o
      hw/input/virtio-input-hid.c:340:13: error: initializer element is not constant
      hw/input/virtio-input-hid.c:340:13: error: (near initialization for ‘virtio_keyboard_config[1].u.ids.bustype’)
      ...

      Signed-off-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 489653b5db17679fd61b740dd289c798bb25d7b9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 20:01:05 2015 +0100

      monitor: Change return type of monitor_cur_is_qmp() to bool

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9f3982f2dcd96753d57d0ac64bd1ae3b37a90eb3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:56:38 2015 +0100

      monitor: Rename monitor_ctrl_mode() to monitor_is_qmp()

      ... and change return type to bool.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f994b2587f081693b017ebd03b362d162d3108b3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:51:51 2015 +0100

      monitor: Turn int command_mode into bool in_command_mode

      While there, inline the pointless qmp_cmd_mode() wrapper.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6a50636f35ba677c747f2f6127b0dba994b039ca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:49:41 2015 +0100

      monitor: Drop do_qmp_capabilities()'s superfluous QMP check

      Superfluous since commit 30f5041 removed it from HMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 74358f2a1647b239d87340ea0024f9d2efa266ca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:35:59 2015 +0100

      monitor: Unbox Monitor member mc and rename to qmp

      While there, rename its type as well, from MonitorControl to
      MonitorQMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c83fe23b58199a6d4a938305cb0fc45fe7729b61
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:20:51 2015 +0100

      monitor: Rename monitor_control_read(), monitor_control_event()

      ... to monitor_qmp_read(), monitor_qmp_event().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 7ef6cf6341c453021939c909adf2d62d9dc25fd5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:12:36 2015 +0100

      monitor: Rename handle_user_command() to handle_hmp_command()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 710aec915d208246891b68e2ba61b54951edc508
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 11:28:00 2015 +0100

      monitor: Limit QError use to command handlers

      The previous commits narrowed use of QError to handle_qmp_command()
      and its helpers monitor_protocol_emitter(), build_qmp_error_dict().
      Narrow it further to just the command handler call: instead of
      converting Error to QError throughout handle_qmp_command(), convert
      the QError gotten from the command handler to Error, and switch the
      helpers from QError to Error.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 452e0300a3521f13b6c4ba0b99a8cea3a29209f1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 19:11:13 2015 +0100

      monitor: Inline monitor_has_error() into its only caller

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 70ea0c58991ae44b5a1e67d9c189d79029168cb1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:47:08 2015 +0100

      monitor: Wean monitor_protocol_emitter() off mon->error

      Move mon->error handling to its caller handle_qmp_command().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4086182fcd9b106345b5cc535d78bcc6d13a7683
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 29 10:27:16 2015 +0200

      monitor: Propagate errors through invalid_qmp_mode()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit ba0510aad43148e5284cb52fcc7a0103b5e0af4d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 2 18:41:43 2015 +0100

      monitor: Propagate errors through qmp_check_input_obj()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 326283aa5d4d51d576185af4cbbdc29f648cd766
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 2 18:39:09 2015 +0100

      monitor: Propagate errors through qmp_check_client_args()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 8a4f501c09bcb8b5a220699e378aa8fb7ec178e4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 18:50:05 2015 +0100

      monitor: Drop unused "new" HMP command interface

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 04e00c92ef75629a241ebc50537f75de0867928d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:48:49 2015 +0100

      monitor: Use trad. command interface for HMP pcie_aer_inject_error

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      pcie_aer_inject_error's implementation is split into the
      hmp_pcie_aer_inject_error() and pcie_aer_inject_error_print().  The
      former is a peculiar crossbreed between HMP and QMP handler.  On
      success, it works like a QMP handler: store QDict through ret_data
      parameter, return 0.  Printing the QDict is left to
      pcie_aer_inject_error_print().  On failure, it works more like an HMP
      handler: print error to monitor, return negative number.

      To convert to the traditional interface, turn
      pcie_aer_inject_error_print() into a command handler wrapping around
      hmp_pcie_aer_inject_error().  By convention, this command handler
      should be called hmp_pcie_aer_inject_error(), so rename the existing
      hmp_pcie_aer_inject_error() to do_pcie_aer_inject_error().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 318660f84a0a26451750aee68ab7dcf88731637d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:24:48 2015 +0100

      monitor: Use traditional command interface for HMP device_add

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      For device_add, that's easy: just wrap the obvious hmp_device_add()
      around do_device_add().

      monitor_user_noop() is now unused, drop it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 072ebe6b0351060b33287454fdef625fe79c858f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:00:56 2015 +0100

      monitor: Use traditional command interface for HMP drive_del

      All QMP commands use the "new" handler interface (mhandler.cmd_new).
      Most HMP commands still use the traditional interface (mhandler.cmd),
      but a few use the "new" one.  Complicates handle_user_command() for no
      gain, so I'm converting these to the traditional interface.

      For drive_del, that's easy: hmp_drive_del() sheds its unused last
      parameter, and its return value, which the caller ignored anyway.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit b8a185bc9a8ecbdc74fd64672e4abdd09a558e1c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 17:29:02 2015 +0100

      monitor: Convert client_migrate_info to QAPI

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 13cadefbda71e119db79fe0b7a4efd26a6d005bd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 19:16:58 2015 +0100

      monitor: Improve and document client_migrate_info protocol error

      Protocol must be spice, vnc isn't implemented.  Fix up documentation.

      Attempts to use vnc or any other unknown protocol yield the misleading
      error message "Invalid parameter 'protocol'".  Improve it to
      "Parameter 'protocol' expects spice".

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by. Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 84add864ebd2e6f3c645948ab595d8454165ebc5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 16:45:15 2015 +0100

      monitor: Clean up after previous commit

      Inline qmp_call_cmd() along with its helper handler_audit() into its
      only caller handle_qmp_command(), and simplify the result.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 65207c59d99f2260c5f1d3b9c491146616a522aa
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 14:35:26 2015 +0100

      monitor: Drop broken, unused asynchronous command interface

      The asynchronous monitor command interface goes back to commit 940cc30
      (Jan 2010).  Added a third case to command execution.  The hope back
      then according to the commit message was that all commands get
      converted to the asynchronous interface, killing off the other two
      cases.  Didn't happen.

      The initial asynchronous commands balloon and info balloon were
      converted back to synchronous long ago (commit 96637bc and d72f32),
      with commit messages calling the asynchronous interface "not fully
      working" and "deprecated".  The only other user went away in commit
      3b5704b.

      New code generally uses synchronous commands and asynchronous events.

      What exactly is still "not fully working" with asynchronous commands?
      Well, here's a bug that defeats actual asynchronous use pretty
      reliably: the reply's ID is wrong (and has always been wrong) unless
      you use the command synchronously!  To reproduce, we need an
      asynchronous command, so we have to go back before commit 3b5704b.
      Run QEMU with spice:

          $ qemu-system-x86_64 -nodefaults -S -spice port=5900,disable-ticketing -qmp stdio
          {"QMP": {"version": {"qemu": {"micro": 94, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}

      Connect a spice client in another terminal:

          $ remote-viewer spice://localhost:5900

      Set up a migration destination dummy in a third terminal:

          $ socat TCP-LISTEN:12345 STDIO

      Now paste the following into the QMP monitor:

          { "execute": "qmp_capabilities", "id": "i0" }
          { "execute": "client_migrate_info", "id": "i1", "arguments": { "protocol": "spice", "hostname": "localhost", "port": 12345 } }
          { "execute": "query-kvm", "id": "i2" }

      Produces two replies immediately, one to qmp_capabilities, and one to
      query-kvm:

          {"return": {}, "id": "i0"}
          {"return": {"enabled": false, "present": true}, "id": "i2"}

      Both are correct.  Two lines of debug output from libspice-server not
      shown.

      Now EOF socat's standard input to make it close the connection.  This
      makes the asynchronous client_migrate_info complete.  It replies:

          {"return": {}}

      Bug: "id": "i1" is missing.  Two lines of debug output from
      libspice-server not shown.  Cherry on top: storage for the missing ID
      is leaked.

      Get rid of this stuff before somebody hurts himself with it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9e472263b07d53cb3401ee49ef1b45ef195ddb84
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jun 1 21:03:59 2015 +0200

      acpi: add missing ssdt

      commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
          TPM2 ACPI table support

      was missing a file, so build with iasl fails
      (build without iasl works since it uses the generated
       hex files).

      Reported-by: "Daniel P. Berrange" <berrange@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b821cbe274c5a5cacf1a7b28360d869ae1e6e0c3
  Merge: 9657caf 830d70d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 15:22:46 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, pci, tpm, virtio, vhost enhancements and fixes

      A bunch of cleanups and fixes all over the place,
      enhancements in TPM, virtio and vhost.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon Jun  1 13:19:48 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (60 commits)
        vhost-user: add multi queue support
        virtio: make features 64bit wide
        qdev: add 64bit properties
        virtio-mmio: ioeventfd support
        hw/acpi/aml-build: Fix memory leak
        acpi: add aml_while() term
        acpi: add aml_increment() term
        acpi: add aml_shiftright() term
        acpi: add aml_shiftleft() term
        acpi: add aml_index() term
        acpi: add aml_lless() term
        acpi: add aml_add() term
        TPM2 ACPI table support
        tpm: Probe for connected TPM 1.2 or TPM 2
        Extend TPM TIS interface to support TPM 2
        Add stream ID to MSI write
        acpi: Simplify printing to dynamic string
        i386: drop FDC in pc-q35-2.4+ if neither it nor floppy drives are wanted
        i386/pc_q35: don't insist on board FDC if there's no default floppy
        i386/pc: '-drive if=floppy' should imply a board-default FDC
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 830d70db692e374b55555f4407f96a1ceefdcc97
  Author: Ouyang Changchun <changchun.ouyang@intel.com>
  Date:   Thu May 28 09:23:06 2015 +0800

      vhost-user: add multi queue support

      Based on patch by Nikolay Nikolaev:
      Vhost-user will implement the multi queue support in a similar way
      to what vhost already has - a separate thread for each queue.
      To enable the multi queue functionality - a new command line parameter
      "queues" is introduced for the vhost-user netdev.

      Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com>
      Signed-off-by: Changchun Ouyang <changchun.ouyang@intel.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 019a3edbb25f1571e876f8af1ce4c55412939e5d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Jun 1 10:45:40 2015 +0200

      virtio: make features 64bit wide

      Make features 64bit wide everywhere.

      On migration a full 64bit guest_features field is sent if one of the
      high bits is set, in addition to the lower 32bit guest_features field
      which must stay for compatibility reasons.  That way we send the lower
      32 feature bits twice, but the code is simpler because we don't have
      to split and compose the 64bit features into two 32bit fields.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fdba6d967e00864edd21275a6ee1d23a383510e8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Jun 1 10:45:39 2015 +0200

      qdev: add 64bit properties

      Needed for virtio features which go from 32bit to 64bit with virtio 1.0

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 434027badb421863b85ffdb4769966533c001cfa
  Author: Ying-Shiuan Pan <yingshiuan.pan@gmail.com>
  Date:   Tue May 12 11:10:50 2015 +0300

      virtio-mmio: ioeventfd support

      set_host_notifier and set_guest_notifiers supported by virtio-mmio now.
      Most code copied from virtio-pci.

      This makes it possible to use vhost-net with virtio-mmio,
      improving performance by about 30%.

      The kvm-arm does not yet support irqfd, need to fix the hard-coded part after
      kvm-arm gets irqfd support.

      Signed-off-by: Ying-Shiuan Pan <yingshiuan.pan@gmail.com>
      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit afcf905cff7971324c2706600ead35a1f41f417a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 25 15:14:37 2015 +0800

      hw/acpi/aml-build: Fix memory leak

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 68e6b0af784dda4efd9d4e2e9d3b03a31ca1408c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:46 2015 +0300

      acpi: add aml_while() term

      Add encoding for ACPI DefWhile Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af39d5363f373e6c1168a0e84658d6e4ef57fa8c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:45 2015 +0300

      acpi: add aml_increment() term

      Add encoding for ACPI DefIncrement Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f7bd7b8eb6573ed22bfc51e148455a1c0a1e36d0
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:44 2015 +0300

      acpi: add aml_shiftright() term

      Add encoding for ACPI DefShiftRight Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit a57dddddd2f93b87852fac2ed41a31c45e6d192a
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:43 2015 +0300

      acpi: add aml_shiftleft() term

      Add encoding for ACPI DefShiftLeft Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 928b8996576875f9364f77c5a41f12cd55c7b9f7
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:42 2015 +0300

      acpi: add aml_index() term

      Add encoding for ACPI DefIndex Opcode.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 96396e2858fd8a0b4ee218c9894b5a67d22d97d9
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:41 2015 +0300

      acpi: add aml_lless() term

      Add encoding for ACPI DefLLess Opcode.

      Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c08cf0704247aa55e9b0bb14cf34d845629e0e3e
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Mon May 25 18:33:40 2015 +0300

      acpi: add aml_add() term

      Add encoding for ACPI DefAdd Opcode.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

  commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:07 2015 -0400

      TPM2 ACPI table support

      Add a TPM2 ACPI table if a TPM 2 is used in the backend.
      Also add an SSDT for the TPM 2.

      Rename tpm_find() to tpm_get_version() and have this function
      return the version of the TPM found, TPMVersion_Unspec if
      no TPM is found. Use the version number to build version
      specific ACPI tables.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9657cafceb90accedd574a3accb3d344def8e764
  Merge: 97af820 07e1548
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jun 1 11:29:37 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150530' into staging

      TriCore bugfixes

      # gpg: Signature made Sat May 30 15:50:49 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150530:
        target-tricore: fix BOL_ST_H_LONGOFF using ld
        target-tricore: fix msub32_q producing the wrong overflow bit
        target-tricore: fix OPC2_32_RR_DVINIT_HU having write before use on the result

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 56a3c24ffc11955ddc7bb21362ca8069a3fc8c55
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:06 2015 -0400

      tpm: Probe for connected TPM 1.2 or TPM 2

      In the TPM passthrough backend driver, modify the probing code so
      that we can check whether a TPM 1.2 or TPM 2 is being used
      and adapt the behavior of the TPM TIS accordingly.

      Move the code that tested for a TPM 1.2 into tpm_utils.c
      and extend it with test for probing for TPM 2. Have the
      function return the version of TPM found.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 116694c34aa794a994051fce55bfee418fe1521d
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue May 26 16:51:05 2015 -0400

      Extend TPM TIS interface to support TPM 2

      Following the recent upgrade to version 1.3, extend the TPM TIS
      interface with capabilities introduced for support of a TPM 2.

      TPM TIS for TPM 2 introduced the following extensions beyond the
      TPM TIS 1.3 (used for TPM 1.2):

      - A new 32bit interface Id register was introduced.
      - New flags for the status (STS) register were defined.
      - New flags for the capability flags were defined.

      Support the above if a TPM TIS 1.3 for TPM 2 is used with a TPM 2
      on the backend side. Support the old TPM TIS 1.3 configuration if a
      TPM 1.2 is being used. A subsequent patch will then determine which
      TPM version is being used in the backend.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 38d40ff10f71657ea913a63d1f8477be368b92c1
  Author: Pavel Fedin <p.fedin@samsung.com>
  Date:   Wed May 27 15:59:59 2015 +0300

      Add stream ID to MSI write

      GICv3 ITS distinguishes between devices by using hardwired device IDs passed on the bus.
      This patch implements passing these IDs in qemu.
      SMMU is also known to use stream IDs, therefore this addition can also be useful for
      implementing platforms with SMMU.

      Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

       Changes from v1:
      - Added bus number to the stream ID
      - Added stream ID not only to MSI-X, but also to plain MSI. Some common code was made into
      msi_send_message() function.
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c3bdc56c183f6ca6baa502bd7861583ca98b333b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 27 19:55:55 2015 +0200

      acpi: Simplify printing to dynamic string

      build_append_namestringv() and aml_string() first calculate the
      resulting string's length with vsnprintf(NULL, ...), then allocate,
      then print for real.  Simply use g_strdup_vprintf() or g_vasprintf()
      instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit ea96bc629cbd52be98b2967a4b4f72e91dfc3ee4
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:11 2015 +0200

      i386: drop FDC in pc-q35-2.4+ if neither it nor floppy drives are wanted

      It is Very annoying to carry forward an outdatEd coNtroller with a mOdern
      Machine type.

      Hence, let us not instantiate the FDC when all of the following apply:
      - the machine type is pc-q35-2.4 or later,
      - "-device isa-fdc" is not passed on the command line (nor in the config
        file),
      - no "-drive if=floppy,..." is requested.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 6cd2234ccbacf2825372142a2658bf318ce2f848
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:10 2015 +0200

      i386/pc_q35: don't insist on board FDC if there's no default floppy

      The "no_floppy = 1" machine class setting causes "default_floppy" in
      main() to become zero. Consequently, default_drive() will not call
      drive_add() and drive_new() for IF_FLOPPY, index=0, meaning that no
      default floppy drive will be created for the virtual machine. In that
      case, board code should also not insist on the creation of the
      board-default FDC.

      The board-default FDC will still be created if the user requests a floppy
      drive with "-drive if=floppy".

      Additionally, separate FDCs can be specified manually with "-device
      isa-fdc". They allow the

        -device isa-fdc,driveA=...

      syntax that is more flexible than the one required by the board-default
      FDC:

        -global isa-fdc.driveA=...

      This patch doesn't change the behavior observably, as all Q35 machine
      types have "no_floppy = 0".

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 936a7c1cf7410a3bab97c98301054921d47a8918
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:09 2015 +0200

      i386/pc: '-drive if=floppy' should imply a board-default FDC

      Even if board code decides not to request the creation of the FDC (keyed
      off board-level factors, to be determined later), we should create the FDC
      nevertheless if the user passes '-drive if=floppy' on the command line.

      Otherwise '-drive if=floppy' would break without explicit '-device
      isa-fdc' on such boards.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit fd53c87cf6651b0dfe9f5107cfe77d2f697bd4f6
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu May 28 22:04:08 2015 +0200

      i386/pc: pc_basic_device_init(): delegate FDC creation request

      This patch introduces no observable change, but it allows the callers of
      pc_basic_device_init(), ie. pc_init1() and pc_q35_init(), to request (or
      not request) the creation of the FDC explicitly.

      At the moment both callers pass constant create_fdctrl=true (hence no
      observable change).

      Assuming a board passes create_fdctrl=false, "floppy" will be NULL on
      output, and (beyond the FDC not being created) that NULL will be passed on
      to pc_cmos_init(). Luckily, pc_cmos_init() already handles that case.

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Cc: "Gabriel L. Somlo" <gsomlo@gmail.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: qemu-block@nongnu.org
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit b829c2a98f1f67308eb02fcddb52d8fa67775f18
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:32 2015 +0800

      virtio: increase the queue limit to 1024

      Increase the queue limit to 1024. But virtio-ccw and s390-virtio won't
      support this, this is done through failing device_plugged() for those
      two transports if the number of virtqueues is greater than 64.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 87b3bd1c858e6cacac4d403da9109ec3a04fe9d0
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:31 2015 +0800

      virtio: rename VIRTIO_PCI_QUEUE_MAX to VIRTIO_QUEUE_MAX

      VIRTIO_PCI_QUEUE_MAX is not only used for pci, so rename it be generic.

      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d820331a0b47cbbdc409b435545aea25e19b57ad
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:30 2015 +0800

      virtio-s390: introduce virtio_s390_device_plugged()

      This patch introduce a virtio-s390 specific device_plugged() function
      and doing the number of virtqueue validation inside.

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 74c85296dc880568005b8e7572e08a39d66bcdca
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:29 2015 +0800

      virtio-s390: introduce virito s390 queue limit

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 10ceaa1e8f9f74c917df1fe5db856817a8b26fe7
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:28 2015 +0800

      virtio-ccw: validate the number of queues against bus limitation

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8dfbaa6ac450c4ec2646b1ca08a4017052a90c1d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:27 2015 +0800

      virtio-ccw: introduce ccw specific queue limit

      Cc: Alexander Graf <agraf@suse.de>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ad176aaed24535f535e0fdb03c538c23017535d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:26 2015 +0800

      virtio: introduce virtio_get_num_queues()

      This patch introduces virtio_get_num_queues() which iterates the vqs
      array and return the number of virtqueues used by device.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e83980455c8c7eb066405de512be7c4bace3ac4d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:25 2015 +0800

      virtio: device_plugged() can fail

      This patch passes error pointer to transport specific device_plugged()
      callback. Through this way, device_plugged() can do some transport
      specific check and fail. This will be uesd by following patches that
      check the number of virtqueues against the transport limitation.

      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit da51a335aa61ec0e45879d80f3c5e2ee4f87cd2f
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri May 29 14:15:24 2015 +0800

      virtio-net: adding all queues in .realize()

      Instead of adding queues for multiqueue during feature set. This patch
      did this in .realize(), this will help the following patches that
      count the number of virtqueues used in .device_plugged() callback.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cf34f533a161f8ced7322321d70ca00414d47473
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri May 29 11:29:40 2015 +0200

      virtio: move VIRTIO_F_NOTIFY_ON_EMPTY into core

      Nearly all transports have been offering VIRTIO_F_NOTIFY_ON_EMPTY,
      s390-virtio being the exception. There's no reason why it shouldn't
      offer it as well, though (handling is done in core anyway), so let's
      move it to the common virtio features.

      While we're changing it anyway, fix the indentation for the
      DEFINE_VIRTIO_COMMON_FEATURES macro.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 13644819c5bf322ae4c2a415aca77d5dbde95fe8
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri May 29 11:29:39 2015 +0200

      virtio-ccw: Don't advertise VIRTIO_F_BAD_FEATURE

      This was copied from virtio-pci, but it doesn't make much sense for
      ccw, as it doesn't have to handle the broken implementations this bit
      is supposed to deal with. Remove it.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6b8f1020540c27246277377aa2c3331ad2bfb160
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue May 26 16:34:47 2015 +0200

      virtio: move host_features

      Move host_features from the individual transport proxies into
      the virtio device. Transports may continue to add feature bits
      during device plugging.

      This should it make easier to offer different sets of host features
      for virtio-1/transitional support.

      Tested-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2332333c9738b442fbbd5b83a1eaa6be656ab9b5
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri May 29 21:57:32 2015 +0200

      pc: acpi: fix pvpanic for buggy guests

      In the old times, we always had pvpanic in ACPI and a _STA method told
      the guest not to use it.  Automatic generation dropped the _STA method
      as the specification says that missing _STA means enabled and working.
      Some guests (Linux) had buggy drivers and this change made them unable
      to utilize pvpanic.

      A Linux patch is posted as well, but I think it's worth to make pvpanic
      useable on old guests at the price of three lines and few bytes of SSDT.

      The old _STA method was
        Method (_STA, 0, NotSerialized) {
            Store (PEST, Local0)
            If (LEqual (Local0, Zero)) {
                Return (Zero) }
            Else {
                Return (0x0F) }}

      Igor pointed out that we don't need to use a method to return a constant
      and that 0xB (don't show in UI) is the common definition now.

      Also, the device used to be PEVT.  (PEVT as in "panic event"?)

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 99fbeafee8b568e796863980365080abdb8d675e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:19:01 2015 -0300

      pc: Generate init functions with a macro

      All pc-i440fx and pc-q35 init functions simply call the corresponding
      compat function and then call the main init function. Use a macro to
      generate that code.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 211b5b1d0a31f2f7593d6858a0b10487fb7b7fac
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:19:00 2015 -0300

      piix: Eliminate pc_init_pci()

      The function is not needed anymore, we can simply call pc_init1()
      directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72d164aa73b7c8d22a63b8ee789f97e4a8d2aa5c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:59 2015 -0300

      piix: Add kvmclock_enabled, pci_enabled globals

      This looks like a step backwards, but it will allow pc-0.1[0123] and
      isapc to follow the same compat+init pattern used by the other
      machine-types, allowing us to generate all init function using the same
      macro later.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d48f4fa69eb3efb03a2efe2e4606a97a17cf222f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:58 2015 -0300

      machine: Remove unused fields from QEMUMachine

      This removes the following fields from QEMUMachine: family, alias,
      reset, hot_add_cpu, units_per_default_bus, no_serial, no_parallel,
      use_virtcon, use_sclp, no_floppy, no_cdrom, default_display,
      compat_props, and hw_version.

      The only users of those fields were already converted to use QOM and
      MachineClass directly, so they are not needed anymore.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d644b11657ae047d50d8ea9ce285ecd6dae04ca2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:57 2015 -0300

      pc: Remove qemu_register_pc_machine() function

      The helper is not needed anymore, as the PC machine classes are
      registered using QOM directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 865906f7fdadd2732441ab158787f81f6a212bfe
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:56 2015 -0300

      pc: Don't use QEMUMachine anymore

      Now that we have a DEFINE_PC_MACHINE helper macro that just requires an
      initialization function, it is trivial to convert them to register a QOM
      machine class directly, instead of using QEMUMachine.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 25519b062c70f2afe2d2f0c262f3838a41e8bc7c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:55 2015 -0300

      pc: Move compat_props setting inside *_machine_options() functions

      This will simplify the DEFINE_PC_MACHINE macro, and will help us to
      implement reuse of PC_COMPAT_* macros through class_init function reuse,
      in the future.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fddd179ab962f6f78a8493742e1068d6a620e059
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:54 2015 -0300

      pc: Convert *_MACHINE_OPTIONS macros into functions

      By now the new functions will get QEMUMachine as argument, but they will
      be later converted to initialize a MachineClass struct directly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 61f219dfb093c0df91926928c780299cdf429619
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:53 2015 -0300

      pc: Define machines using a DEFINE_PC_MACHINE macro

      This will automatically generate the existing QEMUMachine structs based
      on the *_MACHINE_OPTIONS macros, and automatically add registration code
      for them.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b6b5c8e492ae7b71a16fe702b7409bff0feebfa7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 15 14:18:52 2015 -0300

      pc: Define MACHINE_OPTIONS macros consistently for all machines

      Define a MACHINE_OPTIONS macro for each PC machine, and move every field
      inside the QEMUMachine structs to the macros, except for name, init, and
      compat_props.

      This also ensures that all MACHINE_OPTIONS inherit the fields from the
      next version, so their definitions carry only the changes that exist
      between one version and the next one.

      Comments about specific cases:

      pc-*-2.1:

        Existing PC_*_2_1_MACHINE_OPTIONS macros were defined as:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin"

        PC_*_2_2_MACHINE_OPTIONS is:
            PC_*_2_3_MACHINE_OPTIONS
        which is expanded to:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin",
            .default_display = "std"

        The only difference between 2_1 and 2_2 is .default_display, that's why
        we didn't reuse PC_*_2_2_MACHINE_OPTIONS. The good news is that having
        multiple initializers for a field is allowed by C99, and the last
        initializer overrides the previous ones.

        So we can reuse the 2_2 macro in 2_1 and define PC_*_2_1_MACHINE_OPTIONS
        as:
            PC_*_2_2_MACHINE_OPTIONS,
            .default_display = NULL

      pc-*-1.7:

        PC_*_1_7_MACHINE_OPTIONS was defined as:
            PC_*_MACHINE_OPTIONS

        PC_*_2_0_MACHINE_OPTIONS is defined as:
            PC_*_2_1_MACHINE_OPTIONS
        which is expanded to:
            PC_*_2_2_MACHINE_OPTIONS,
            .default_display = NULL
        which is expanded to:
            PC_*_2_3_MACHINE_OPTIONS,
            .default_display = NULL
        which is expanded to:
            PC_*_MACHINE_OPTIONS,
            .default_machine_opts = "firmware=bios-256k.bin",
            .default_display = "std",
            .default_display = NULL  /* overrides the previous line */

        So, the only difference between PC_*_1_7_MACHINE_OPTIONS and
        PC_*_2_0_MACHINE_OPTIONS is .default_machine_opts (as .default_display
        is not explicitly set by PC_*_MACHINE_OPTIONS so it is NULL).

        So we can keep the macro reuse pattern and define
        PC_*_2_0_MACHINE_OPTIONS as:
            PC_*_2_0_MACHINE_OPTIONS,
            .default_machine_opts = NULL

      pc-*-2.4 (alias and is_default fields):

        Set alias and is_default fields inside the 2.4 MACHINE_OPTIONS macro,
        and clear it in the 2.3 macro (that reuses the 2.4 macro).

      hw_machine:

        As all the machines older than v1.0 set hw_version explicitly, we can
        safely move the field to the MACHINE_OPTIONS macros without affecting
        the other versions that reuse them.

      init function:

        Some machines had the init function set inside the MACHINE_OPTIONS
        macro. Move it to the QEMUMachine declaration, to keep it consistent
        with the other machines.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f6d5a0bad276ea97fac4e0efb0f41f54a3f1ac84
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:10 2015 -0300

      piix: Define PC_COMPAT_0_10

      Move compat_props from pc-0.10 to the macro, to make it consistent with
      the other machines.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit faf7e4254fa33a13805a34a1ffeeb9dcc0a36a5e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:09 2015 -0300

      piix: Move pc-0.1[23] rombar compat props to PC_COMPAT_0_13

      The VGA and vmware-svga rombar compat properties were added by commit
      281a26b15b4adcecb8604216738975abd754bea8, but only to pc-0.13 and
      pc-0.12. This breaks the PC_COMPAT_* nesting pattern we currently
      follow.

      The new variables will now be inherited by pc-0.11 and older, but
      pc-0.11 and pc-0.10 already have PCI.rombar=0 on compat_props, so they
      shouldn't be affected at all.

      Cc: Stefan Weil <sw@weilnetz.de>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d765519bef48bd95f2139314a5354144387523eb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:08 2015 -0300

      piix: Move pc-0.13 virtio-9p-pci compat to PC_COMPAT_0_13

      The compat property was added by commit
      9dbcca5aa13cb9ab40788ac4c56bc227d94ca920, and the pc-0.12 and older
      machine-types were not changed because virtio-9p-pci was introduced on QEMU
      0.13 (commit 9f10751365b26b13b8a9b67e0e90536ae3d282df). The only problem is
      that this breaks the PC_COMPAT_* nesting pattern we currently use.

      So, move the property to PC_COMPAT_0_13. This make pc-0.12 and older inherit
      it, but that shouldn't be an issue as QEMU 0.12 didn't have virtio-9p-pci.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d5303df71073da70e0ad29a6dfb304ec7b747f5c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:07 2015 -0300

      piix: Move pc-0.11 drive version compat props to PC_COMPAT_0_11

      The current code setting ide-drive.ver and scsi-disk.ver on pc-0.11
      breaks the PC_COMPAT_* nesting pattern we currently use.

      As those variables are overwritten in pc-0.10 too, they can be inherited
      by pc-0.10 with no side-effects at all.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit bb08d8829b5bec6af619e4532a397ef12727516c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:06 2015 -0300

      piix: Move pc-0.14 qxl compat properties to PC_COMPAT_0_14

      Those properties were introduced by commit
      3827cdb1c3aa17a792d1658161195b9d7173c26b. They were not duplicated into
      pc-0.13 and older because 0.14 was the first QEMU version supporting
      qxl. The only problem is that this breaks the PC_COMPAT_* nesting
      pattern we currently use.

      So, move the properties to PC_COMPAT_0_14. This makes pc-0.13 and older
      inherit them, but that shouldn't be an issue as QEMU 0.13 didn't support
      qxl.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 38ff32c6e6fd966c5adb9cde4d393a8cca9ef093
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:05 2015 -0300

      spapr: define SPAPR_COMPAT_2_3

      Don't add the pseries-2.3 machine yet, but define the corresponding
      SPAPR_COMPAT macro to make sure both pseries-2.2 and pseries-2.1 will
      inherit HW_COMPAT_2_3.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4dfd8eaa19c90087f19b56da5d04d9c468109a65
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:04 2015 -0300

      spapr: Use HW_COMPAT_* inside SPAPR_COMPAT_* macros

      SPAPR_COMPAT_2_1 will need to include both HW_COMPAT_2_2 and
      HW_COMPAT_2_1, so include HW_COMPAT_2_1 inside SPAPR_COMPAT_2_1 and
      HW_COMPAT_2_2 inside SPAPR_COMPAT_2_2.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 42134ac9d74799cf2f70257798b72a2988b75d31
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:03 2015 -0300

      pc: Define PC_COMPAT_2_[123] macros

      Once we start adding compat code for pc-2.3, the usage of HW_COMPAT_2_1
      in pc-*-2.2 won't be enough, as it also has to include PC_COMPAT_2_3
      inside it. To ensure that, define PC_COMPAT_2_3, PC_COMPAT_2_2, and
      PC_COMPAT_2_1 macros.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1edbde82b809f80b973978886d8232fbf280cb03
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:02 2015 -0300

      hw: Define empty HW_COMPAT_2_[23] macros

      Now we can make everything consistent and define the macros even if they
      are still empty.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit dd754baf46b6479a02521f671a0b58ffc799810e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:01 2015 -0300

      spapr: Move commas inside SPAPR_COMPAT_* macros

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a7cde24dc2f104c8e5861df0e2938e79264e9d58
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:53:00 2015 -0300

      pc: Move commas inside PC_COMPAT_* macros

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f27086a731bbd0141646702c95f6dc5fce3e8575
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:52:59 2015 -0300

      hw: Move commas inside HW_COMPAT_2_1 macro

      Changing the convention to include commas inside the macros will allow
      macros containing empty lists to be defined and used without compilation
      errors.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4974920ab8fc8cf05687f1f764650dbc7c821004
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu May 14 15:52:58 2015 -0300

      pc: Replace tab with spaces

      Coding style change only.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ecfa60e37439c870d08a90a845b061a53aa26f74
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:07 2015 +0800

      hw/s390x/virtio-ccw: use alias property for virtio-balloon-ccw

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 39b87c7b9f8bf3618e0357699d29615e521264d8
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:06 2015 +0800

      hw/virtio/virtio-pci: use alias property for virtio-balloon-pci

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1190044ea5a1c9a871664c4e2013072e51e56d5a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Mon May 11 17:34:05 2015 +0800

      hw/virtio/virtio-balloon: move adding property to virtio_balloon_instance_init

      This is in preparation for using alias property in virtio-balloon-pci
      and virtio-balloon-ccw.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 07e15486faf353260431f10e85185372c5036baa
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:58 2015 +0200

      target-tricore: fix BOL_ST_H_LONGOFF using ld

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-4-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 9bbd4843c052a0a467c7a3363046b0c95c0e5fc0
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:57 2015 +0200

      target-tricore: fix msub32_q producing the wrong overflow bit

      The inversion of the overflow bit as a special case, which was needed for the
      madd32_q instructions, does not apply for msub32_q instructions. So remove it.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-3-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 05b6ca9bbcaede74120050aa8e6684300c09257c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri May 22 12:15:56 2015 +0200

      target-tricore: fix OPC2_32_RR_DVINIT_HU having write before use on the result

      If the argument r1 was the same as the extended result register r3+1, we would
      overwrite r1 and then use it.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Message-Id: <1432289758-6250-2-git-send-email-kbastian@mail.uni-paderborn.de>

  commit 97af820f539efe80b87615a04f9de11ea585f725
  Merge: 2cc3bdb 3960c33
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 17:10:57 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150529' into staging

      target-arm:
       * Support ACPI for ARMv8 systems using the 'virt' board
         (and a UEFI boot image, typically)
       * avoid buffer overrun in some UNPREDICTABLE ldrd/strd cases
       * further work preparing for 64-bit EL2/EL3 support

      # gpg: Signature made Fri May 29 12:14:06 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150529: (39 commits)
        target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd
        hw/arm/virt: Enable dynamic generation of ACPI v5.1 tables
        ACPI: split CONFIG_ACPI into 4 pieces
        hw/arm/virt-acpi-build: Add PCIe controller in ACPI DSDT table
        hw/acpi/aml-build: Add Unicode macro
        hw/acpi/aml-build: Add aml_dword_io() term
        hw/acpi/aml-build: Add aml_create_dword_field() term
        hw/acpi/aml-build: Add aml_else() term
        hw/acpi/aml-build: Add aml_lnot() term
        hw/acpi/aml-build: Add aml_or() term
        hw/acpi/aml-build: Add ToUUID macro
        hw/acpi/aml-build: Make aml_buffer() definition consistent with the spec
        hw/arm/virt-acpi-build: Generate MCFG table
        hw/arm/virt-acpi-build: Generate RSDP table
        hw/arm/virt-acpi-build: Generate RSDT table
        hw/arm/virt-acpi-build: Generate GTDT table
        hw/arm/virt-acpi-build: Generate MADT table
        hw/arm/virt-acpi-build: Generate FADT table and update ACPI headers
        hw/arm/virt-acpi-build: Generation of DSDT table for virt devices
        hw/acpi/aml-build: Add aml_interrupt() term
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2cc3bdbe2d3908f7a813d1c2d774cc2bf07746cd
  Merge: 2a90c45 9abe3bd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 15:32:15 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-block-2015-05-29' into staging

      Block QAPI, monitor, command line patches

      # gpg: Signature made Fri May 29 12:02:32 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-block-2015-05-29:
        qapi: add dirty bitmap status

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a90c454a1b90ace56ed908cd064f2fd483d1231
  Merge: 9441aa2 63c67b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 14:24:35 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150529-1' into staging

      gtk: add opengl rendering support.
      small bugfixes for gtk and opengl ui code.

      # gpg: Signature made Fri May 29 10:44:54 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150529-1:
        gtk: Replace gdk_cursor_new()
        gtk: add opengl support, using egl
        ui: add egl-helpers
        ui: shader.h protect against double inclusion
        ui: use libexpoxy

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9abe3bdc45ced367fe034c0fdd7c686212389767
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue May 12 15:53:01 2015 -0400

      qapi: add dirty bitmap status

      Bitmaps can be in a handful of different states with potentially
      more to come as we tool around with migration and persistence patches.

      Management applications may need to know why certain bitmaps are
      unavailable for various commands, e.g. busy in another operation,
      busy being migrated, etc.

      Right now, all we offer is BlockDirtyInfo's boolean member 'frozen'.
      Instead of adding more booleans, replace it by an enumeration member
      'status' with values 'active' and 'frozen'.  Then add new value
      'disabled'.

      Incompatible change.  Fine because the changed part hasn't been
      released so far.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      [Commit message tweaked]
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3960c336ad96c2183549c8bf32bbff93ecda7ea4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:29:00 2015 +0100

      target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd

      A LDRD or STRD where rd is not an even number is UNPREDICTABLE.
      We were letting this fall through, which is OK unless rd is 15,
      in which case we would attempt to do a load_reg or store_reg
      to a nonexistent r16 for the second half of the double-word.
      Catch the odd-numbered-rd cases and UNDEF them instead.

      To do this we rearrange the structure of the code a little
      so we can put the UNDEF catches at the top before we've
      allocated TCG temporaries.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431348973-21315-1-git-send-email-peter.maydell@linaro.org

  commit d7c2e2db28eb7e8f2ed7467fa2f2c59026b206d1
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/arm/virt: Enable dynamic generation of ACPI v5.1 tables

      Initialize VirtGuestInfoState and register a machine_init_done notify to
      call virt_acpi_build().

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-25-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 135a67a692bedb952ea720351026247104da8645
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      ACPI: split CONFIG_ACPI into 4 pieces

      As core.c, piix4.c, ich9.c and pcihp.c are for x86, add CONFIG_ACPI_X86
      to make it only for x86. ARM doesn't support cpu and memory hotplug, add
      CONFIG_ACPI_CPU_HOTPLUG and CONFIG_ACPI_MEMORY_HOTPLUG to exclude them
      for target-arm.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-24-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4e5de1ae02f6b47eb088531d3d4d047b4db6cfa
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/arm/virt-acpi-build: Add PCIe controller in ACPI DSDT table

      Add PCIe controller in ACPI DSDT table, so the guest can detect
      the PCIe.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-23-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e1f776c434f8f18079b82d8121c166fb53a63451
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:59 2015 +0100

      hw/acpi/aml-build: Add Unicode macro

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-22-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 616ef329adbb671be783a1dba96d881b9218ff80
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_dword_io() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-21-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ed8176a37a8f227e61daddbcf92dc5d1cad45818
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_create_dword_field() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-20-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 467b07dfae6087381d0993ab910253a6c1850457
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_else() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-19-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea7df04a0217fe6314a1520dde1883c45fefcaaa
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_lnot() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-18-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 922cc8823e484733021a7be5b0e876eba2218623
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:58 2015 +0100

      hw/acpi/aml-build: Add aml_or() term

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-17-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b930fb9db4aa07abb8f3871eb7379242edbdf2a5
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/acpi/aml-build: Add ToUUID macro

      Add ToUUID macro, this is useful for generating PCIe ACPI table.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-16-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ed8b5847e46c24d6e9c286892a00a34bee9b0835
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/acpi/aml-build: Make aml_buffer() definition consistent with the spec

      According to ACPI spec, DefBuffer can take two parameters: BufferSize
      and ByteList. Make it consistent with the spec. Uninitialized buffer
      could be requested by passing ByteList as NULL to reserve space.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-15-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8434488400971c6793893b8c9547bc6b97e076ce
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:57 2015 +0100

      hw/arm/virt-acpi-build: Generate MCFG table

      Generate MCFG table for PCIe controller.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-14-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4bec5d876b694f7f13ad3fcfe510ff46e9748d0
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate RSDP table

      RSDP points to RSDT which in turn points to other tables.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-13-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 243bdb79fb0b2eda176cdef37700f29068a71d43
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate RSDT table

      RSDT points to other tables FADT, MADT, GTDT. This code is shared with x86.

      Here we still use RSDT as UEFI puts ACPI tables below 4G address space,
      and UEFI ignore the RSDT or XSDT.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-12-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ee246400c1ceef2014e120b718388d5f4aea8a2a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate GTDT table

      ACPI v5.1 defines GTDT for ARM devices as a place to describe timer
      related information in the system. The Arch Timer interrupts must
      be provided for GTDT.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-11-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 982d06c561a62cf7d2a8d31e8a8c107fb3477419
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:56 2015 +0100

      hw/arm/virt-acpi-build: Generate MADT table

      MADT describes GIC enabled ARM platforms. The GICC and GICD
      subtables are used to define the GIC regions.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-10-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c2f7c0c306dcd56725b506d3743eed421e6d0994
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/arm/virt-acpi-build: Generate FADT table and update ACPI headers

      In the case of mach virt, it is used to set the Hardware Reduced bit
      and enable PSCI SMP booting through HVC. So ignore FACS and FADT
      points to DSDT.

      Update the header definitions for FADT taking into account the new
      additions of ACPI v5.1 in `include/hw/acpi/acpi-defs.h`

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-9-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfccd8cfd7c5d1b6740463821d84106bbaced44c
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/arm/virt-acpi-build: Generation of DSDT table for virt devices

      DSDT consists of the usual common table header plus a definition
      block in AML encoding which describes all devices in the platform.

      After initializing DSDT with header information the namespace is
      created which is followed by the device encodings. The devices are
      described using the Resource Template for the 32-Bit Fixed Memory
      Range and the Extended Interrupt Descriptors.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-8-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 205d1d1c04033b1be4c925e687b6865d1fc1b26b
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/acpi/aml-build: Add aml_interrupt() term

      Add aml_interrupt() for describing device interrupt in resource template.
      These can be used to generating DSDT table for ACPI on ARM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-7-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dc17ab1de53d37ddcca81b16dfeae839322fbe5a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:55 2015 +0100

      hw/acpi/aml-build: Add aml_memory32_fixed() term

      Add aml_memory32_fixed() for describing device mmio region in resource
      template. These can be used to generating DSDT table for ACPI on ARM.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1432522520-8068-6-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f5d8c8cd792b3712f85a1f9a3a9a719015691975
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt-acpi-build: Basic framework for building ACPI tables on ARM

      Introduce a preliminary framework in virt-acpi-build.c with the main
      ACPI build functions. It exposes the generated ACPI contents to
      guest over fw_cfg.

      The required ACPI v5.1 tables for ARM are:
      - RSDP: Initial table that points to XSDT
      - RSDT: Points to FADT GTDT MADT tables
      - FADT: Generic information about the machine
      - GTDT: Generic timer description table
      - MADT: Multiple APIC description table
      - DSDT: Holds all information about system devices/peripherals, pointed by FADT

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-5-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a1f001be3ea7478cac803d03149cfcfc1fa2094
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt: Record PCIe ranges in MemMapEntry array

      To generate ACPI table for PCIe controller, we need the base and size of
      the PCIe ranges. Record these ranges in MemMapEntry array, then we could
      share and use them for generating ACPI table.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1432522520-8068-4-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit afe0b3803f1a5fffe618af5a483d4c9567b5c5b7
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/arm/virt: Move common definitions to virt.h

      Move some common definitions to virt.h. These will be used by
      generating ACPI tables.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1432522520-8068-3-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff80dc7fa8045e2b2531888d965424d2b0e1d1b6
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri May 29 11:28:54 2015 +0100

      hw/acpi/aml-build: Make enum values to be upper case to match coding style

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Message-id: 1432522520-8068-2-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1eced713d9913a5c58ba9daa795f10e4c856c49
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Add WFx instruction trap support

      Add support for trapping WFI and WFE instructions to the proper EL when
      SCTLR/SCR/HCR settings apply.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: removed unnecessary tweaking of syn_wfx() prototype;
       use raise_exception();
       don't trap on WFE (and add comment explaining why not);
       remove unnecessary ARM_FEATURE checks;
       trap to EL3, not EL1, if in S-EL0 and SCTLR check fires]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 84549b6dcf9147559ec08b066de673587be6b763
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Don't halt on WFI unless we don't have any work

      Just NOP the WFI instruction if we have work to do.
      This doesn't make much difference currently (though it does avoid
      jumping out to the top level loop and immediately restarting),
      but the distinction between "halt" and "don't halt" will become
      more important when the decision to halt requires us to trap
      to a higher exception level instead.

      Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 647f767ba3b37fb229275086187e96242248a4ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Move TB flags down to fill gap

      Deleting the now-unused ARM_TBFLAG_CPACR_FPEN left a gap in the
      bit usage; move the following ARM_TBFLAG_XSCALE_CPAR and
      ARM_TBFLAG_NS_SHIFT down 3 bits to fill the gap.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 9dbbc748d671c70599101836cd1c2719d92f3017
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:53 2015 +0100

      target-arm: Extend FP checks to use an EL

      Extend the ARM disassemble context to take a target exception EL instead of a
      boolean enable. This change reverses the polarity of the check making a value
      of 0 indicate floating point enabled (no exception).

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: Use a common TB flag field for AArch32 and AArch64;
       CPTR_EL2 exists in v7; CPTR_EL2 should trap for EL2 accesses;
       CPTR_EL2 should not trap for secure accesses; CPTR_EL3
       should trap for EL3 accesses; CPACR traps for secure
       accesses should trap to EL3 if EL3 is AArch32]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 3cf6a0fcedd429693d439556543400d5f0e31e1d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Make singlestate TB flags common between AArch32/64

      Currently we keep the TB flags PSTATE_SS and SS_ACTIVE in different
      bit positions for AArch64 and AArch32. Replace these separate
      definitions with a single common flag in the upper part of the
      flags word.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit c6f191642a4027909813b4e6e288411f8371e951
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Add AArch64 CPTR registers

      Adds CPTR_EL2/3 system registers definitions and access function.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      [PMM: merge CPTR_EL2 and HCPTR definitions into a single
       def using STATE_BOTH;
       don't use readfn/writefn to implement RAZ/WI registers;
       don't use accessfn for the no-EL2 CPTR_EL2;
       fix cpacr_access logic to catch EL2 accesses to CPACR being
       trapped to EL3;
       use new CP_ACCESS_TRAP_EL[23] rather than setting
       exception.target_el directly]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 38836a2cd47c20daaaa84873e3d6020f19e4bfca
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:52 2015 +0100

      target-arm: Allow cp access functions to indicate traps to EL2 or EL3

      Some coprocessor access functions will need to indicate that the
      instruction should trap to EL2 or EL3 rather than the default
      target exception level; add corresponding CPAccessResult enum
      entries and handling code.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 012a906b19e99b126403ff4a257617dab9b34163
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Update interrupt handling to use target EL

      Updated the interrupt handling to utilize and report through the target EL
      exception field.  This includes consolidating and cleaning up code where
      needed. Target EL is now calculated once in arm_cpu_exec_interrupt() and
      do_interrupt was updated to use the target_el exception field.  The
      necessary code from arm_excp_target_el() was merged in where needed and the
      function removed.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c63285991b371c031147ad620dd7671662a90303
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Make raise_exception() take syndrome and target EL

      Rather than making every caller of raise_exception set the
      syndrome and target EL by hand, make these arguments to
      raise_exception() and have that do the job.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 863b6589d738d0b4c8b283297b0ff228f3d3fb14
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Set exception target EL in tlb_fill

      Set the exception target EL for MMU faults in tlb_fill.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:51 2015 +0100

      target-arm: Move setting of exception info into tlb_fill

      Move the code which sets exception information out of
      arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill
      is the only caller which wants to raise_exception()
      so it makes more sense for it to handle the whole of
      the exception setup.

      As part of this cleanup, move the user-mode-only
      implementation function for the handle_mmu_fault CPU
      method into cpu.c so we don't need to make it globally
      visible, and rename the softmmu-only utility function
      arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear
      that it's not the same thing.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit f2932df777dace044719dc2f394f5a5a8aa1b1cd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Set correct syndrome for faults on MSR DAIF*, imm

      If the SCTLR.UMA trap bit is set then attempts by EL0 to update
      the PSTATE DAIF bits via "MSR DAIFSet, imm" and "MSR DAIFClr, imm"
      instructions will raise an exception. We were failing to set
      the syndrome information for this exception, which meant that
      it would be reported as a repeat of whatever the previous
      exception was. Set the correct syndrome information.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit e3b1d480995f6e2e86ef062038e618c1234dbcf1
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Extend helpers to route exceptions

      Updated the various helper routines to set the target EL as needed using a
      dedicated function.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-3-git-send-email-greg.bellows@linaro.org
      [PMM: Also set target_el in fault cases in access_check_cp_reg()]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 737103619869600668cc7e8700e4f6eab3943896
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri May 29 11:28:50 2015 +0100

      target-arm: Add exception target el infrastructure

      Add a CPU state exception target EL field that will be used for communicating
      the EL to which an exception should be routed.

      Add a disassembly context field for tracking the EL3 architecture needed for
      determining the target exception EL.

      Add a target EL argument to the generic exception helper for callers to specify
      the EL to which the exception should be routed.  Extended the helper to set
      the newly added CPU state exception target el.

      Added a function for setting the target exception EL and updated calls to helpers
      to call it.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9441aa282bc3213ef0530cab86f318b877bac25c
  Merge: ba7c388 55a1d80
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 11:23:07 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150529-1' into staging

      kbd: add support for brazilian keyboard (two extra keys).
      input: add virtio-input devices.

      # gpg: Signature made Fri May 29 10:09:02 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150529-1:
        virtio-input: emulated devices [device]
        virtio-input: core code & base class [device]
        virtio-input: add linux/input.h
        kbd: add brazil kbd keys to x11 evdev map
        kbd: add brazil kbd keys to qemu

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 63c67b6d4462b6589b371d55e3740e9f0dba3281
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed May 20 15:35:31 2015 +0200

      gtk: Replace gdk_cursor_new()

      gdk_cursor_new() has been deprecated in GTK 3.16, it is recommended to
      use gdk_cursor_new_for_display() instead, so do that.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 97edf3bd5eab8952d475de66ede77307c12b8c48
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jan 20 12:43:28 2015 +0100

      gtk: add opengl support, using egl

      This adds opengl rendering support to the gtk ui, using egl.
      It's off by default for now, use 'qemu -display gtk,gl=on'
      to play with this.

      Note that gtk got native opengl support with release 3.16.
      There most likely will be a separate implementation for 3.16+,
      using the native gtk opengl support.  This patch covers older
      versions (and for the time being 3.16 too, hopefully without
      rendering quirks).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ba7c388963e099c0d2cedb7f048e30747ffff25d
  Merge: ce0274f f7a8beb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 29 10:17:48 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150529-1' into staging

      spice: misc fixes.

      # gpg: Signature made Fri May 29 09:16:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150529-1:
        spice: fix spice_chr_add_watch() pre-condition
        spice: don't update mm_time when spice-server is stopped.
        spice-char: notify the server when chardev is writable
        virtio-console: notify chardev when writable

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ced9e9f6da2257224591b91727cfeee4f3977fb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jan 6 15:40:00 2015 +0100

      ui: add egl-helpers

      Add helper functions to initialize OpenGL using egl.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 896e1a050a0d333b1f0ec0768cc64e26c5d0d104
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon May 11 12:25:23 2015 +0200

      ui: shader.h protect against double inclusion

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit dcf30025c3e3d43140a687240433de1920adf8b0
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon May 11 12:24:43 2015 +0200

      ui: use libexpoxy

      libepoxy does the opengl extension handling for us.

      It also is helpful for trouble-shooting as it prints nice error messages
      instead of silently failing or segfaulting in case we do something
      wrong, like using gl commands not supported by the current context.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 55a1d80a41032d6133adec041c0096820beaa1b7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 1 10:06:29 2014 +0200

      virtio-input: emulated devices [device]

      This patch adds the virtio-input-hid base class and
      virtio-{keyboard,mouse,tablet} subclasses building on the base class.
      They are hooked up to the qemu input core and deliver input events
      to the guest like all other hid devices (ps/2 kbd, usb tablet, ...).

      Using them is as simple as adding "-device virtio-tablet-device" to
      your command line, for use all transports except pci.  virtio-pci
      support comes as separate patch, once virtio-pci got virtio 1.0
      support.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f73ddbad397f98c1d476ffbf93d65af1cfa796e6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 14 14:39:20 2014 +0100

      virtio-input: core code & base class [device]

      This patch adds virtio-input support to qemu.  It brings a abstract
      base class providing core support, other classes can build on it to
      actually implement input devices.

      virtio-input basically sends linux input layer events (evdev) over
      virtio.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2fe7c31832a345cdc34314cdcd5478d06b884842
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Mar 19 11:55:24 2015 +0100

      virtio-input: add linux/input.h

      Linux input layer (evdev) header file.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 33aa30cafcce053b833f9fe09fbb88e2f54b93aa
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 26 13:12:54 2015 +0200

      kbd: add brazil kbd keys to x11 evdev map

      This patch adds the two extra brazilian keys to the evdev keymap for
      X11.  This patch gets the two keys going with the vnc, gtk and sdl1
      UIs.

      The SDL2 library complains it doesn't know these keys, so the SDL2
      library must be fixed before we can update ui/sdl2-keymap.h

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b771f470f3e2f99f585eaae68147f0c849fd1f8d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 26 10:39:10 2015 +0200

      kbd: add brazil kbd keys to qemu

      The brazilian computer keyboard layout has two extra keys (compared to
      the usual 105-key intl ps/2 keyboard).  This patch makes these two keys
      known to qemu.

      For historic reasons qemu has two ways to specify a key:  A QKeyCode
      (name-based) or a number (ps/2 scancode based).  Therefore we have to
      update multiple places to make new keys known to qemu:

        (1) The QKeyCode definition in qapi-schema.json
        (2) The QKeyCode <-> number mapping table in ui/input-keymap.c

      This patch does just that.  With this patch applied you can send those
      two keys to the guest using the send-key monitor command.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f7a8beb5e6a13dc924895244777d9ef08b23b367
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Thu May 28 15:04:58 2015 +0200

      spice: fix spice_chr_add_watch() pre-condition

      Since e02bc6de30c44fd668dc0d6e1cd1804f2eed3ed3, add_watch() is called
      with G_IO_HUP. Even if spice-qemu-char ignores this flag, the
      precondition must be changed.

      https://bugzilla.redhat.com/show_bug.cgi?id=1128992

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 641381c1fcd66ea8de07ecfcd733089da26cbba9
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue May 12 11:54:34 2015 +0200

      spice: don't update mm_time when spice-server is stopped.

      Skip mm_time updates (in qxl device memory) in case the guest is stopped.
      Guest isn't able to look anyway, and it causes problems with migration.

      Also make sure the initial state for spice server is stopped.

      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e95e203c085b7731746e39c9b9f8bd2f6eaa0cd6
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue May 5 16:58:56 2015 +0200

      spice-char: notify the server when chardev is writable

      The spice server is polling on write, unless
      SPICE_CHAR_DEVICE_NOTIFY_WRITABLE flag is set. In this case, qemu must
      call spice_server_char_device_wakeup() when the frontend is writable.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 246ca55faff625f4c15e21f3424781e215a254ea
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue May 5 16:58:55 2015 +0200

      virtio-console: notify chardev when writable

      When the virtio serial is writable, notify the chardev backend
      with qemu_chr_accept_input().

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ce0274f730eacbd24c706523ddbbabb6b95d0659
  Author: Fabien Chouteau <chouteau@adacore.com>
  Date:   Sat Feb 7 09:38:45 2015 +0100

      Revert "gdbstub: Do not kill target in system emulation mode"

      The requirements described in this patch are implemented by "Add GDB
      qAttached support".

      This reverts commit 00e94dbc7fd0110b0555d59592b004333adfb4b8.

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a3919386eab91b56e40fb4faead980f57a664b2e
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:44 2015 +0100

      Add GDB qAttached support

      With this patch QEMU handles qAttached request from gdb. When QEMU
      replies 1, GDB sends a "detach" command at the end of a debugging
      session otherwise GDB sends "kill".

      The default value for qAttached is 1 on system emulation and 0 on user
      emulation.

      Based on original version by Fabien Chouteau.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4dabe747af0a6bd66a86c2c7879f1882bec43c33
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:43 2015 +0100

      gdbstub: Introduce an is is_query_packet helper

      This helper supports parsing of query packets with optional extensions.
      The separator can be specified so that we can use it already for both
      qqemu.sstep[=] and qSupported[:feature].

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 070949f39ee96bd16654e6623ab4ff627d918ba6
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sat Feb 7 09:38:42 2015 +0100

      gdbstub: Fix qOffsets packet detection

      qOffsets has no additional optional parameters. So match the complete
      string to avoid stumbling over possible future commands with identical
      prefix.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a84904737277c2f07c8fbcb69db27451d844f12b
  Merge: bc3004f 46ca6b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 28 14:57:34 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150528' into staging

      A set of patches add support for vector registers on s390x.
      Notable: Floating point registers and vector registers overlap,
      so extra care is needed so that we end up with a consistent state
      in all cases.

      # gpg: Signature made Thu May 28 09:37:27 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150528:
        s390x: Enable vector processing capability
        s390x: Migrate vector registers
        s390x: Add vector registers to ELF dump
        linux/elf.h update
        s390x: Add vector registers to HMP output
        s390x: gdb updates for vector registers
        gdb-xml: Include XML for s390 vector registers
        s390x: Store Additional Status SIGP order
        s390x: Vector Register IOCTLs
        s390x: Common access to floating point registers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc3004f0bb28d36b97eea5ff48922d16b4df7a1f
  Merge: 0915aed 2bc22a5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 28 11:03:02 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Wed May 27 11:02:55 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        net/net: Record usage status of mac address
        tap: Improve -netdev/netdev_add/-net/... tap error reporting
        tap: Finish conversion of tap_open() to Error
        tap-solaris: Convert tap_open() to Error
        tap-bsd: Convert tap_open() to Error
        tap-linux: Convert tap_open() to Error
        tap: Permit incremental conversion of tap_open() to Error
        tap: Convert launch_script() to Error
        tap: Convert net_init_tap_one() to Error
        tap: Convert tap_set_sndbuf() to Error
        tap: Improve -netdev/netdev_add/-net/... bridge error reporting
        tap: net_tap_fd_init() can't fail, drop dead error handling
        net/dump: Improve -net/host_net_add dump error reporting
        net: Improve -net nic error reporting
        net: Permit incremental conversion of init functions to Error
        net: Improve error message for -net hubport a bit
        net: Change help text to list -netdev instead of -net by default

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46ca6b3bc99ebf9205e28ed14c023ebf84d39bb7
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu Oct 30 09:23:06 2014 -0400

      s390x: Enable vector processing capability

      Everything is finally in place, inform the kernel that user space
      supports vector registers.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b2ac0ff5d9478907cfd5b204c9179f77d0cb943f
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 7 10:52:16 2015 -0400

      s390x: Migrate vector registers

      When migrating a guest, be sure to include the vector registers.
      The vector registers are defined in a subsection, similar to the
      existing subsection for floating point registers.  Since the
      floating point registers are always present (and thus migrated),
      we can skip them when performing the migration of the vector
      registers which may or may not be present.

      Suggested-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 3ceeb2930faf1116ee4bb22c8a7794bb2337e8a9
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 29 14:54:26 2014 -0400

      s390x: Add vector registers to ELF dump

      Create ELF notes for the vector registers where applicable, so that
      their contents can be examined by utilities such as crash or readelf.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit eeef559ab4a80753b7bf31728780692a3a4e3ec1
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Wed Nov 12 14:22:55 2014 -0500

      linux/elf.h update

      Sync with kernel elf.h updates to get s390x vector register definitions.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 56c42271495fc5f6c5bd70c4309a74b425c5cbda
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 29 13:50:37 2014 -0400

      s390x: Add vector registers to HMP output

      There are mechanisms to dump registers via the qemu HMP interface,
      such as the "info registers" command.  Expand this output to dump
      the new vector registers.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ca343c7a84fbe457dd442d26d5a01f31e8a8d308
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Tue Jun 3 08:42:18 2014 -0400

      s390x: gdb updates for vector registers

      gdb allows registers to be displayed/modified, and is being updated
      to account for the new vector registers.  Mirror these changes in
      the gdb stub in qemu so that this can be performed when gdb is
      attached to the qemu gdbserver.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 773d4ebc9a31a5e0efbaf83f76715ab40c355384
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Tue Nov 18 17:03:02 2014 -0500

      gdb-xml: Include XML for s390 vector registers

      Include the vector registers XML file that is provided by gdb,
      and can be used by the qemu gdbserver interface.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit abec53565dce5ed56bff4968d3bed88f6cf68c3c
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Wed Jan 14 09:57:16 2015 -0500

      s390x: Store Additional Status SIGP order

      Add handling for the Store Additional Status at Address order
      that exists for the Signal Processor (SIGP) instruction.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fcb79802e07fe06fe24ba97a027d8a1c3a714fa7
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Mon Aug 18 15:33:39 2014 -0400

      s390x: Vector Register IOCTLs

      Handle the actual syncing of the vector registers with kernel space,
      via the get/put register IOCTLs.

      The vector registers that were introduced with the z13 overlay
      the existing floating point registers.  FP registers 0-15 are
      the high-halves of vector registers 0-15.  Thus, remove the
      freg fields and replace them with the equivalent vector field
      to avoid errors in duplication.  Moreover, synchronize either the
      vector registers via kvm_sync_regs, or floating point registers
      via the GET/SET FPU IOCTLs.

      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit c498d8e36e2998fb67de21a34ece633d356a4834
  Author: Eric Farman <farman@linux.vnet.ibm.com>
  Date:   Thu May 7 14:35:44 2015 -0400

      s390x: Common access to floating point registers

      Provide a routine to access the correct floating point register,
      to simplify future expansion.

      Suggested-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2bc22a58e16f0650e56dccfac9495e5aef58e2ef
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu May 21 17:44:48 2015 +0800

      net/net: Record usage status of mac address

      Currently QEMU dynamically generates mac address for the NIC which
      doesn't specify the mac address. But when we hotplug a NIC without
      specifying mac address, the mac address will increase for the same NIC
      along with hotplug and hot-unplug, and at last it will overflow. And if
      we codeplug one NIC with mac address e.g. "52:54:00:12:34:56", then
      hotplug one NIC without specifying mac address and the mac address of
      the hotplugged NIC is duplicate of "52:54:00:12:34:56".

      This patch add a mac_table to record the usage status and free the mac
      address when the NIC is unrealized.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a308817743be5cc051d3379477f54027deb0befb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:03 2015 +0200

      tap: Improve -netdev/netdev_add/-net/... tap error reporting

      When -netdev tap fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -netdev tap,id=foo
          qemu-system-x86_64: -netdev tap,id=foo: could not configure /dev/net/tun: Operation not permitted
          qemu-system-x86_64: -netdev tap,id=foo: Device 'tap' could not be initialized

      With the command line, the messages go to stderr.  In HMP, they go to
      the monitor.  In QMP, the second one becomes the error reply, and the
      first one goes to stderr.

      Convert net_init_tap() to Error.  This suppresses the unwanted second
      message, and makes the specific error the QMP error reply.

      [Dropped duplicate "and" from error message as suggested by Eric Blake:
      "ifname=, script=, downscript=, and vnet_hdr=, "
      "queues=, and vhostfds= are invalid with helper="
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-16-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 95c35a74fea51e307f6a3967e465a22776056b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:02 2015 +0200

      tap: Finish conversion of tap_open() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-15-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 576c6eb6700d241c9d4a6883d25720c7bbaaeccd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:01 2015 +0200

      tap-solaris: Convert tap_open() to Error

      Fixes inappropriate use of syslog().

      Not fixed: leaks on error paths, suspicious non-fatal errors.  FIXMEs
      added instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-14-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4bce487e14bf8949a91883a3213c2b7fa9d668bc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:59:00 2015 +0200

      tap-bsd: Convert tap_open() to Error

      Fixes inappropriate use of stderr in monitor command handler.

      While there, improve some of the messages a bit.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-13-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47896e2fd3dd80685434b320cb0e10164995e31c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:59 2015 +0200

      tap-linux: Convert tap_open() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-12-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 468dd82408e950d48def28f87e4cffabfd592ace
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:58 2015 +0200

      tap: Permit incremental conversion of tap_open() to Error

      Convert the trivial ones immediately: tap-aix and tap-haiku.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-11-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ac4fcf5639f44f7d863a35eaa2ad07ff31aabc01
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:57 2015 +0200

      tap: Convert launch_script() to Error

      Fixes inappropriate use of stderr in monitor command handler.

      While there, improve the messages some.

      [Fixed Error **err -> Error *err local variable that broke the build.
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-10-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 445f116cabe0c4435590244741ac3d0b8f08d91d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:56 2015 +0200

      tap: Convert net_init_tap_one() to Error

      [Dropped %s from "tap: open vhost char device failed: %s" since
      error_setg_errno() already prints a human-readable error string and
      there is no format string argument.
      --Stefan]

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-9-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80b832c300c2fc39c68e0ab095d408cb9199cfa0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:55 2015 +0200

      tap: Convert tap_set_sndbuf() to Error

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-8-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a8a21be9855e0bb0947a7325d0d1741a8814f21e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:54 2015 +0200

      tap: Improve -netdev/netdev_add/-net/... bridge error reporting

      When -netdev bridge fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -netdev bridge,id=foo
          failed to launch bridge helper
          qemu-system-x86_64: -netdev bridge,id=foo: Device 'bridge' could not be initialized

      The first message goes to stderr.  Wrong for HMP, because errors need
      to go to the monitor there.

      The second message goes to stderr for -netdev, to the monitor for HMP
      netdev_add, and becomes the error reply for QMP netdev_add.

      Convert net_bridge_run_helper() to Error, and propagate its errors
      through net_init_bridge().  This ensures the error gets reported where
      the user is, and suppresses the unwanted second message.

      While there, improve the error messages a bit.

      The above example becomes:

          $ qemu-system-x86_64 -netdev bridge,id=foo
          qemu-system-x86_64: -netdev bridge,id=foo: bridge helper failed

      net_init_tap() also uses net_bridge_run_helper().  Propagate its
      errors there as well.  Improves reporting these errors with -netdev
      tap & friends.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-7-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da4a4eac26381c7fce3f147f3c8a7e7bb483be1e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:53 2015 +0200

      tap: net_tap_fd_init() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-6-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3791f83ca999edc2d11eb2006ccc1091cd712c15
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:52 2015 +0200

      net/dump: Improve -net/host_net_add dump error reporting

      When -net dump fails, it first reports a specific error, then a
      generic one, like this:

          $ qemu-system-x86_64 -net dump,id=foo,file=/eperm
          qemu-system-x86_64: -net dump,id=foo,file=/eperm: -net dump: can't open /eperm
          qemu-system-x86_64: -net dump,id=foo,file=/eperm: Device 'dump' could not be initialized

      Convert net_init_tap() to Error.  This suppresses the unwanted second
      message.

      Improve the error messages to include strerror(errno) where
      appropriate.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-5-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6630886863d4a9b3b7bcb3b0e2895d83eb269c75
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:51 2015 +0200

      net: Improve -net nic error reporting

      When -net nic fails, it first reports a specific error, then a generic
      one, like this:

          $ qemu-system-x86_64 -net nic,netdev=nonexistent
          qemu-system-x86_64: -net nic,netdev=nonexistent: netdev 'nonexistent' not found
          qemu-system-x86_64: -net nic,netdev=nonexistent: Device 'nic' could not be initialized

      Convert net_init_nic() to Error to get rid of the unwanted second
      error message.

      While there, tidy up an Overcapitalized Error Message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-4-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a30ecde6e795682d1473c45acae66a60a76fca2f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:50 2015 +0200

      net: Permit incremental conversion of init functions to Error

      Error reporting for netdev_add is broken: the net_client_init_fun[]
      report the actual errors with (at best) error_report(), and their
      caller net_client_init1() makes up a generic error on top.

      For command line and HMP, this produces an mildly ugly error cascade.

      In QMP, the actual errors go to stderr, and the generic error becomes
      the command's error reply.

      To fix this, we need to convert the net_client_init_fun[] to Error.

      To permit fixing them one by one, add an Error ** parameter to the
      net_client_init_fun[].  If the call fails without returning an Error,
      make up the same generic Error as before.  But if it returns one, use
      that instead.  Since none of them does so far, no functional change.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-3-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca7eb1848bb06d9b75784d7760b83c7b0beb1102
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri May 15 13:58:49 2015 +0200

      net: Improve error message for -net hubport a bit

      Type "hubport" is valid only with -netdev.  Unfortunately, that's
      detected late and the error message doesn't explain why:

          $ qemu-system-i386 -net hubport,id=foo,hubid=0
          qemu-system-i386: -net hubport,id=foo,hubid=0: Device 'hubport' could not be initialized

      Improve the error message to "Parameter 'type' expects a net type".

      Not fixed: -net hubport without the parameters required by -netdev
      hubport still asks for those parameters:

          $ qemu-system-i386 -net hubport
          qemu-system-i386: -net hubport: Parameter 'hubid' is missing

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1431691143-1015-2-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6a8b4a5be21ad4941c8a6a5db1d355a522aea2fb
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Fri May 15 16:58:24 2015 +0200

      net: Change help text to list -netdev instead of -net by default

      Looking at the output of "qemu-system-xxx -help", you easily get
      the impression that "-net" is the preferred way instead of "-netdev"
      to specify host network interface, since the "-net" option is
      omnipresent but the "-netdev" option is only listed as a one-liner
      at the end. This is ugly since "-net" is considered as legacy and
      even might be removed one day. Thus, this patch switches the output
      to explain the host network interfaces with the "-netdev" option
      instead, moving the old "-net" option into some few lines at
      the end.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1431701904-12230-1-git-send-email-thuth@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0915aed5842bd4dbe396b92d4f3b846ae29ad663
  Merge: 0d2ed60 cd6cb73
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 26 11:31:03 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri May 22 20:58:44 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        ahci: do not remap clb/fis unconditionally
        macio: move unaligned DMA write code into separate pmac_dma_write() function
        macio: move unaligned DMA read code into separate pmac_dma_read() function
        qtest: pre-buffer hex nibs
        libqos/ahci: Swap memread/write with bufread/write
        qtest: add memset to qtest protocol
        qtest: Add base64 encoded read/write
        qtest: allow arbitrarily long sends
        qtest/ahci: add migrate halted dma test
        qtest/ahci: add halted dma test
        qtest/ahci: add flush migrate test
        qtest/ahci: add migrate dma test
        qtest/ahci: Add migration test
        ich9/ahci: Enable Migration
        libqos: Add migration helpers
        libqos/ahci: Fix sector set method
        libqos/ahci: Add halted command helpers
        glib: remove stale compat functions
        configure: require glib 2.22

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cd6cb73beb63e5fa62ca8ed540b9d54063b15c44
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      ahci: do not remap clb/fis unconditionally

      This continues the IOMMU fix from 2.3, where we should not attempt
      to remap the CLB or FIS RX buffers if the AHCI device is currently
      running.

      The same applies to migration: keep our mitts off these registers
      unless the device is supposed to be on.

      Does not impact backwards compatibility for the AHCI device.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1431470173-30847-2-git-send-email-jsnow@redhat.com

  commit bd4214fc92090694aefa17882815c6109f0fd70c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri May 22 14:13:44 2015 -0400

      macio: move unaligned DMA write code into separate pmac_dma_write() function

      Similarly switch the macio IDE routines over to use the new function and
      tidy-up the remaining code as required.

      [Maintainer edit: printf format codes adjusted for 32/64bit. --js]

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1425939893-14404-3-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 4827ac1e8f8306b24e61b44ea1f2082ea08099bb
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri May 22 14:13:44 2015 -0400

      macio: move unaligned DMA read code into separate pmac_dma_read() function

      This considerably helps simplify the complexity of the macio read routines and
      by switching macio CDROM accesses to use the new code, fixes the issue with
      the CDROM device being detected intermittently by Darwin/OS X.

      [Maintainer edit: printf format codes adjusted for 32/64bit. --js]

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ailande.co.uk>
      Acked-by: John Snow <jsnow@redhat.com>
      Message-id: 1425939893-14404-2-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 5560b85a31e6f15a8841b66620d9497943094ee4
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: pre-buffer hex nibs

      Instead of converting each byte one-at-a-time and then sending each byte
      over the wire, use sprintf() to pre-compute all of the hex nibs into a
      single buffer, then send the entire buffer all at once.

      This gives a moderate speed boost to memread() and memwrite() functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1431021095-7558-2-git-send-email-jsnow@redhat.com

  commit 91d0374a7ffbd6a9cd0ba159c9160d9f26220cf5
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      libqos/ahci: Swap memread/write with bufread/write

      Where it makes sense, use the new faster primitives.
      For generally small reads/writes such as for the PRDT
      and FIS packets, stick with the more wasteful but
      easier to debug memread/memwrite.

      For ahci-test (before migration tests):
      With this patch:
      real    0m3.675s
      user    0m2.582s
      sys     0m1.718s

      Without any qtest protocol improvements:
      real    0m14.171s
      user    0m12.072s
      sys     0m12.527s

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-6-git-send-email-jsnow@redhat.com

  commit 4d00796364ec4edab86b08abc38fd644d5e3c0ad
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: add memset to qtest protocol

      Previously, memset was just a frontend to write() and only
      stupidly sent the pattern many times across the wire.

      Let's not discuss who stupidly wrote it like that in the first place.
      (Hint: It was me.)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-4-git-send-email-jsnow@redhat.com

  commit 7a6a740d8dcc02f5693315d7935b5de9b963bb96
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:44 2015 -0400

      qtest: Add base64 encoded read/write

      For larger pieces of data that won't need to be debugged and
      viewing the hex nibbles is unlikely to be useful, we can encode
      data using base64 instead of encoding each byte as %02x, which
      leads to some space savings and faster reads/writes.

      For now, the default is left as hex nibbles in memwrite() and memread().
      For the purposes of making qtest io easier to read and debug, some
      callers may want to specify using the old encoding format for small
      patches of data where the savings from base64 wouldn't be that profound.

      memwrite/memread use a data encoding that takes 2x the size of the original
      buffer, but base64 uses "only" (4/3)x, so for larger buffers we can save a
      decent amount of time and space.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1430864578-22072-3-git-send-email-jsnow@redhat.com

  commit 332cc7e9b39ddb2feacb4c71dcd18c3e5b0c3147
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest: allow arbitrarily long sends

      qtest currently has a static buffer of size 1024 that if we
      overflow, ignores the additional data silently which leads
      to hangs or stream failures.

      Use glib's string facilities to allow arbitrarily long data,
      but split this off into a new function, qtest_sendf.

      Static data can still be sent using qtest_send, which avoids
      the malloc/copy overhead.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1430864578-22072-2-git-send-email-jsnow@redhat.com

  commit 5d1cf0917b4f1282ac81bb72697713d14c98a876
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add migrate halted dma test

      Test migrating a halted DMA transaction.
      Resume, then test data integrity.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-10-git-send-email-jsnow@redhat.com

  commit 189d1b6126625212fbb50ed3a30a3e9e7ba7ca37
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add halted dma test

      If we're going to test the migration of halted DMA jobs,
      we should probably check to make sure we can resume them
      locally as a first step.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-9-git-send-email-jsnow@redhat.com

  commit a606ce50c29561b567995ab663cbb40067623e82
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add flush migrate test

      Use blkdebug to inject an error on first flush, then attempt to flush
      on the first guest. When the error halts the VM, migrate to the
      second VM, and attempt to resume the command.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-8-git-send-email-jsnow@redhat.com

  commit 88e21f9485f0a41603f0af3483ff3f11c95979ab
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: add migrate dma test

      Write to one guest, migrate, and then read from the other.
      adjust ahci_io to clear any buffers it creates, so that we
      can use ahci_io safely on both guests knowing we are using
      empty buffers and not accidentally re-using data.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-7-git-send-email-jsnow@redhat.com

  commit 278128ab06c36341edb2c8b0bfcfd92760f4db52
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      qtest/ahci: Add migration test

      Notes:

       * The migration is performed on QOSState objects.

       * The migration is performed in such a way that it does not assume
         consistency between the allocators attached to each. That is to say,
         you can use each QOSState object completely independently and then at
         an arbitrary point decide to migrate, and the destination object will
         now be consistent with the memory within the source guest. The source
         object that was migrated from will have a completely blank allocator.

      ahci-test.c:
       - verify_state is added
       - ahci_migrate is added as a frontend to migrate
       - test_migrate_sanity test case is added.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-6-git-send-email-jsnow@redhat.com

  commit 04329029a8c539eb5f75dcb6d8b016f0c53a031a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      ich9/ahci: Enable Migration

      Lift the flag preventing the migration of the ICH9/AHCI devices.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-5-git-send-email-jsnow@redhat.com

  commit 085248ae87704f1c1e4e1f929f58beca3ba294a2
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:43 2015 -0400

      libqos: Add migration helpers

      libqos.c:
          -set_context for addressing which commands go where
          -migrate performs the actual migration

      malloc.c:
          - Structure of the allocator is adjusted slightly with
            a second-tier malloc to make swapping around the allocators
            easy when we "migrate" the lists from the source to the destination.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-4-git-send-email-jsnow@redhat.com

  commit 455e861cc625891baacf74e66c31a914883b80ca
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      libqos/ahci: Fix sector set method

      || probably does not mean the same thing as |.

      Additionally, allow users to submit a prd_size of 0
      to indicate that they'd like to continue using the default.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-3-git-send-email-jsnow@redhat.com

  commit 008b6e123ff2ee421112768e838b0b44bc7f6c45
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      libqos/ahci: Add halted command helpers

      Sometimes we want a command to halt the VM instead
      of complete successfully, so it'd be nice to let the
      libqos/ahci functions cope with such scenarios.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1430417242-11859-2-git-send-email-jsnow@redhat.com

  commit 62754b157156c2cd26a00ce534aeec9e74619d95
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      glib: remove stale compat functions

      Since we're bumping the version to 2.22+,
      remove the now-stale compat functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431469140-22208-2-git-send-email-jsnow@redhat.com

  commit f40685c62b802c8c3f5c914e8d357dd5c4d4f9cc
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri May 22 14:13:42 2015 -0400

      configure: require glib 2.22

      This provides g_ptr_array_new_with_free_func, as well as a few
      other functions that we've been hacking around in glib-compat.h.
      Cleaning up the compatibility headers will come later.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431469140-22208-2-git-send-email-jsnow@redhat.com

  commit 0d2ed6039cf86fe3a78671e32b5e3eb17d725762
  Merge: bb2fa17 4120201
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 17:20:09 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block layer core and image format patches

      # gpg: Signature made Fri May 22 16:21:03 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (22 commits)
        MAINTAINERS: Split "Block QAPI, monitor, command line" off core
        MAINTAINERS: Add header files to Block Layer Core section
        tests: add test case for encrypted qcow2 read/write
        qemu-io: prompt for encryption keys when required
        util: allow \n to terminate password input
        util: move read_password method out of qemu-img into osdep/oslib
        qcow2/qcow: protect against uninitialized encryption key
        qemu-iotests: Make debugging python tests easier
        qemu-iotests: qemu-img info on afl VMDK image with a huge capacity
        block: Detect multiplication overflow in bdrv_getlength
        qemu-io: Use getopt() correctly
        qcow2: style fixes in qcow2-cache.c
        qcow2: make qcow2_cache_put() a void function
        qcow2: use a hash to look for entries in the L2 cache
        qcow2: remove qcow2_cache_find_entry_to_replace()
        qcow2: use an LRU algorithm to replace entries from the L2 cache
        qcow2: simplify qcow2_cache_put() and qcow2_cache_entry_mark_dirty()
        qcow2: use one single memory block for the L2/refcount cache tables
        vmdk: Fix overflow if l1_size is 0x20000000
        vmdk: Fix next_cluster_sector for compressed write
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bb2fa17f182ee0b45b53474f76679944fc891f04
  Merge: 8b6db32 9371557
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 16:22:42 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150522' into staging

      TriCore v1.6.1 ISA and missing v1.6 instructions

      # gpg: Signature made Fri May 22 16:02:45 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150522:
        target-tricore: add RR_DIV and RR_DIV_U instructions of the v1.6 ISA
        target-tricore: add FRET instructions of the v1.6 ISA
        target-tricore: add FCALL instructions of the v1.6 ISA
        target-tricore: add SYS_RESTORE instruction of the v1.6 ISA
        target-tricore: add RR_CRC32 instruction of the v1.6.1 ISA
        target-tricore: add SWAPMSK instructions of the v1.6.1 ISA
        target-tricore: add CMPSWP instructions of the v1.6.1 ISA
        target-tricore: Add SRC_MOV_E instruction of the v1.6 ISA
        target-tricore: introduce ISA v1.6.1 feature
        target-tricore: Add ISA v1.3.1 cpu and fix tc1796 to using v1.3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4120201d2fcfc24404fe6eb6b761b66bc35bca16
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed May 20 13:23:46 2015 +0200

      MAINTAINERS: Split "Block QAPI, monitor, command line" off core

      Kevin and Stefan asked me to take care of this part.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c346e0bb9300afe3036560c21baa7fdfb253d9b
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed May 20 12:03:17 2015 +0200

      MAINTAINERS: Add header files to Block Layer Core section

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f7ac119cfac735b24412db8d53b9be13e5ff23b0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:22 2015 +0100

      tests: add test case for encrypted qcow2 read/write

      Add a simple test case for qemu-iotests that covers read/write
      with encrypted qcow2 files.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8caf02127e92939fff39b63a7ff1a5834d320191
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:21 2015 +0100

      qemu-io: prompt for encryption keys when required

      The qemu-io tool does not check if the image is encrypted so
      historically would silently corrupt the sectors by writing
      plain text data into them instead of cipher text. The earlier
      commit turns this mistake into a fatal abort, so check for
      encryption and prompt for key when required.

      This enables us to add unit tests to ensure we don't break
      the ability of qemu-img to convert existing encrypted qcow2
      files into a non-encrypted format.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6a11d5183fb7564a3d32007b46846312fd61a1c5
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:20 2015 +0100

      util: allow \n to terminate password input

      The qemu_read_password() method looks for \r to terminate the
      reading of the a password. This is what will be seen when
      reading the password from a TTY. When scripting though, it is
      useful to be able to send the password via a pipe, in which
      case we must look for \n to terminate password input.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d57e4e482e3997b1382625c84149ad0b69155fc0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:19 2015 +0100

      util: move read_password method out of qemu-img into osdep/oslib

      The qemu-img.c file has a read_password() method impl that is
      used to prompt for passwords on the console, with impls for
      POSIX and Windows. This will be needed by qemu-io.c too, so
      move it into the QEMU osdep/oslib files where it can be shared
      without code duplication

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8336aafae1451d54c81dd2b187b45f7c45d2428e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue May 12 17:09:18 2015 +0100

      qcow2/qcow: protect against uninitialized encryption key

      When a qcow[2] file is opened, if the header reports an
      encryption method, this is used to set the 'crypt_method_header'
      field on the BDRVQcow[2]State struct, and the 'encrypted' flag
      in the BDRVState struct.

      When doing I/O operations, the 'crypt_method' field on the
      BDRVQcow[2]State struct is checked to determine if encryption
      needs to be applied.

      The crypt_method_header value is copied into crypt_method when
      the bdrv_set_key() method is called.

      The QEMU code which opens a block device is expected to always
      do a check

         if (bdrv_is_encrypted(bs)) {
             bdrv_set_key(bs, ....key...);
         }

      If code forgets to do this, then 'crypt_method' is never set
      and so when I/O is performed, QEMU writes plain text data
      into a sector which is expected to contain cipher text, or
      when reading, will return cipher text instead of plain
      text.

      Change the qcow[2] code to consult bs->encrypted when deciding
      whether encryption is required, and assert(s->crypt_method)
      to protect against cases where the caller forgets to set the
      encryption key.

      Also put an assert in the set_key methods to protect against
      the case where the caller sets an encryption key on a block
      device that does not have encryption

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aa4f592a1dd9aea5f5c36f6ff4b22b5bd208162a
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon May 18 09:39:12 2015 +0800

      qemu-iotests: Make debugging python tests easier

      Adding "-d" option. The output goes to "tee" so it appears in your
      console. Also, raise the verbosity of unnitest runner.

      When testing a topic branch, it's possible that a bug introduced by a
      code change makes the python test case hang, with debug output, it is
      much easier to locate the problem.

      This can also be helpful if you want to watch the progress of a python
      test, it offers you a way to sense the speed of each test case method
      you're writing.

      Note: because there is no easy way to get *both* the verbose output and
      the output expected by ./check comparison, the case would always fail
      with an "output mismatch". The sole purpose of using this option is
      giving developers a quick way to debug when things go wrong.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b93bbf4ee9035ae077679482305d5beb38df4d7d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 15 16:36:06 2015 +0800

      qemu-iotests: qemu-img info on afl VMDK image with a huge capacity

      The image is contributed by Richard W.M. Jones.

      Cc: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4a9c9ea0d318bec2f67848c5ceaf4ad5bcb91d09
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri May 15 16:36:05 2015 +0800

      block: Detect multiplication overflow in bdrv_getlength

      Bogus image may have a large total_sectors that will overflow the
      multiplication. For cleanness, fix the return code so the error message
      will be meaningful.

      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b062ad86dcd33ab39be5060b0655d8e13834b167
  Author: Eric Blake <eblake@redhat.com>
  Date:   Tue May 12 09:10:56 2015 -0600

      qemu-io: Use getopt() correctly

      POSIX says getopt() returns -1 on completion.  While Linux happens
      to define EOF as -1, this definition is not required by POSIX, and
      there may be platforms where checking for EOF instead of -1 would
      lead to an infinite loop.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d1b4efe5c4088fd2289e39b95bbdf73b3dcb7432
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:59 2015 +0300

      qcow2: style fixes in qcow2-cache.c

      Fix pointer declaration to make it consistent with the rest of the
      code.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a3f1afb43a09e4577571c044c48f2ba9e6e4ad06
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:58 2015 +0300

      qcow2: make qcow2_cache_put() a void function

      This function never receives an invalid table pointer, so we can make
      it void and remove all the error checking code.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 812e4082cae73e12fd425cace4fd3a715a7c1d32
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:57 2015 +0300

      qcow2: use a hash to look for entries in the L2 cache

      The current cache algorithm traverses the array starting always from
      the beginning, so the average number of comparisons needed to perform
      a lookup is proportional to the size of the array.

      By using a hash of the offset as the starting point, lookups are
      faster and independent from the array size.

      The hash is computed using the cluster number of the table, multiplied
      by 4 to make it perform better when there are collisions.

      In my tests, using a cache with 2048 entries, this reduces the average
      number of comparisons per lookup from 430 to 2.5.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fdfbca82a0874916007ca76323cd35f2af8a2ef3
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:56 2015 +0300

      qcow2: remove qcow2_cache_find_entry_to_replace()

      A cache miss means that the whole array was traversed and the entry
      we were looking for was not found, so there's no need to traverse it
      again in order to select an entry to replace.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2693310eccccf8351678ddd6f3b050163e51dba0
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:55 2015 +0300

      qcow2: use an LRU algorithm to replace entries from the L2 cache

      The current algorithm to evict entries from the cache gives always
      preference to those in the lowest positions. As the size of the cache
      increases, the chances of the later elements of being removed decrease
      exponentially.

      In a scenario with random I/O and lots of cache misses, entries in
      positions 8 and higher are rarely (if ever) evicted. This can be seen
      even with the default cache size, but with larger caches the problem
      becomes more obvious.

      Using an LRU algorithm makes the chances of being removed from the
      cache independent from the position.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit baf07d60f5c5d5d0f0c9e844cde75691f1ceb3d1
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:54 2015 +0300

      qcow2: simplify qcow2_cache_put() and qcow2_cache_entry_mark_dirty()

      Since all tables are now stored together, it is possible to obtain
      the position of a particular table directly from its address, so the
      operation becomes O(1).

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 72e80b89015bab196f0f0e83b12b0eee75fa0574
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon May 11 15:54:53 2015 +0300

      qcow2: use one single memory block for the L2/refcount cache tables

      The qcow2 L2/refcount cache contains one separate table for each cache
      entry. Doing one allocation per table adds unnecessary overhead and it
      also requires us to store the address of each table separately.

      Since the size of the cache is constant during its lifetime, it's
      better to have an array that contains all the tables using one single
      allocation.

      In my tests measuring freshly created caches with sizes 128MB (L2) and
      32MB (refcount) this uses around 10MB of RAM less.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 13c4941cdd8685d28c7e3a09e393a5579b58db46
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue May 5 17:28:13 2015 +0800

      vmdk: Fix overflow if l1_size is 0x20000000

      Richard Jones caught this bug with afl fuzzer.

      In fact, that's the only possible value to overflow (extent->l1_size =
      0x20000000) l1_size:

      l1_size = extent->l1_size * sizeof(long) => 0x80000000;

      g_try_malloc returns NULL because l1_size is interpreted as negative
      during type casting from 'int' to 'gsize', which yields a enormous
      value. Hence, by coincidence, we get a "not too bad" behavior:

      qemu-img: Could not open '/tmp/afl6.img': Could not open
      '/tmp/afl6.img': Cannot allocate memory

      Values larger than 0x20000000 will be refused by the validation in
      vmdk_add_extent.

      Values smaller than 0x20000000 will not overflow l1_size.

      Cc: qemu-stable@nongnu.org
      Reported-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Tested-by: Richard W.M. Jones <rjones@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5e82a31eb967db135fc4e688b134fb0972d62de3
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 6 20:23:46 2015 +0800

      vmdk: Fix next_cluster_sector for compressed write

      This fixes the bug introduced by commit c6ac36e (vmdk: Optimize cluster
      allocation).

      Sometimes, write_len could be larger than cluster size, because it
      contains both data and marker.  We must advance next_cluster_sector in
      this case, otherwise the image gets corrupted.

      Cc: qemu-stable@nongnu.org
      Reported-by: Antoni Villalonga <qemu-list@friki.cat>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aacd5650c68ef2e9e19079ba60cb0df51e15880c
  Author: Christoph Hellwig <hch@lst.de>
  Date:   Thu Apr 30 11:44:17 2015 +0200

      nvme: support NVME_VOLATILE_WRITE_CACHE feature

      The SCSI emulation in the Linux NVMe driver really wants to know
      if a device has a volatile write cache.  Given that qemu has moved
      away from a model where we report the backing store WCE bit to
      one where the WCE bit is supposed to be part of the migratable
      guest-visible state we always return 1 here.

      Signed-off-by: Christoph Hellwig <hch@lst.de>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ecbda7a22576591a84f44de1be0150faf6001f1c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed May 6 13:21:51 2015 +0200

      qcow2: Flush pending discards before allocating cluster

      Before a freed cluster can be reused, pending discards for this cluster
      must be processed.

      The original assumption was that this was not a problem because discards
      are only cached during discard/write zeroes operations, which are
      synchronous so that no concurrent write requests can cause cluster
      allocations.

      However, the discard/write zeroes operation itself can allocate a new L2
      table (and it has to in order to put zero flags there), so make sure we
      can cope with the situation.

      This fixes https://bugs.launchpad.net/bugs/1349972.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 9371557115a734412974f8d4096cbe8a62ca2731
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon May 11 14:59:55 2015 +0200

      target-tricore: add RR_DIV and RR_DIV_U instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0e045f43c45f675711c3f6836118dc7eabcc2411
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 22:46:50 2015 +0200

      target-tricore: add FRET instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 9e14a7b24f4cff93da664fdcfecad41fbd229e2b
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 22:38:16 2015 +0200

      target-tricore: add FCALL instructions of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit bc3551c43308dd77bc1cc9a4e39962b2afd4dffc
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 21:25:42 2015 +0200

      target-tricore: add SYS_RESTORE instruction of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e5c96c82bc529674b61eacd221734abc2674e264
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu May 7 19:55:37 2015 +0200

      target-tricore: add RR_CRC32 instruction of the v1.6.1 ISA

      This instruction was introduced by the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ddd8cebe3106bdfb2681d8d283296199fd6c7417
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:57:10 2015 +0200

      target-tricore: add SWAPMSK instructions of the v1.6.1 ISA

      Those instruction were introduced in the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 62872ebc38d700ea30b0cd861e40703dccdcae2a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:47:39 2015 +0200

      target-tricore: add CMPSWP instructions of the v1.6.1 ISA

      Those instruction were introduced in the new Aurix platform.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fcecf12684e1169653df72ed307ec2a82ca69b18
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:22:45 2015 +0200

      target-tricore: Add SRC_MOV_E instruction of the v1.6 ISA

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 6d2afc8a5edc042e4e7c2ceb49f7cabe02aae793
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed May 6 20:18:41 2015 +0200

      target-tricore: introduce ISA v1.6.1 feature

      The aurix platform contains of several different cpu models and uses
      the 1.6.1 ISA. This patch changes the generic aurix model to the more
      specific tc27x cpu model and sets specific features.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fd5ecf31d4c48651de97c1aaf8771762753de9a7
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Mar 22 12:49:12 2015 +0000

      target-tricore: Add ISA v1.3.1 cpu and fix tc1796 to using v1.3

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 8b6db32a4ec47d1171ccfa21d557096b99f4eef0
  Merge: f5790c3 a53f1a9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 13:25:40 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri May 22 10:00:53 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (38 commits)
        block: get_block_status: use "else" when testing the opposite condition
        qemu-iotests: Test unaligned sub-block zero write
        block: Fix NULL deference for unaligned write if qiov is NULL
        Revert "block: Fix unaligned zero write"
        block: align bounce buffers to page
        block: minimal bounce buffer alignment
        block: return EPERM on writes or discards to read-only devices
        configure: Add workaround for ccache and clang
        configure: silence glib unknown attribute __alloc_size__
        configure: factor out supported flag check
        configure: handle clang -nopie argument warning
        block/parallels: improve image writing performance further
        block/parallels: optimize linear image expansion
        block/parallels: add prealloc-mode and prealloc-size open paramemets
        block/parallels: delay writing to BAT till bdrv_co_flush_to_os
        block/parallels: create bat_entry_off helper
        block/parallels: improve image reading performance
        iotests, parallels: check for incorrectly closed image in tests
        block/parallels: implement incorrect close detection
        block/parallels: implement parallels_check method of block driver
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f5790c3bc81702c98c7ddadedb274758cff8cbe7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 12:30:13 2015 +0100

      Revert "target-alpha: Add vector implementation for CMPBGE"

      This reverts commit 32ad48abd74a997220b841e4e913edeb267aa362.

      Unfortunately the SSE2 code here fails to compile on some versions
      of gcc:
       target-alpha/int_helper.c:77:24: error: invalid operands to binary >=
       (have '__vector(16) unsigned char' and '__vector(16) unsigned char')

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 27e1259a69c49ee2dd53385f4ca4ca14b822191d
  Merge: 9e549d3 32ad48a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 22 10:06:33 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-axp-20150521' into staging

      Rewrite fp exceptions

      # gpg: Signature made Thu May 21 18:35:52 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-axp-20150521:
        target-alpha: Add vector implementation for CMPBGE
        target-alpha: Rewrite helper_zapnot
        target-alpha: Raise IOV from CVTQL
        target-alpha: Suppress underflow from CVTTQ if DNZ
        target-alpha: Raise EXC_M_INV properly for fp inputs
        target-alpha: Disallow literal operand to 1C.30 to 1C.37
        target-alpha: Implement WH64EN
        target-alpha: Fix integer overflow checking insns
        target-alpha: Fix cvttq vs inf
        target-alpha: Fix cvttq vs large integers
        target-alpha: Raise IOV from CVTTQ
        target-alpha: Set EXC_M_SWC for exceptions from /S insns
        target-alpha: Set fpcr_exc_status even for disabled exceptions
        target-alpha: Tidy FPCR representation
        target-alpha: Set PC correctly for floating-point exceptions
        target-alpha: Forget installed round mode after MT_FPCR
        target-alpha: Rename floating-point subroutines
        target-alpha: Move VAX helpers to a new file

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a53f1a95f9605f300fbafbc8b60b8a8c67e9c4b4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 14 12:35:02 2015 +0200

      block: get_block_status: use "else" when testing the opposite condition

      A bit of Boolean algebra (and common sense) tells us that the
      second "if" here is looking for blocks that are not allocated.
      This is the opposite of the "if" that sets BDRV_BLOCK_ALLOCATED,
      and thus it can use an "else".

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1431599702-10431-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ab53c44718305d3fde3d9d2251889f1cab694be2
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:12:01 2015 +0000

      qemu-iotests: Test unaligned sub-block zero write

      Test zero write in byte range 512~1024 for 4k alignment.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431522721-3266-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9eeb6dd1b27bd57eb4e3869290e87feac8e8b226
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:12:00 2015 +0000

      block: Fix NULL deference for unaligned write if qiov is NULL

      For zero write, callers pass in NULL qiov (qemu-io "write -z" or
      scsi-disk "write same").

      Commit fc3959e466 fixed bdrv_co_write_zeroes which is the common case
      for this bug, but it still exists in bdrv_aio_write_zeroes. A simpler
      fix would be in bdrv_co_do_pwritev which is the NULL dereference point
      and covers both cases.

      So don't access it in bdrv_co_do_pwritev in this case, use three aligned
      writes.

      [Initialize ret to 0 in bdrv_co_do_zero_pwritev() to avoid uninitialized
      variable warning with gcc 4.9.2.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1431522721-3266-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d01c07f2221ca39ab2dd9e55932d99db98103b30
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed May 13 13:11:59 2015 +0000

      Revert "block: Fix unaligned zero write"

      This reverts commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05.

      The core write code already handles the case, so remove this
      duplication.

      Because commit 61007b316 moved the touched code from block.c to
      block/io.c, the change is manually reverted.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431522721-3266-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 459b4e66129d091a11e9886ecc15a8bf9f7f3d92
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue May 12 17:30:56 2015 +0300

      block: align bounce buffers to page

      The following sequence
          int fd = open(argv[1], O_RDWR | O_CREAT | O_DIRECT, 0644);
          for (i = 0; i < 100000; i++)
                  write(fd, buf, 4096);
      performs 5% better if buf is aligned to 4096 bytes.

      The difference is quite reliable.

      On the other hand we do not want at the moment to enforce bounce
      buffering if guest request is aligned to 512 bytes.

      The patch changes default bounce buffer optimal alignment to
      MAX(page size, 4k). 4k is chosen as maximal known sector size on real
      HDD.

      The justification of the performance improve is quite interesting.
      From the kernel point of view each request to the disk was split
      by two. This could be seen by blktrace like this:
        9,0   11  1     0.000000000 11151  Q  WS 312737792 + 1023 [qemu-img]
        9,0   11  2     0.000007938 11151  Q  WS 312738815 + 8 [qemu-img]
        9,0   11  3     0.000030735 11151  Q  WS 312738823 + 1016 [qemu-img]
        9,0   11  4     0.000032482 11151  Q  WS 312739839 + 8 [qemu-img]
        9,0   11  5     0.000041379 11151  Q  WS 312739847 + 1016 [qemu-img]
        9,0   11  6     0.000042818 11151  Q  WS 312740863 + 8 [qemu-img]
        9,0   11  7     0.000051236 11151  Q  WS 312740871 + 1017 [qemu-img]
        9,0    5  1     0.169071519 11151  Q  WS 312741888 + 1023 [qemu-img]
      After the patch the pattern becomes normal:
        9,0    6  1     0.000000000 12422  Q  WS 314834944 + 1024 [qemu-img]
        9,0    6  2     0.000038527 12422  Q  WS 314835968 + 1024 [qemu-img]
        9,0    6  3     0.000072849 12422  Q  WS 314836992 + 1024 [qemu-img]
        9,0    6  4     0.000106276 12422  Q  WS 314838016 + 1024 [qemu-img]
      and the amount of requests sent to disk (could be calculated counting
      number of lines in the output of blktrace) is reduced about 2 times.

      Both qemu-img and qemu-io are affected while qemu-kvm is not. The guest
      does his job well and real requests comes properly aligned (to page).

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431441056-26198-3-git-send-email-den@openvz.org
      CC: Paolo Bonzini <pbonzini@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4196d2f0308cb1ae13ed450424ab7dfe154acda9
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue May 12 17:30:55 2015 +0300

      block: minimal bounce buffer alignment

      The patch introduces new concept: minimal memory alignment for bounce
      buffers. Original so called "optimal" value is actually minimal required
      value for aligment. It should be used for validation that the IOVec
      is properly aligned and bounce buffer is not required.

      Though, from the performance point of view, it would be better if
      bounce buffer or IOVec allocated by QEMU will be aligned stricter.

      The patch does not change any alignment value yet.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1431441056-26198-2-git-send-email-den@openvz.org
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit eaf5fe2dd4ec001d645ff3b343f466457badaa64
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 7 17:45:48 2015 +0200

      block: return EPERM on writes or discards to read-only devices

      This is the behavior in the operating system, for example Linux's
      blkdev_write_iter has the following:

              if (bdev_read_only(I_BDEV(bd_inode)))
                      return -EPERM;

      This does not apply to opening a device for read/write, when the
      device only supports read-only operation.  In this case any of
      EACCES, EPERM or EROFS is acceptable depending on why writing is
      not possible.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1431013548-22492-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fd0e60530f10078f488fa3e9591cc7db5732989c
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:39 2015 -0400

      configure: Add workaround for ccache and clang

      Test if ccache is interfering with semantic analysis of macros,
      disable its habit of trying to compile already pre-processed
      versions of code if so. ccache attempts to save time by compiling
      pre-processed versions of code, but this disturbs clang's static
      analysis enough to produce false positives.

      ccache allows us to disable this feature, opting instead to
      compile the original version instead of its preprocessed version.
      This makes ccache much slower for cache misses, but at least it
      becomes usable with QEMU/clang.

      This workaround only activates for users using ccache AND clang,
      and only if their configuration is observed to be producing warnings.
      You may need to clear your ccache for builds started without -Werror,
      as those may continue to produce warnings from the cache.

      Thanks to Peter Eisentraut for his writeup on the issue:
      http://peter.eisentraut.org/blog/2014/12/01/ccache-and-clang-part-3/

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bbbf2e04e5ea347d877c7fa8ee02e4bb647a48fc
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:38 2015 -0400

      configure: silence glib unknown attribute __alloc_size__

      The glib headers use GCC attributes.  Unfortunately the __GNUC__ and
      __GNUC_MINOR__ version macros are also defined by clang, but clang
      doesn't support the same attributes as GCC.

      clang 3.5.0 does not support the __alloc_size__ attribute:

        https://github.com/llvm-mirror/clang/commit/c047507a9a79e89fc8339e074fa72822a7e7ea73

      The following warning is produced:

        gstrfuncs.h:257:44: warning: unknown attribute '__alloc_size__' ignored [-Wunknown-attributes]
              G_GNUC_MALLOC G_GNUC_ALLOC_SIZE(2);
                gmacros.h:67:45: note: expanded from macro 'G_GNUC_ALLOC_SIZE'
                      #define G_GNUC_ALLOC_SIZE(x) __attribute__((__alloc_size__(x)))

      This patch checks whether glib headers cause warnings and disables
      -Wunknown-attributes if it is able to.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 93b25869228a3c0c632a6aa66624cc4e549ba14a
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 25 18:57:37 2015 -0400

      configure: factor out supported flag check

      Factor out the function that checks if a compiler
      flag is supported or not.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4a7b344df40b1f4b2e732ddb0d68079ce658d89
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Mar 25 18:57:36 2015 -0400

      configure: handle clang -nopie argument warning

      gcc 4.9.2 treats -nopie as an error:

        cc: error: unrecognized command line option ‘-nopie’

      clang 3.5.0 treats -nopie as a warning:

        clang: warning: argument unused during compilation: '-nopie'

      The causes ./configure to fail with clang:

        ERROR: configure test passed without -Werror but failed with -Werror.

      Make the -nopie test use -Werror so that compile_prog works for both gcc
      and clang.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427324259-1481-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ddd2ef2ce8d693b6e2635a0c20f65744641ff8df
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:47:00 2015 +0300

      block/parallels: improve image writing performance further

      Try to perform IO for the biggest continuous block possible.
      All blocks abscent in the image are accounted in the same type
      and preallocation is made for all of them at once.

      The performance for sequential write is increased from 200 Mb/sec to
      235 Mb/sec on my SSD HDD.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-28-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 19f5dc15912dfb6af06c97e4975023e545e85c72
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:59 2015 +0300

      block/parallels: optimize linear image expansion

      Plain image expansion spends a lot of time to update image file size.
      This seriously affects the performance. The following simple test
        qemu_img create -f parallels -o cluster_size=64k ./1.hds 64G
        qemu_io -n -c "write -P 0x11 0 1024M" ./1.hds
      could be improved if the format driver will pre-allocate some space
      in the image file with a reasonable chunk.

      This patch preallocates 128 Mb using bdrv_write_zeroes, which should
      normally use fallocate() call inside. Fallback to older truncate()
      could be used as a fallback using image open options thanks to the
      previous patch.

      The benefit is around 15%.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Karan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-27-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d61790112fa861fbbbb02b53f9c3beb9ca7f8419
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:58 2015 +0300

      block/parallels: add prealloc-mode and prealloc-size open paramemets

      This is preparational commit for tweaks in Parallels image expansion.
      The idea is that enlarge via truncate by one data block is slow. It
      would be much better to use fallocate via bdrv_write_zeroes and
      expand by some significant amount at once.

      Original idea with sequential file writing to the end of the file without
      fallocate/truncate would be slower than this approach if the image is
      expanded with several operations:
      - each image expanding means file metadata update, i.e. filesystem
        journal write. Truncate/write to newly truncated space update file
        metadata twice thus truncate removal helps. With fallocate call
        inside bdrv_write_zeroes file metadata is updated only once and
        this should happen infrequently thus this approach is the best one
        for the image expansion
      - tail writes are ordered, i.e. the guest IO queue could not be sent
        immediately to the host introducing additional IO delays

      This patch just adds proper parameters into BDRVParallelsState and
      performs options parsing in parallels_open.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-26-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0d31c7c200b3dca2aeeaa6f74ff3fd539aad803a
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:57 2015 +0300

      block/parallels: delay writing to BAT till bdrv_co_flush_to_os

      The idea is that we do not need to immediately sync BAT to the image as
      from the guest point of view there is a possibility that IO is lost
      even in the physical controller until flush command was finished.
      bdrv_co_flush_to_os is exactly the right place for this purpose.

      Technically the patch uses loaded BAT data as a cache and performs
      actual on-disk metadata updates in parallels_co_flush_to_os callback.

      This patch speed ups
        qemu-img create -f parallels -o cluster_size=64k ./1.hds 64G
        qemu-io -f parallels -c "write -P 0x11 0 1024k" 1.hds
      writing from 50-60 Mb/sec to 80-90 Mb/sec on rotational media and
      from 160 Mb/sec to 190 Mb/sec on SSD disk.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-25-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2d68e22e94e8bc5a0d32a38b53c592c320db8261
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:56 2015 +0300

      block/parallels: create bat_entry_off helper

      calculate offset of the BAT entry in the image file.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-24-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6953d920784466dfaea77f7cfd23df2ad8b772a0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:55 2015 +0300

      block/parallels: improve image reading performance

      Try to perform IO for the biggest continuous block possible.
      The performance for sequential read is increased from 220 Mb/sec to
      360 Mb/sec for continous image on my SSD HDD.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-23-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6be831e99f89d72a8c4a114347d5512c326af29
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:54 2015 +0300

      iotests, parallels: check for incorrectly closed image in tests

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-22-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6dd6b9f1440c37811ad963b49a48bf80a8bde377
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:53 2015 +0300

      block/parallels: implement incorrect close detection

      The software driver must set inuse field in Parallels header to
      0x746F6E59 when the image is opened in read-write mode. The presence of
      this magic in the header on open forces image consistency check.

      There is an unfortunate trick here. We can not check for inuse in
      parallels_check as this will happen too late. It is possible to do
      that for simple check, but during the fix this would always report
      an error as the image was opened in BDRV_O_RDWR mode. Thus we save
      the flag in BDRVParallelsState for this.

      On the other hand, nothing should be done to clear inuse in
      parallels_check. Generic close will do the job right.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-21-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 49ad6467313d17486af9029413debb709dc971a8
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:52 2015 +0300

      block/parallels: implement parallels_check method of block driver

      The check is very simple at the moment. It calculates necessary stats
      and fix only the following errors:
      - space leak at the end of the image. This would happens due to
        preallocation
      - clusters outside the image are zeroed. Nothing else could be done here

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-20-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 23d6bd3bd1225e8c8ade6ed829eabcf90ddfa6f7
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:51 2015 +0300

      block/parallels: move parallels_open/probe to the very end of the file

      This will help to avoid forward declarations for upcoming parallels_check

      Some very obvious formatting fixes were made to the moved code to make
      checkpatch happy.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-19-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9eae9cca95e76afc2f2288a665e08a64953f2820
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:50 2015 +0300

      block/parallels: read parallels image header and BAT into single buffer

      This metadata cache would allow to properly batch BAT updates to disk
      in next patches. These updates will be properly aligned to avoid
      read-modify-write transactions on block level.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-18-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd97cdc064f24484a2ebc141a4ec6bba35f56007
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:49 2015 +0300

      block/parallels: keep BAT bitmap data in little endian in memory

      This will allow to use this data as buffer to BAT update directly
      without any intermediate buffers.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-17-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 555cc9d9fc5c71be6bd3f288eaf1e5628732088f
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:48 2015 +0300

      block/parallels: create bat2sect helper

      deduplicate copy/paste arithmetcs

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-16-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 369f7de9d57e4dd2f312255fc12271d5749c0a4e
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:47 2015 +0300

      block/parallels: rename catalog_ names to bat_

      BAT means 'block allocation table'. Thus this name is clean and shorter
      on writing.

      Some obvious formatting fixes in the old code were made to make checkpatch
      happy.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-15-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit cc5690f20fcc075940a213380b362ae2054c03ba
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:46 2015 +0300

      parallels: change copyright information in the image header

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-14-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca9c4e0675f9cb98138e1069605114f45746d985
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:45 2015 +0300

      iotests, parallels: test for newly created parallels image via qemu-img

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-13-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 74cf6c5026fef6e327f09786445f626df02cbdf0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:44 2015 +0300

      block/parallels: support parallels image creation

      Do not even care to create WithoutFreeSpace image, it is obsolete.
      Always create WithouFreSpacExt one.

      The code also does not spend a lot of efforts to fill cylinders and
      heads fields, they are not used actually in a real life neither in
      QEMU nor in Parallels products.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-12-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 50ffd8fd3cfceede87cec1f7f9a04cd7b9147271
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:43 2015 +0300

      iotests, parallels: test for write into Parallels image

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-11-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5a41e1fa95f379e236883f38dacda292f6c48e6f
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:42 2015 +0300

      block/parallels: _co_writev callback for Parallels format

      Support write on Parallels images. The code is almost the same as one
      in the previous patch implemented scatter-gather IO for read.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-10-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d0e61ce56d1520cade573eb344fdb136993d2279
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:41 2015 +0300

      block/parallels: mark parallels format driver as zero inited

      From the guest point of view unallocated blocks are zeroed.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-9-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 912f31281a683a24b552a8cc6c293ab389b62013
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:40 2015 +0300

      block/parallels: replace magic constants 4, 64 with proper sizeofs

      simple purification..

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-8-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 481fb9cf18925eab19e4af8a44bd86b82eb897ad
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:39 2015 +0300

      block/parallels: provide _co_readv routine for parallels format driver

      Main approach is taken from qcow2_co_readv.

      The patch drops coroutine lock for the duration of IO operation and
      peforms normal scatter-gather IO using standard QEMU backend.

      The patch also adds comment about locking considerations in the driver.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Message-id: 1430207220-24458-7-git-send-email-den@openvz.org
      CC: Roman Kagan <rkagan@parallels.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd3bed16ff229496b30cc77224b0c0ae645c4dae
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:38 2015 +0300

      block/parallels: add get_block_status

      Implement VFS method for get_block_status to Parallels format driver.

      qemu_co_mutex_lock is not necessary yet (the driver is read-only) but
      will be necessary very soon when write will be supported.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1430207220-24458-6-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9de9da17d8304576e8402697bcee72c88ce499b8
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:37 2015 +0300

      block/parallels: read up to cluster end in one go

      Teach parallels_read() to do reads in coarser granularity than just a
      single sector: if requested, read up to the cluster end in one go.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-5-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2944256997dd8b080f8b0cc062e4b663cb2ec09c
  Author: Roman Kagan <rkagan@parallels.com>
  Date:   Tue Apr 28 10:46:36 2015 +0300

      block/parallels: switch to bdrv_read

      Switch the .bdrv_read method implementation from using bdrv_pread() to
      bdrv_read() on the underlying file, since the latter is subject to i/o
      throttling while the former is not.

      Besides, since bdrv_read() operates in sectors rather than bytes, adjust
      the helper functions to do so too.

      Signed-off-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1430207220-24458-4-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0789890467d30e2ab10d84b5398bdc903db8cb91
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:35 2015 +0300

      block/parallels: rename parallels_header to ParallelsHeader

      this follows QEMU coding convention

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-3-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d134cf73b10e9d0283e1d2531299c8f9ab13b5eb
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 28 10:46:34 2015 +0300

      iotests, parallels: quote TEST_IMG in 076 test to be path-safe

      suggested by Jeff Cody

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1430207220-24458-2-git-send-email-den@openvz.org
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 32ad48abd74a997220b841e4e913edeb267aa362
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Aug 18 10:19:06 2014 -0700

      target-alpha: Add vector implementation for CMPBGE

      While conditionalized on SSE2, it's a "portable" gcc generic vector
      implementation, which could be enabled on other hosts.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8d8d324e3424bf891d41e9c7758dcc09cf3c38b9
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 15 12:07:05 2014 -0700

      target-alpha: Rewrite helper_zapnot

      This form produces significantly smaller code on x86_64.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9e549d36e989b14423279fb991b71728a2a4ae7c
  Merge: eba05e9 0ef705a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 21 09:07:19 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150520-1' into staging

      vnc: misc fixes.

      # gpg: Signature made Wed May 20 09:32:45 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150520-1:
        qemu-sockets: Report explicit error if unlink fails
        vnc: Tweak error when init fails
        vnc: Don't assert if opening unix socket fails
        ui: remove check for failure of qemu_acl_init()
        Strip brackets from vnc host

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ef705a2653f09c15e44a644a98b6febc761431e
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:19 2015 -0400

      qemu-sockets: Report explicit error if unlink fails

      Consider this case:

      $ ls -ld ~/root-owned/
      drwx--x--x. 2 root root 4096 Apr 29 12:55 /home/crobinso/root-owned/
      $ ls -l ~/root-owned/foo.sock
      -rwxrwxrwx. 1 crobinso crobinso 0 Apr 29 12:55 /home/crobinso/root-owned/foo.sock

      $ qemu-system-x86_64 -vnc unix:~/root-owned/foo.sock
      qemu-system-x86_64: -vnc unix:/home/crobinso/root-owned/foo.sock: Failed to start VNC server: Failed to bind socket to /home/crobinso/root-owned/foo.sock: Address already in use

      ...which is techinically true, but the real error is that we failed to
      unlink. So report it.

      This may seem pathological but it's a real possibility via libvirt.

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bc119048d7377ec8335ecde5946df629a1b72b46
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:18 2015 -0400

      vnc: Tweak error when init fails

      Before:
      qemu-system-x86_64: -display vnc=unix:/root/foo.sock: Failed to start VNC server on `(null)': Failed to bind socket to /root/foo.sock: Permission denied

      After:
      qemu-system-x86_64: -display vnc=unix:/root/foo.sock: Failed to start VNC server: Failed to bind socket to /root/foo.sock: Permission denied

      Rather than tweak the string possibly show unix: value as well,
      just drop the explicit display reporting. We already get the cli
      string in the error message, that should be sufficient.

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3d00ac1a2ee0294fc3d460e6013a5cdd9c73ea6c
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Tue May 5 11:07:17 2015 -0400

      vnc: Don't assert if opening unix socket fails

      Reproducer:

      $ qemu-system-x86_64 -display vnc=unix:/root/i-cant-access-you.sock
      qemu-system-x86_64: iohandler.c:60: qemu_set_fd_handler2: Assertion `fd >= 0' failed.
      Aborted (core dumped)

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2b2c1a38eeaba5d8bfe92281e9e680361e09ee3b
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Fri May 1 11:44:46 2015 +0100

      ui: remove check for failure of qemu_acl_init()

      The qemu_acl_init() function has long since stopped being able
      to return NULL, since g_malloc will abort on OOM. As such the
      checks for NULL were unreachable code.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 274c3b52e10466a4771d591f6298ef61e8354ce0
  Author: Ján Tomko <jtomko@redhat.com>
  Date:   Mon Apr 27 17:03:14 2015 +0200

      Strip brackets from vnc host

      Commit v2.2.0-1530-ge556032 vnc: switch to inet_listen_opts
      bypassed the use of inet_parse in inet_listen, making literal
      IPv6 addresses enclosed in brackets fail:

      qemu-kvm: -vnc [::1]:0: Failed to start VNC server on `(null)': address
      resolution failed for [::1]:5900: Name or service not known

      Strip the brackets to make it work again.

      Signed-off-by: Ján Tomko <jtomko@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit eba05e922e8e7f307bc5d4104a78797e55124e97
  Merge: fdbe454 a48da7b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 14:10:33 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-serial-20150519-1' into staging

      serial: fix multi-pci card error cleanup.

      # gpg: Signature made Tue May 19 11:47:29 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-serial-20150519-1:
        serial: fix multi-pci card error cleanup.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a48da7b5bc1f0c98e7a124337140efd47049066c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed May 6 12:58:19 2015 +0200

      serial: fix multi-pci card error cleanup.

      Put the number of serial ports into a local variable in
      multi_serial_pci_realize, then increment the port count
      (pci->ports) as we initialize the serial port cores.

      Now pci->ports always holds the number of successfully
      initialized ports and we can use multi_serial_pci_exit
      to properly cleanup the already initialized bits in case
      of a init failure.

      https://bugzilla.redhat.com/show_bug.cgi?id=970551

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fdbe454a242105fcfe48b9c44b5499b80ff84160
  Merge: faa261a 176c324
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 11:47:03 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150519-1' into staging

      hw/display: qomify vga cards

      # gpg: Signature made Tue May 19 11:23:09 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20150519-1:
        vga-pci: QOMify
        qxl: QOMify
        cirrus_vga: QOMify

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 176c324febd76d6f164347583f5af35b3cb4e5fb
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:08 2015 +0800

      vga-pci: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c69f6c7dcf6164ee0ee3b00bec27dfdec4e8b661
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:10 2015 +0800

      qxl: QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d338bae33a76d02678ea706622dfcc26b8b8325c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue May 12 17:27:09 2015 +0800

      cirrus_vga: QOMify

      QOMify pci-cirrus-vga like isa-cirrus-vga device.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit faa261a7fb254866bdd5b6a25ad94677945f21b4
  Merge: 62bf3df b4c6a11
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 10:25:59 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150519' into staging

      cocoa queue:
       * fix various issues with full screen in the OSX UI
       * set an icon for our binary file
       * add entries to the View menu for QEMU consoles
       * fix various warnings that are produced when building on 10.10
         (largely deprecated interfaces)

      # gpg: Signature made Tue May 19 09:17:23 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-cocoa-20150519:
        ui/cocoa: Add console items to the View menu
        ui/cocoa: Avoid deprecated NSOKButton/NSCancelButton constants
        ui/cocoa: Don't use NSWindow useOptimizedDrawing on OSX 10.10 and up
        ui/cocoa: Declare that QemuCocoaAppController implements NSApplicationDelegate
        ui/cocoa: openPanelDidEnd returnCode should be NSInteger, not int
        ui/cocoa: Remove compatibility ifdefs for OSX 10.4
        ui/cocoa: Drop tests for CGImageCreateWithImageInRect support
        Makefile.target: set icon for binary file on Mac OS X
        ui/cocoa: Make -full-screen option work on Mac OS X
        ui/cocoa: Fix several full screen issues on Mac OS X

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b4c6a112dcfa1d24b905e6cccc763e02000937f1
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Add console items to the View menu

      Add any console that is available to the current emulator as a
      menu item under the View menu.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: Adjusted to apply after zoom-to-fit menu item was added;
       create the View menu at the same time as all the others, and only
       add the dynamically-determined items to it later]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8617989eae7398e9e782a73857fc53a548692b31
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Avoid deprecated NSOKButton/NSCancelButton constants

      In OSX 10.10, the NSOKButton and NSCancelButton constants are deprecated
      and provoke compiler warnings. Avoid them by using the
      NSFileHandlingPanelCancelButton and NSFileHandlingPanelOKButton constants
      instead. These are the documented correct constants for the 10.6-and-up
      beginSheetModalForWindow API we use. We also use the same method for
      the pre-10.6 compatibility code path, but conveniently the constant
      values are the same and the constant names have been present since 10.0.
      Preferring the constant names that match the non-legacy API makes more
      sense anyway.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-7-git-send-email-peter.maydell@linaro.org

  commit 81801ae21333d81a8e7887bc6b11c601b6ecbee6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Don't use NSWindow useOptimizedDrawing on OSX 10.10 and up

      Starting in OSX 10.10, NSWindow useOptimizedDrawing is deprecated, so
      don't use it there.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-6-git-send-email-peter.maydell@linaro.org

  commit 2a4c8c53dabf564142d5329b9ff8a82468324fd6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: Declare that QemuCocoaAppController implements NSApplicationDelegate

      Our class QemuCocoaAppController implements the NSApplicationDelegate
      interface, and we pass an object of this class to [NSApp setDelegate].
      However, we weren't declaring in the class definition that we implemented
      this interface; in OSX 10.10 this provokes the following (slighly
      misleading) warning:
      ui/cocoa.m:1031:24: warning: sending 'QemuCocoaAppController *' to parameter of
            incompatible type 'id<NSFileManagerDelegate>'
          [NSApp setDelegate:appController];
                             ^~~~~~~~~~~~~
      /System/Library/Frameworks/Foundation.framework/Headers/NSFileManager.h:109:47:
      note: passing argument to parameter 'delegate' here
      @property (assign) id <NSFileManagerDelegate> delegate NS_AVAILABLE(10_5,
      2_0);
                                                    ^

      Annoyingly, this interface wasn't formally defined until OSX 10.6, so we
      have to surround the relevant part of the @interface line with an ifdef.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-5-git-send-email-peter.maydell@linaro.org

  commit de1aadee289722478c19f211f0fa3a38e7e66b6f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:18 2015 +0100

      ui/cocoa: openPanelDidEnd returnCode should be NSInteger, not int

      The type for openPanelDidEnd's returnCode argument should be NSInteger,
      not int. This only matters for the OSX 10.5 code path where we pass
      the method directly to an OSX function to call.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-4-git-send-email-peter.maydell@linaro.org

  commit 89424ff32f5c106f90627c7abe019c81c716fd13
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Remove compatibility ifdefs for OSX 10.4

      Remove compatibility ifdefs that work around OSX 10.4 not providing
      various typedefs and functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-3-git-send-email-peter.maydell@linaro.org

  commit b63901d84cc22a06f82900620fdbe01ff16511ec
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Drop tests for CGImageCreateWithImageInRect support

      The code that tries to test at both compiletime and runtime
      for whether CGImageCreateWithImageInRect is supported provokes
      a compile warning on OSX 10.3:

      ui/cocoa.m:378:13: warning: comparison of function 'CGImageCreateWithImageInRect'
            equal to a null pointer is always false[-Wtautological-pointer-compare]
              if (CGImageCreateWithImageInRect == NULL) { // test if "CGImageCreateWithImageInRect" is
      supported on host at runtime
                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~    ~~~~

      The simplest way to deal with this is just to drop this code,
      since we don't in practice support OSX 10.4 anyway. (10.5 was
      released in 2007 and is the last PPC version, so is the earliest
      we really need to continue to support at all.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1431296361-16981-2-git-send-email-peter.maydell@linaro.org

  commit 4e34017c21485e5606beda7e6218c36d3568b363
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      Makefile.target: set icon for binary file on Mac OS X

      Implements setting the icon for the binary file in Mac OS X.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: tweaked makefile to use $@ and quiet-command]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43227af88a36faed50cedb0c7cef71a49c0be9d2
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Make -full-screen option work on Mac OS X

      This patch makes the -full-screen option actually instruct QEMU to
      enter fullscreen at startup, on Mac OS X.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5d1b2eef58632974494b4b94f8970846aa0bffb9
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Tue May 19 09:11:17 2015 +0100

      ui/cocoa: Fix several full screen issues on Mac OS X

      This patch makes several changes:
      - Minimizes distorted full screen display by respecting aspect
      ratios.
      - Makes full screen mode available on Mac OS 10.7 and higher.
      - Allows user to decide if video should be stretched to fill the
      screen, using a menu item called "Zoom To Fit".
      - Hides the normalWindow so it won't show up in full screen mode.
      - Allows user to exit full screen mode.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      [PMM: minor whitespace tweaks, remove incorrectly duplicated
       use of 'f' menu accelerator key]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57a808b6d7f52a62111f6070933dfca6cd88a0fd
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:42:55 2014 -0700

      target-alpha: Raise IOV from CVTQL

      Even if an exception isn't taken, the status flags need updating
      and the result should be written to the destination.  Move the body
      of cvtql out of line, since we now always need a call.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4ed069ab5334a495b49d0704795524fa34e8dbfc
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:14:09 2014 -0700

      target-alpha: Suppress underflow from CVTTQ if DNZ

      I.e. respect flush_inputs_to_zero.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit b99e80694cc635aa6ed5a3716e89645a8afa261c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Jul 8 10:11:06 2014 -0700

      target-alpha: Raise EXC_M_INV properly for fp inputs

      Ignore DNZ if software completion isn't used.  Raise INV for
      denormals in system mode so the OS completion handler sees them.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ed0851380c8ed181ddd6ed3542b14fcb0bca6700
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jul 7 06:18:20 2014 -0700

      target-alpha: Disallow literal operand to 1C.30 to 1C.37

      Before 64f45e49 we used to have literal checks for 4 of these 8 opcodes.
      Confirmed that real hardware doesn't allow them.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 2517def6f82bec9eba9333a37f85a6f368ba52ee
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 21:04:26 2014 -0700

      target-alpha: Implement WH64EN

      Backward compatible cache insn introduced for EV7.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4d1628e832dfc6ec02b0d196f6cc250aaa7bf3b3
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 13:18:26 2014 -0700

      target-alpha: Fix integer overflow checking insns

      We need to write the result to the destination register before
      raising any exception.  Thus inline the code for each insn, and
      check for any exception after we're done.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7b4dde839e86ca6c254d4e3cd28260e9d668afb5
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 12:37:59 2014 -0700

      target-alpha: Fix cvttq vs inf

      We should raise INV for infinities as well, not OVR+INE.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7f2e40020cfc827f7e59670f8c400b0b9a704481
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Thu Jul 3 12:36:34 2014 -0700

      target-alpha: Fix cvttq vs large integers

      The range +- 2**63 - 2**64 was returning the wrong truncated
      result.  We also incorrectly signaled overflow for -2**63.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c24a8a0b6dad5a33d84f5fb846edb28c43312c71
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 12:57:03 2014 -0700

      target-alpha: Raise IOV from CVTTQ

      Floating-point overflow is a different bit from integer overflow.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit f6b6b7b8a775f97edab43eb672d5991f534c2e61
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Mon Jun 30 09:53:46 2014 -0700

      target-alpha: Set EXC_M_SWC for exceptions from /S insns

      Previously forgotten, the kernel needs the software completion bit to
      know that it needs to emulate software completion qualified insns.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 471d4930470aee38dffe6fc4890ede3d8eaf23c4
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 11:08:28 2014 -0700

      target-alpha: Set fpcr_exc_status even for disabled exceptions

      The qualifiers can suppress the raising of exceptions, but real
      hardware still records that the exceptions occurred.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit f3d3aad4a920a4436a9f5397d7a2963aefe141a9
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 12:17:07 2014 -1000

      target-alpha: Tidy FPCR representation

      Store the fpcr as the hardware represents it.  Convert the softfpu
      representation of exceptions into the fpcr representation.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ba9c5de5f2d33d468a07a8794121472ea031a0b5
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 13:06:19 2014 -0700

      target-alpha: Set PC correctly for floating-point exceptions

      PC should be one past the faulting insn.  Add better commentary
      for the machine-check exception path.

      Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9d5a626b2c3fa98761b35b5e2ac86f7adb231002
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sat Jun 28 10:25:36 2014 -0700

      target-alpha: Forget installed round mode after MT_FPCR

      When we use QUAL_RM_D, we copy fpcr_dyn_round to float_status.
      When we install a new FPCR value, we update fpcr_dyn_round.
      Reset the status of the cache so that we re-copy for the next
      fp insn that requires dynamic rounding.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3da653fa05579579b0ba55a02ffa2aa3d466f01b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 10:54:35 2014 -1000

      target-alpha: Rename floating-point subroutines

      ... to match the instructions, which have no leading "f".

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9354452c39fef1ab2491da5989e6944d8bb2e16a
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Aug 8 10:42:45 2014 -1000

      target-alpha: Move VAX helpers to a new file

      Keep the IEEE and VAX floating point emulation separate.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 62bf3df432d93fa6eb0f355c460d6d784b7cbc1a
  Merge: 385057c 18084b2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 18 20:23:16 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150518-3' into staging

      target-arm:
       * New board model: xlnx-ep108
       * Some more preparation for AArch64 EL2/EL3
       * Fix bugs in access checking for generic counter registers
       * Remove a stray '+' sign

      # gpg: Signature made Mon May 18 20:13:05 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150518-3: (21 commits)
        target-arm: Remove unneeded '+'
        target-arm: Correct accessfn for CNTV_TVAL_EL0
        target-arm: Correct accessfn for CNTP_{CT}VAL_EL0
        target-arm: Add WFx syndrome function
        target-arm: Add EL3 and EL2 TCR checking
        target-arm: Add TTBR regime function and use
        linux-user/arm: Correct TARGET_NR_timerfd to TARGET_NR_timerfd_create
        arm: xlnx-ep108: Add bootloading
        arm: xlnx-ep108: Add external RAM
        arm: Add xlnx-ep108 machine
        arm: xlnx-zynqmp: Add UART support
        char: cadence_uart: Split state struct and type into header
        char: cadence_uart: Clean up variable names
        arm: xlnx-zynqmp: Add GEM support
        net: cadence_gem: Split state struct and type into header
        net: cadence_gem: Clean up variable names
        arm: xlnx-zynqmp: Connect CPU Timers to GIC
        arm: xlnx-zynqmp: Add GIC
        arm: Introduce Xilinx ZynqMP SoC
        target-arm: cpu64: Add support for Cortex-A53
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 18084b2f71b22b3ec3bf4828b8cb83d1d39e8502
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:28 2015 +1000

      target-arm: Remove unneeded '+'

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1431499963-1019-4-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b65c08ee1a05760c1c5a786a6cedf240f924c53e
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:27 2015 +1000

      target-arm: Correct accessfn for CNTV_TVAL_EL0

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1431499963-1019-3-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12cde08aaf571de65d3fbbdf93c83f0a4321267f
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed May 13 16:52:26 2015 +1000

      target-arm: Correct accessfn for CNTP_{CT}VAL_EL0

      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1431499963-1019-2-git-send-email-edgar.iglesias@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:20 2015 -0500

      target-arm: Add WFx syndrome function

      Adds a utility function for creating a WFx exception syndrome

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 88e8add8b6656c349a96b447b074688d02dc5415
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:19 2015 -0500

      target-arm: Add EL3 and EL2 TCR checking

      Updated get_phys_addr_lpae to check the appropriate TTBCR/TCR depending on the
      current EL. Support includes using the different TCR format as well as checks to
      insure TTBR1 is not used when in EL2 or EL3.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aef878be4e7ab1bdb30b408007320400b0a29c83
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Wed Apr 22 12:09:18 2015 -0500

      target-arm: Add TTBR regime function and use

      Add a utility function for choosing the correct TTBR system register based on
      the specified MMU index. Add use of function on physical address lookup.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1429722561-12651-7-git-send-email-greg.bellows@linaro.org
      [PMM: fixed regime_ttbr() return type to be uint64_t]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d82322e175d58c0c8951cbc905da1ca9ee2e008c
  Author: Timothy Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
  Date:   Wed Apr 8 21:40:52 2015 +0100

      linux-user/arm: Correct TARGET_NR_timerfd to TARGET_NR_timerfd_create

      Misspelled system call name in macro was causing timerfd_create not
      to be supported for the ARM target.

      Signed-off-by: Timothy Edward Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 082587b741efc5329380b4a156d86f2bdbfa2d70
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:30 2015 -0700

      arm: xlnx-ep108: Add bootloading

      Add bootloader support using standard ARM bootloader.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: b829abaf2b70d02b28e79301553cbd74afc416a1.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b79b9d28f6b8f7879c50b6c053b4e3796de5b7d0
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:27 2015 -0700

      arm: xlnx-ep108: Add external RAM

      Zynq MPSoC supports external DDR RAM. Add a RAM at 0 to the model.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 2c25e2a4198402a6477aef2975d5df7c415dd341.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 859a0c5b5fb8be0c1ed78d96695a162c9210e1e6
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:24 2015 -0700

      arm: Add xlnx-ep108 machine

      Add a machine model for the Xilinx ZynqMP SoC EP108 board.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 3896b34c862f370dc0679e4428bf3848d1f9f83c.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3bade2a9e6336e0eb7cc5ad7425994f1143c5cfa
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:21 2015 -0700

      arm: xlnx-zynqmp: Add UART support

      There are 2x Cadence UARTs in Zynq MP. Add them.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: e30795536f77599fabc1052278d846ccd52322e2.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ae57b2fa35dae9aa4b50db5e632156eded9bec0
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:18 2015 -0700

      char: cadence_uart: Split state struct and type into header

      Create a new header for Cadence UART to allow using the device with
      modern SoC programming conventions. The state struct needs to be
      visible to embed the device in SoC containers.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 46a0fbd45b6b205f54c4a8c778deb75c77f8abdf.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e86da3cb40d6f70ce99d8e64952c49df8ad78848
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:15 2015 -0700

      char: cadence_uart: Clean up variable names

      Clean up some variable names in preparation for migrating the state struct
      and type cast macro to a public header. The acronym "UART" on it's own is
      not specific enough to be used in a more global namespace so preface with
      "cadence". Fix the capitalisation of "uart" in the state type while touching
      the typename. Preface macros used by the state struct itself with CADENCE_UART
      so they don't conflict in namespace either.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 3812b7426c338beae9e082557f3524a99310ddc6.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 14ca2e462ee137974d81729b1d88d9d39cf2f22c
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:12 2015 -0700

      arm: xlnx-zynqmp: Add GEM support

      There are 4x Cadence GEMs in ZynqMP. Add them.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 7d3e68e5495d145255f0ee567046415e3a26d67e.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f49856d4e65703e347ee3e2277a87282ce601bcd
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:09 2015 -0700

      net: cadence_gem: Split state struct and type into header

      Create a new header for Cadence GEM to allow using the device with
      modern SoC programming conventions. The state struct needs to be
      visible to embed the device in SoC containers.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a98b5df6440c5bff8f813a26bb53ce1cfefb4c4c.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 448f19e23155021e42878e7effc3da895921ad4e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:07 2015 -0700

      net: cadence_gem: Clean up variable names

      Cleanup some variable names in preparation for migrating the state
      struct and type cast macro to a public header. The acronym "GEM" on
      its own is not specific enough to be used in a more global namespace
      so preface with "cadence". Fix the capitalisation of "gem" in the
      state type while touching the typename. Also preface the GEM_MAXREG
      macro as this will need to migrate to public header.

      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 8e2b0687b3a7b7a3fde5ba2f3bee6f3b911e84ef.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf4cb10966a7685bba3aeaf14434902889ef535d
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:04 2015 -0700

      arm: xlnx-zynqmp: Connect CPU Timers to GIC

      Connect the GPIO outputs from the individual CPUs for the timers to the
      GIC.

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a7866a4f0c903c91fa3034210b4d2879aa4bfcb9.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7729e1f4b3c670eca38cc0ee0d96c1177efbc1e3
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:23:01 2015 -0700

      arm: xlnx-zynqmp: Add GIC

      Add the GIC and connect IRQ outputs to the CPUs. The GIC regions are
      under-decoded through a 64k address region so implement aliases
      accordingly.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5853189965728d676106d9e94e76b9bb87981cb5.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f0a902f76452211cadbdf1d25ef9b94732b096e8
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:58 2015 -0700

      arm: Introduce Xilinx ZynqMP SoC

      With quad Cortex-A53 CPUs.

      Use SMC PSCI, with the standard policy of secondaries starting in
      power-off.

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: a16202a6c7b79e446e5289d38cb18d2ee4b897a0.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e35310260ec57d20301c65a5714ca55369e971cc
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:55 2015 -0700

      target-arm: cpu64: Add support for Cortex-A53

      Add the ARM Cortex-A53 processor definition. Similar to A57, but with
      different L1 I cache policy, phys addr size and different cache
      geometries. The cache sizes is implementation configurable, but use
      these values (from Xilinx Zynq MPSoC) as a default until cache size
      configurability is added.

      Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: db439ff834cf0431bc192b05272a3b28fe2045d0.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ee804264ddc4d3cd36a5183a09847e391da0fc66
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Thu May 14 19:22:52 2015 -0700

      target-arm: cpu64: generalise name of A57 regs

      Rename some A57 CP register variables in preparation for support for
      Cortex A53. Use "a57_a53" to describe the shareable features. Some of
      the CP15 registers (such as ACTLR) are specific to implementation, but
      we currently just RAZ them so continue with that as the policy for both
      A57 and A53 processors under a shared definition.

      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5a5f957994677d91435190b3be1cefa6f657e274.1431381507.git.peter.crosthwaite@xilinx.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 385057cbec9b4a0eb6150330c572e875ed714965
  Merge: 99e7627 4180978
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 15 17:51:20 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-05-15' into staging

      qapi: Fix qapi mangling of downstream names, and more

      # gpg: Signature made Fri May 15 17:41:31 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qapi-2015-05-15: (26 commits)
        qapi: Inline gen_command_decl_prologue(), gen_command_def_prologue()
        qapi: Drop pointless flush() before close()
        qapi: Factor open_output(), close_output() out of generators
        qapi: Turn generators' mandatory option -i into an argument
        qapi: Fix generators to report command line errors decently
        qapi: Factor parse_command_line() out of the generators
        qapi: qapi-commands.py option --type is unused, drop it
        qapi: qapi-event.py option -b does nothing, drop it
        tests: Add missing dependencies on $(qapi-py)
        qapi: Support downstream events and commands
        qapi: Support downstream alternates
        qapi: Support downstream flat unions
        qapi: Support downstream simple unions
        qapi: Support downstream structs
        qapi: Support downstream enums
        qapi: Make c_type() consistently convert qapi names
        qapi: Tidy c_type() logic
        qapi: Move camel_to_upper(), c_enum_const() to closely related code
        qapi: Use c_enum_const() in generate_alternate_qtypes()
        qapi: Simplify c_enum_const()
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 99e7627a70d1a23e30a514e5a4798005cf4eb3aa
  Merge: 1eeace9 dfb3630
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri May 15 16:02:08 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150514' into staging

      Per-memop alignment

      # gpg: Signature made Thu May 14 20:17:27 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150514:
        tcg: Add MO_ALIGN, MO_UNALN
        tcg: Push merged memop+mmu_idx parameter to softmmu routines
        tcg: Merge memop and mmu_idx parameters to qemu_ld/st

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dfb36305626636e2e07e0c5acd3a002a5419399e
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed May 13 11:25:20 2015 -0700

      tcg: Add MO_ALIGN, MO_UNALN

      These modifiers control, on a per-memory-op basis, whether
      unaligned memory accesses are allowed.  The default setting
      reflects the target's definition of ALIGNED_ONLY.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3972ef6f830d65e9bacbd31257abedc055fd6dc8
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Wed May 13 09:10:33 2015 -0700

      tcg: Push merged memop+mmu_idx parameter to softmmu routines

      The extra information is not yet used but it is now available.
      This requires minor changes through all of the tcg backends.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 59227d5d45bb3c31dc2118011691c35b3c00879c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue May 12 11:51:44 2015 -0700

      tcg: Merge memop and mmu_idx parameters to qemu_ld/st

      At the tcg opcode level, not at the tcg-op.h generator level.
      This requires minor changes through all of the tcg backends,
      but none of the cpu translators.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 4180978c9205c50acd2d6c385def9b3e81911696
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:52:55 2015 +0200

      qapi: Inline gen_command_decl_prologue(), gen_command_def_prologue()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 09896d3f48078a93e3d2dbd8ef86436b85ebda7c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:49:29 2015 +0200

      qapi: Drop pointless flush() before close()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12f8e1b9ff57e99dafbb13f89cd5a99ad5c28527
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 14:46:39 2015 +0200

      qapi: Factor open_output(), close_output() out of generators

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 16d80f61814745bd3f5bb9f47ae3b00edf9e1e45
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:32:16 2015 +0200

      qapi: Turn generators' mandatory option -i into an argument

      Mandatory option is silly, and the error handling is missing: the
      programs crash when -i isn't supplied.  Make it an argument, and check
      it properly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit b45409683e829770000a4560ed21e704f87df74c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:17:34 2015 +0200

      qapi: Fix generators to report command line errors decently

      Report to stderr, prefix with the program name.  Also reject
      extra arguments.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 2114f5a98d0d80774306279e1694de074ca86aa0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:12:21 2015 +0200

      qapi: Factor parse_command_line() out of the generators

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 72aaa73a4acef06bfaed750064c40a597f0cf745
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 11:41:22 2015 +0200

      qapi: qapi-commands.py option --type is unused, drop it

      Anything but --type sync (which is the default) suppresses output
      entirely, which makes no sense.

      Dates back to the initial commit c17d990.  Commit message says
      "Currently only generators for synchronous qapi/qmp functions are
      supported", so maybe output other than "synchronous qapi/qmp" was
      planned at the time, to be selected with --type.

      Should other kinds of output ever materialize, we can put the option
      back.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c70cef5bd48c7be603f75a7b5346db032a31b470
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 11:40:21 2015 +0200

      qapi: qapi-event.py option -b does nothing, drop it

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit df3e21a0e0edd30ea2e7c9b09b05feaaa297c718
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Apr 2 13:38:48 2015 +0200

      tests: Add missing dependencies on $(qapi-py)

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e3c4c3d796c1147d32f66fa1413d5d7c49d5aa37
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:51:01 2015 -0600

      qapi: Support downstream events and commands

      Enhance the testsuite to cover downstream events and commands.
      Events worked without more tweaks, but commands needed a few final
      updates in the generator to mangle names in the appropriate places.
      In making those tweaks, it was easier to drop type_visitor() and
      inline its actions instead.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d1f07c86c05706facf950b0b0dba370f71fd5ef6
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:51:00 2015 -0600

      qapi: Support downstream alternates

      Enhance the testsuite to cover downstream alternates, including
      whether the branch name or type is downstream.  Update the
      generator to mangle alternate names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 857af5f06c3fb097d1bb6bc8a23b9992aac99e75
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:59 2015 -0600

      qapi: Support downstream flat unions

      Enhance the testsuite to cover downstream flat unions, including
      the base type, discriminator name and type, and branch name and
      type.  Update the generator to mangle the union names in the
      appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit bb33729043ceda56b4068db13bdc17786ebd0ed0
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:58 2015 -0600

      qapi: Support downstream simple unions

      Enhance the testsuite to cover downstream simple unions, including
      when a union branch is a downstream name.  Update the generator to
      mangle the union names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 83a02706bb1fd31c93eab755de543dfe228682d4
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:57 2015 -0600

      qapi: Support downstream structs

      Enhance the testsuite to cover downstream structs, including struct
      members and base structs.  Update the generator to mangle the
      struct names in the appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fce384b8e5193e02421f6b2c2880f3684abcbdc0
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:56 2015 -0600

      qapi: Support downstream enums

      Enhance the testsuite to cover a downstream enum type and enum
      string.  Update the generator to mangle the enum name in the
      appropriate places.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c6405b54b7b09a876f2f2fba2aa6f8ac87189cb9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:55 2015 -0600

      qapi: Make c_type() consistently convert qapi names

      Continuing the string of cleanups for supporting downstream names
      containing '.', this patch focuses on ensuring c_type() can
      handle a downstream name.  This patch alone does not fix the
      places where generator output should be calling this function
      but was open-coding things instead, but it gets us a step closer.

      In particular, the changes to c_list_type() and type_name() mean
      that type_name(FOO) now handles the case when FOO contains '.',
      '-', or is a ticklish identifier other than a builtin (builtins
      are exempted because ['int'] must remain mapped to 'intList' and
      not 'q_intList').  Meanwhile, ['unix'] now maps to 'q_unixList'
      rather than 'unixList', to match the fact that 'unix' is ticklish;
      however, our naming conventions state that complex types should
      start with a capital, so no type name following conventions will
      ever have the 'q_' prepended.

      Likewise, changes to c_type() mean that c_type(FOO) properly
      handles an enum or complex type FOO with '.' or '-' in the
      name, or is a ticklish identifier (again, a ticklish identifier
      as a type name violates conventions).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d557344628e32771f07e5b6a2a818ee3d8e7a65f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:54 2015 -0600

      qapi: Tidy c_type() logic

      c_type() is designed to be called on both string names and on
      array designations, so 'name' is a bit misleading because it
      operates on more than strings.  Also, no caller ever passes
      an empty string.  Finally, + notation is a bit nicer to read
      than '%s' % value for string concatenation.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 849bc5382e42b3b9590c6a50ba30c2fd2450308c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:53 2015 -0600

      qapi: Move camel_to_upper(), c_enum_const() to closely related code

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit b42e91484df9772bb0c26aa0f05390a92d564d6f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:52 2015 -0600

      qapi: Use c_enum_const() in generate_alternate_qtypes()

      Missed in commit b0b5819.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 02e20c7e593363c564aae96e3c5bdc58630ce584
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:51 2015 -0600

      qapi: Simplify c_enum_const()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 7c81c61f9c2274f66ba947eafd9618d60da838a6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:50 2015 -0600

      qapi: Rename generate_enum_full_value() to c_enum_const()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit fa6068a1e8ef3c878ac9ee2399bb01eeaf61c366
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:49 2015 -0600

      qapi: Rename _generate_enum_string() to camel_to_upper()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>

  commit 18df515ebbefa9f13474b128b8050d5fa346ea1e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Thu May 14 06:50:48 2015 -0600

      qapi: Rename identical c_fun()/c_var() into c_name()

      Now that the two functions are identical, we only need one of them,
      and we might as well give it a more descriptive name.  Basically,
      the function serves as the translation from a QAPI name into a
      (portion of a) C identifier, without regards to whether it is a
      variable or function name.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 47299262de424af0cb69965d082e5e70b2314183
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu May 14 06:50:47 2015 -0600

      qapi: Fix C identifiers generated for names containing '.'

      c_fun() maps '.' to '_', c_var() doesn't.  Nothing prevents '.' in
      QAPI names that get passed to c_var().

      Which QAPI names get passed to c_fun(), to c_var(), or to both is not
      obvious.  Names of command parameters and struct type members get
      passed to c_var().

      c_var() strips a leading '*', but this cannot happen.  c_fun()
      doesn't.

      Fix c_var() to work exactly like c_fun().

      Perhaps they should be replaced by a single mapping function.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      [add 'import string']
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>

  commit 777abdfe7bb47e582c8eb87dd6cecdf3fd9f86fc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon May 11 17:17:49 2015 +0200

      doc: fix qmp event type

      Event name for hot unplug errors was wrong.
      Make doc match code.

      Cc: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reported-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 58f88d4b7e9e5578b8dd2c5acfe555b85b35af88
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri May 8 16:04:22 2015 -0300

      qmp: Add qom_path field to query-cpus command

      This will allow clients to query additional information directly using
      qom-get on the CPU objects.

      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 1eeace9c237a729d11c7acd7c0338ab4562af637
  Merge: 4d2d2d8 57af728
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 13 16:06:07 2015 +0100

      Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' into staging

      Patch queue for s390 - 2015-05-13

      A few TCG fixes for the s390x target. Nothing special, but with these
      applied I can run most of the SLE12 binaries in Linux-user emulation.

      # gpg: Signature made Wed May 13 13:49:25 2015 BST using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-s390-for-upstream:
        s390x: Add interlocked access facility 1 instructions
        s390x: Add some documentation in opcode list
        s390x: Fix stoc direction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4d2d2d8b21779d7becbdffd7cd7983a7ccb55b54
  Merge: 968bb75 e907746
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 13 13:57:44 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-cve-pull-request' into staging

      # gpg: Signature made Wed May 13 12:52:19 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-cve-pull-request:
        fdc: force the fifo access to be in bounds of the allocated buffer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57af7289f276ce70b65f2fbb4981833f04264aac
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri May 8 03:07:53 2015 +0200

      s390x: Add interlocked access facility 1 instructions

      We're currently missing all instructions defined by the "interlocked-access
      facility 1" which is part of zEC12. This patch implements all of them except
      for LPD and LPDG.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 13f67dd5825a7dfd7a4904a5fb0cf0a3f95d2d45
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri May 8 03:06:41 2015 +0200

      s390x: Add some documentation in opcode list

      I find it really hard to grasp what each field in the opcode list means.
      Slowly walking through its semantics myself, I figured I'd write a small
      summary at the top of the file to make life easier for me and whoever
      looks at the file next.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit c095ed731ce4fecf166e4ac02ddc606b408f5e1f
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Apr 15 03:45:41 2015 +0200

      s390x: Fix stoc direction

      The store conditional instruction wants to store when the condition
      is fulfilled, so we should branch out when it's not true.

      The code today branches out when the condition is true, clearly
      reversing the logic. Fix it up by negating the condition.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e907746266721f305d67bc0718795fedee2e824c
  Author: Petr Matousek <pmatouse@redhat.com>
  Date:   Wed May 6 09:48:59 2015 +0200

      fdc: force the fifo access to be in bounds of the allocated buffer

      During processing of certain commands such as FD_CMD_READ_ID and
      FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
      get out of bounds leading to memory corruption with values coming
      from the guest.

      Fix this by making sure that the index is always bounded by the
      allocated memory.

      This is CVE-2015-3456.

      Signed-off-by: Petr Matousek <pmatouse@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 968bb75c348a401b85e08d5eb1887a3e6c3185f5
  Merge: 19fbe50 5ae79fe
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 12:11:32 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150512' into staging

      target-arm queue:
       * Support TZ and grouping in the GIC
       * hw/sd: sd_reset cleanup
       * armv7m_nvic: fix bug in systick device

      # gpg: Signature made Tue May 12 12:02:26 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150512:
        hw/arm/highbank.c: Wire FIQ between CPU <> GIC
        hw/arm/vexpress.c: Wire FIQ between CPU <> GIC
        hw/arm/virt.c: Wire FIQ between CPU <> GIC
        hw/intc/arm_gic: Add grouping support to gic_update()
        hw/intc/arm_gic: Change behavior of IAR writes
        hw/intc/arm_gic: Change behavior of EOIR writes
        hw/intc/arm_gic: Handle grouping for GICC_HPPIR
        hw/intc/arm_gic: Restrict priority view
        hw/intc/arm_gic: Implement Non-secure view of RPR
        hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked
        hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked
        hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked
        hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state
        hw/intc/arm_gic: Add Interrupt Group Registers
        hw/intc/arm_gic: Switch to read/write callbacks with tx attributes
        hw/intc/arm_gic: Add Security Extensions property
        hw/intc/arm_gic: Create outbound FIQ lines
        hw/sd: Don't pass BlockBackend to sd_reset()
        armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5ae79fe825bedc89db8b6bde9d0ed0bb5d59558c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:19 2015 +0100

      hw/arm/highbank.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-18-git-send-email-peter.maydell@linaro.org

  commit 27192e390d064489dcb23d5fcceb21cabf86d789
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/arm/vexpress.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-17-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-3-git-send-email-greg.bellows@linaro.org
      [PMM: minor format tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8e7b4ca08b968c9e195bcae9c6cb827c8564871a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/arm/virt.c: Wire FIQ between CPU <> GIC

      Connect FIQ output of the GIC CPU interfaces to the CPUs.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-16-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-4-git-send-email-greg.bellows@linaro.org
      [PMM: minor format tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dadbb58f5955053c5f5dc2252a4b183f90d7bfce
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Add grouping support to gic_update()

      Add support to gic_update() for determining the current IRQ
      and FIQ status when interrupt grouping is supported. This
      simply requires that instead of always raising IRQ we
      check the group of the highest priority pending interrupt
      and the GICC_CTLR.FIQEn bit to see whether we should raise
      IRQ or FIQ.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1430502643-25909-15-git-send-email-peter.maydell@linaro.org

  commit c5619bf9e8935aeb972c0bd935549e9ee0a739f2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Change behavior of IAR writes

      Grouping (GICv2) and Security Extensions change the behavior of IAR
      reads. Acknowledging Group0 interrupts is only allowed from Secure
      state and acknowledging Group1 interrupts from Secure state is only
      allowed if AckCtl bit is set.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-14-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-14-git-send-email-greg.bellows@linaro.org
      [PMM: simplify significantly by reusing the existing
       gic_get_current_pending_irq() rather than reimplementing the
       same logic here]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9c6a7f1395c6d88a3bb1a0cb48811994709966e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Change behavior of EOIR writes

      Grouping (GICv2) and Security Extensions change the behavior of EOIR
      writes. Completing Group0 interrupts is only allowed from Secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-13-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-13-git-send-email-greg.bellows@linaro.org
      [PMM: Rather than go to great lengths to ignore the UNPREDICTABLE case
       of a Secure EOI of a Group1 (NS) irq with AckCtl == 0, we just let
       it fall through; add a comment about it.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c0fa108d918ab818e49c4588ab290004d6b532e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:18 2015 +0100

      hw/intc/arm_gic: Handle grouping for GICC_HPPIR

      Grouping (GICv2) and Security Extensions change the behaviour of reads
      of the highest priority pending interrupt register (ICCHPIR/GICC_HPPIR).

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-12-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-12-git-send-email-greg.bellows@linaro.org
      [PMM: make utility fn static; coding style fixes; AckCtl has an effect
       for GICv2 without security extensions as well; removed checks on enable
       bits because these are done when we set current_pending[cpu]]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8150847061f8d2606101bfff77cc6ec86b081ab0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Restrict priority view

      GICs with Security Extensions restrict the non-secure view of the
      interrupt priority and priority mask registers.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-11-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-15-git-send-email-greg.bellows@linaro.org
      [PMM: minor code tweaks; fixed missing masking in gic_set_priority_mask
      and gic_set_priority]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08efa9f2d1bb27d64fbedcc2879ca45ae6832c20
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Implement Non-secure view of RPR

      For GICs with Security Extensions Non-secure reads have a restricted
      view on the current running priority.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-10-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-11-git-send-email-greg.bellows@linaro.org
      [PMM: make function static, minor comment tweak]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 32951860834f09d1c1a0b81d8d7d5529e2d0e074
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked

      ICCICR/GICC_CTLR is banked in GICv1 implementations with Security
      Extensions or in GICv2 in independent from Security Extensions.
      This makes it possible to enable forwarding of interrupts from
      the CPU interfaces to the connected processors for Group0 and Group1.

      We also allow to set additional bits like AckCtl and FIQEn by changing
      the type from bool to uint32. Since the field does not only store the
      enable bit anymore and since we are touching the vmstate, we use the
      opportunity to rename the field to cpu_ctlr.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-9-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-9-git-send-email-greg.bellows@linaro.org
      [PMM: rewrote to store state in a single uint32_t rather than
       keeping the NS and S banked variants separate; this considerably
       simplifies the get/set functions]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 822e9cc310484f77e0b1c16fbef763a5d0eec80a
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked

      This register is banked in GICs with Security Extensions. Storing the
      non-secure copy of BPR in the abpr, which is an alias to the non-secure
      copy for secure access. ABPR itself is only accessible from secure state
      if the GIC implements Security Extensions.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-8-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-10-git-send-email-greg.bellows@linaro.org
      [PMM: rewrote to fix style issues and correct handling of GICv2
       without security extensions]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 679aa175e84f5f80b32b307fce5a6b92729e0e61
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked

      ICDDCR/GICD_CTLR is banked if the GIC has the security extensions,
      and the S (or only) copy has separate enable bits for Group0 and
      Group1 enable if the GIC implements interrupt groups.

      EnableGroup0 (Bit [1]) in GICv1 is architecturally IMPDEF. Since this
      bit (Enable Non-secure) is present in the integrated GIC of the Cortex-A9
      MPCore, we support this bit in our GICv1 implementation too.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-7-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-8-git-send-email-greg.bellows@linaro.org
      [PMM: rewritten to store the state in a single s->ctlr uint32,
       with the NS register handled as an alias of bit 1 in that value;
       added vmstate version bump]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit eb8b9530b0c618d4f2e728eae10d89239d35b0c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state

      Now that the GIC base class has state fields for the GICD_IGROUPRn
      registers, make kvm_arm_gic_get() and kvm_arm_gic_put() write and
      read them. This allows us to remove the check that made us
      fail migration if the guest had set any of the group register bits.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-6-git-send-email-peter.maydell@linaro.org

  commit c27a5ba94874cb3a29e21b3ad4bd5e504aea93b2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:17 2015 +0100

      hw/intc/arm_gic: Add Interrupt Group Registers

      The Interrupt Group Registers allow the guest to configure interrupts
      into one of two groups, where Group0 are higher priority and may
      be routed to IRQ or FIQ, and Group1 are lower priority and always
      routed to IRQ. (In a GIC with the security extensions Group0 is
      Secure interrupts and Group 1 is NonSecure.)
      The GICv2 always supports interrupt grouping; the GICv1 does only
      if it implements the security extensions.

      This patch implements the ability to read and write the registers;
      the actual functionality the bits control will be added in a
      subsequent patch.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-5-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-7-git-send-email-greg.bellows@linaro.org
      [PMM: bring GIC_*_GROUP macros into line with the others, ie a
       simple SET/CLEAR/TEST rather than GROUP0/GROUP1;
       utility gic_has_groups() function;
       minor style fixes;
       bump vmstate version]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9d853533cc1a27dc09b10c7ab89677f9c5dd8f4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Switch to read/write callbacks with tx attributes

      Switch the GIC's MMIO callback functions to the read_with_attrs
      and write_with_attrs functions which provide MemTxAttrs. This will
      allow the GIC to correctly handle secure and nonsecure register
      accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 1430502643-25909-4-git-send-email-peter.maydell@linaro.org

  commit 5543d1abb6e218a9d3b8887b777fd3947c86c4cf
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Add Security Extensions property

      Add a QOM property which allows the GIC Security Extensions to be
      enabled. These are an optional part of the GICv1 and GICv2 architecture.
      This commit just adds the property and some sanity checks that it
      is only enabled on GIC revisions that support it.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-3-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-5-git-send-email-greg.bellows@linaro.org
      [PMM: changed property name, added checks that it isn't set for
       older GIC revisions or if using the KVM VGIC; reworded commit message]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 44f552964714a41ccd41b5e8ac4cbd2478249db1
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/intc/arm_gic: Create outbound FIQ lines

      Create the outbound FIQ lines from the GIC to the CPUs; these are
      used if the GIC has security extensions or grouping support.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1430502643-25909-2-git-send-email-peter.maydell@linaro.org
      Message-id: 1429113742-8371-2-git-send-email-greg.bellows@linaro.org
      [PMM: added FIQ lines to kvm-arm-gic so its interface is the same;
      tweaked commit message]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 16b781aaef69c90d5f4f5456615f0c26a4f45740
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 11:57:16 2015 +0100

      hw/sd: Don't pass BlockBackend to sd_reset()

      The only valid BlockBackend to pass to sd_reset() is the one for
      the SD card, which is sd->blk. Drop the second argument from this
      function in favour of having it just use sd->blk.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1430683444-9797-1-git-send-email-peter.maydell@linaro.org

  commit 165cdaf857dc850f676fff0b5b873a51865baa9c
  Author: Adrian Huang <adrianhuang0701@gmail.com>
  Date:   Tue May 12 11:57:16 2015 +0100

      armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set

      Consider the following pseudo code to configure SYSTICK (The
      recommended programming sequence from "the definitive guide to the
      arm cortex-m3"):
          SYSTICK Reload Value Register = 0xffff
          SYSTICK Current Value Register = 0
          SYSTICK Control and Status Register = 0x7

      The pseudo code "SYSTICK Current Value Register = 0" leads to invoking
      systick_reload(). As a consequence, the systick.tick member is updated
      and the systick timer starts to count down when the ENABLE bit of
      SYSTICK Control and Status Register is cleared.

      The worst case is that: during the system initialization, the reset
      value of the SYSTICK Control and Status Register is 0x00000000.
      When the code "SYSTICK Current Value Register = 0" is executed, the
      systick.tick member is accumulated with "(s->systick.reload + 1) *
      systick_scale(s)". The systick_scale() gets the external_ref_clock
      scale because the CLKSOURCE bit of the SYSTICK Control and Status
      Register is cleared. This is the incorrect behavior because of the
      code "SYSTICK Control and Status Register = 0x7". Actually, we want
      the processor clock instead of the external reference clock.

      This incorrect behavior defers the generation of the first interrupt.

      The patch fixes the above-mentioned issue by setting the systick.tick
      member and modifying the systick timer only if the ENABLE bit of
      the SYSTICK Control and Status Register is set.

      In addition, the Cortex-M3 Devices Generic User Guide mentioned that
      "When ENABLE is set to 1, the counter loads the RELOAD value from the
      SYST RVR register and then counts down". This patch adheres to the
      statement of the user guide.

      Signed-off-by: Adrian Huang <adrianhuang0701@gmail.com>
      Reviewed-by: Jim Huang <jserv.tw@gmail.com>
      [PMM: minor tweak to comment text]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 19fbe5084c1da6af95177c86e4cab64241d479a8
  Merge: 704eb1c 7db161f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 10:40:31 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon May 11 16:25:58 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        rocker: timestamp on the debug logs helps correlate with events in the VM
        MAINTAINERS: add rocker
        rocker: add tests
        rocker: add new rocker switch device
        pci: add network device class 'other' for network switches
        pci: add rocker device ID
        rocker: add register programming guide
        virtio-net: use qemu_mac_strdup_printf
        net: add MAC address string printer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 704eb1c09963149db4a3407d5ba173ba2a9244bb
  Merge: 0403b0f 1ceca07
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 12 09:01:51 2015 +0100

      Merge remote-tracking branch 'remotes/qmp-unstable/tags/for-upstream' into staging

      QMP pull request

      # gpg: Signature made Mon May 11 14:15:19 2015 BST using RSA key ID E24ED5A7
      # gpg: Good signature from "Luiz Capitulino <lcapitulino@gmail.com>"

      * remotes/qmp-unstable/tags/for-upstream:
        scripts: qmp-shell: Add verbose flag
        scripts: qmp-shell: add transaction subshell
        scripts: qmp-shell: Expand support for QMP expressions
        scripts: qmp-shell: refactor helpers
        MAINTAINERS: New maintainer for QMP and QAPI
        json-parser: Accept 'null' in QMP
        qobject: Add a special null QObject
        qobject: Clean up around qtype_code
        QJSON: Use OBJECT_CHECK

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0403b0f539f40a21da60409b825b4653b273ab39
  Merge: 266745c bc1f7c4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 16:21:50 2015 +0100

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, virtio enhancements

      Memory hot-unplug support for pc, MSI-X
      mapping update speedup for virtio-pci,
      misc refactorings and bugfixes.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Mon May 11 08:23:43 2015 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream: (28 commits)
        acpi: update expected files for memory unplug
        virtio-scsi: Move DEFINE_VIRTIO_SCSI_FEATURES to virtio-scsi
        virtio-net: Move DEFINE_VIRTIO_NET_FEATURES to virtio-net
        pci: Merge pci_nic_init() into pci_nic_init_nofail()
        acpi: add a missing backslash to the \_SB scope.
        qmp-event: add event notification for memory hot unplug error
        acpi: add hardware implementation for memory hot unplug
        acpi: fix "Memory device control fields" register
        acpi: extend aml_field() to support UpdateRule
        acpi, mem-hotplug: add unplug cb for memory device
        acpi, mem-hotplug: add unplug request cb for memory device
        acpi, mem-hotplug: add acpi_memory_slot_status() to get MemStatus
        docs: update documentation for memory hot unplug
        virtio: coding style tweak
        pci: remove hard-coded bar size in msix_init_exclusive_bar()
        virtio-pci: speedup MSI-X masking and unmasking
        virtio: introduce vector to virtqueues mapping
        virtio-ccw: using VIRTIO_NO_VECTOR instead of 0 for invalid virtqueue
        monitor: check return value of qemu_find_net_clients_except()
        monitor: replace the magic number 255 with MAX_QUEUE_NUM
        ...

      Conflicts:
      	hw/s390x/s390-virtio-bus.c

      [PMM: fixed conflict in s390_virtio_scsi_properties and
      s390_virtio_net_properties arrays; since the result of the
      two conflicting patches is to empty the property arrays
      completely, the conflict resolution is to remove them entirely.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 266745cacb848d7cd0ae8889ae262e8718ace4d4
  Merge: 9ad2c8c 3446a11
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 15:07:12 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150511' into staging

      TriCore bugfixes

      # gpg: Signature made Mon May 11 13:26:40 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150511:
        target-tricore: fix rfe not restoring the PC
        target-tricore: fix rslcx restoring the upper context instead of the lower
        target-tricore: fix BO_OFF10_SEXT calculating the wrong offset
        target-tricore: fix SLR_LD_W and SLR_LD_W_POSTINC insn being a 2 byte memory access insted of 4
        target-tricore: Fix LOOP using wrong register for compare

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7db161f6dd144760b2912026d992837ef80ca7e7
  Author: David Ahern <dsahern@gmail.com>
  Date:   Fri Mar 13 21:09:33 2015 -0700

      rocker: timestamp on the debug logs helps correlate with events in the VM

      Signed-off-by: David Ahern <dsahern@gmail.com>
      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-10-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de24d3f1013dbee65b42f34cb825f056647861a5
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:32 2015 -0700

      MAINTAINERS: add rocker

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-9-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 63d2ada2f55a85c3143ecf69a5aeecf6b3f3ffc9
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:31 2015 -0700

      rocker: add tests

      Add some basic test for rocker to test L2/L3/L4 functionality.  Requires an
      external test environment, simp, located here:

      https://github.com/scottfeldman/simp

      To run tests, simp environment must be installed and a suitable VM image built
      and installed with a Linux 3.18 (or greater) kernel with rocker driver support
      enabled.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Message-id: 1426306173-24884-8-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dc488f888060afdc129e0cc8812cf50c4c083423
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:30 2015 -0700

      rocker: add new rocker switch device

      Rocker is a simulated ethernet switch device.  The device supports up to 62
      front-panel ports and supports L2 switching and L3 routing functions, as well
      as L2/L3/L4 ACLs.  The device presents a single PCI device for each switch,
      with a memory-mapped register space for device driver access.

      Rocker device is invoked with -device, for example a 4-port switch:

        -device rocker,name=sw1,len-ports=4,ports[0]=dev0,ports[1]=dev1, \
               ports[2]=dev2,ports[3]=dev3

      Each port is a netdev and can be paired with using -netdev id=<port name>.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Acked-by: Scott Feldman <sfeldma@gmail.com>
      Acked-by: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: David Ahern <dsahern@gmail.com>
      Message-id: 1426306173-24884-7-git-send-email-sfeldma@gmail.com

      rocker: fix clang compiler errors

      Consolidate all forward typedef declarations to rocker.h.

      Signed-off-by: David Ahern <dsahern@gmail.com>
      Acked-by: Scott Feldman <sfeldma@gmail.com>
      Acked-by: Jiri Pirko <jiri@resnulli.us>

      rocker: add support for flow modification

      We had support for flow add/del.  This adds support for flow mod.  I needed
      this for L3 support where an existing route is modified using NLM_F_REPLACE.
      For example:

        ip route add 12.0.0.0/30 nexthop via 11.0.0.1 dev swp1
        ip route change 12.0.0.0/30 nexthop via 11.0.0.9 dev swp2

      The first cmd adds the route.  The second cmd changes the existing route by
      changing its nexthop info.

      In the device, a mod operation results in the matching flow enty being modified
      with the new settings.  This is atomic to the device.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dc407ae8a75d03cf48e114d3812d077fa29a8bd9
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:29 2015 -0700

      pci: add network device class 'other' for network switches

      Rocker is an ethernet switch device, so add 'other' network device class as
      defined by PCI to cover these types of devices.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-6-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5dcc26371dcc72976777c51f0251127716a59ed8
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:28 2015 -0700

      pci: add rocker device ID

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-5-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bbc53c7e2580264fe2b6ea84bd8f3480bcc7c845
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:27 2015 -0700

      rocker: add register programming guide

      This is the register programming guide for the Rocker device.  It's intended
      for driver writers and device writers.  It covers the device's PCI space,
      the register set, DMA interface, and interrupts.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Message-id: 1426306173-24884-4-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0575ba4a52c9259357af29d842950e978306fa4
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:26 2015 -0700

      virtio-net: use qemu_mac_strdup_printf

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426306173-24884-3-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 890ee6abb385d6508bba7f5273c74a8e43bea6af
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Fri Mar 13 21:09:25 2015 -0700

      net: add MAC address string printer

      We can use this in virtio-net code as well as new Rocker driver code, so
      up-level this.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426306173-24884-2-git-send-email-sfeldma@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ceca07e48ead0dd2e41576c81d40e6a91cafefd
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:04 2015 -0400

      scripts: qmp-shell: Add verbose flag

      Add a verbose flag that shows the QMP command that was
      constructed, to allow for later copy/pasting, reference,
      debugging, etc.

      The QMP is converted from a Python literal to JSON first,
      to ensure that it is viable input to the actual QMP parser.

      As a side-effect, this JSON output will helpfully show all
      the necessary conversions that were performed on the input,
      illustrating that "True" was transformed back into "true",
      literal values are now escaped with "" instead of '', and so on.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 30bd6815efbaf5bae70885feac9a35e149e2f1ad
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:03 2015 -0400

      scripts: qmp-shell: add transaction subshell

      Add a special processing mode to craft transactions.

      By entering "transaction(" the shell will enter a special
      mode where each subsequent command will be saved as a transaction
      instead of executed as an individual command.

      The transaction can be submitted by entering ")" on a line by itself.

      Examples:

      Separate lines:

      (QEMU) transaction(
      TRANS> block-dirty-bitmap-add node=drive0 name=bitmap1
      TRANS> block-dirty-bitmap-clear node=drive0 name=bitmap0
      TRANS> )

      With a transaction action included on the first line:

      (QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap2
      TRANS> block-dirty-bitmap-add node=drive0 name=bitmap3
      TRANS> )

      As a one-liner, with just one transaction action:

      (QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap0 )

      As a side-effect of this patch, blank lines are now parsed as no-ops,
      regardless of which shell mode you are in.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6092c3ecc4bdafee5bf07061be78a4a2cc5a5088
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:02 2015 -0400

      scripts: qmp-shell: Expand support for QMP expressions

      This includes support for [] expressions, single-quotes in
      QMP expressions (which is not strictly a part of JSON), and
      the ability to use "True", "False" and "None" literals instead
      of JSON's equivalent true, false, and null literals.

      qmp-shell currently allows you to describe values as
      JSON expressions:
      key={"key":{"key2":"val"}}

      But it does not currently support arrays, which are needed
      for serializing and deserializing transactions:
      key=[{"type":"drive-backup","data":{...}}]

      qmp-shell also only currently accepts doubly quoted strings
      as-per JSON spec, but QMP allows single quotes.

      Lastly, python allows you to utilize "True" or "False" as
      boolean literals, but JSON expects "true" or "false". Expand
      qmp-shell to allow the user to type either, converting to the
      correct type.

      As a consequence of the above, the key=val parsing is also improved
      to give better error messages if a key=val token is not provided.

      CAVEAT: The parser is still extremely rudimentary and does not
      expect to find spaces in {} nor [] expressions. This patch does
      not improve this functionality.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit a7430a0badc59bd6295936e06c1869e8fe32649d
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Apr 29 15:14:01 2015 -0400

      scripts: qmp-shell: refactor helpers

      Refactor the qmp-shell command line processing function
      into two components. This will be used to allow sub-expressions,
      which will assist us in adding transactional support to qmp-shell.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9740618cd2a0ed85b9c1648f05f3066f525f4b2e
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Tue May 5 10:39:15 2015 -0400

      MAINTAINERS: New maintainer for QMP and QAPI

      Markus is taking over maintership of QMP and the QAPI from
      me. Markus has always been a great reviewer and contributor
      to those subsystems. In the last few months he's also doing
      pull requests that are a lot more relevant than the ones I
      was able to do. So, this is a natural move.

      I'm still the maintainer of HMP and QObjects, but I'm
      looking for someone to take over those too.

      PS: This commit also fixes the file listing for the QMP
          entry.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e549e7161f37416ff66971d77d021d30057045ca
  Author: Eric Blake <eblake@redhat.com>
  Date:   Wed Apr 29 15:35:06 2015 -0600

      json-parser: Accept 'null' in QMP

      We document that in QMP, the client may send any json-value
      for the optional "id" key, and then return that same value
      on reply (both success and failures, insofar as the failure
      happened after parsing the id).  [Note that the output may
      not be identical to the input, as whitespace may change and
      since we may reorder keys within a json-object, but that this
      still constitutes the same json-value].  However, we were not
      handling the JSON literal null, which counts as a json-value
      per RFC 7159.

      Also, down the road, given the QAPI schema of {'*foo':'str'} or
      {'*foo':'ComplexType'}, we could decide to allow the QMP client
      to pass { "foo":null } instead of the current representation of
      { } where omitting the key is the only way to get at the default
      NULL value.  Such a change might be useful for argument
      introspection (if a type in older qemu lacks 'foo' altogether,
      then an explicit "foo":null probe will force an easily
      distinguished error message for whether the optional "foo" key
      is even understood in newer qemu).  And if we add default values
      to optional arguments, allowing an explicit null would be
      required for getting a NULL value associated with an optional
      string that has a non-null default.  But all that can come at a
      later day.

      The 'check-unit' testsuite is enhanced to test that parsing
      produces the same object as explicitly requesting a reference
      to the special qnull object.  In addition, I tested with:

      $ ./x86_64-softmmu/qemu-system-x86_64 -qmp stdio -nodefaults
      {"QMP": {"version": {"qemu": {"micro": 91, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
      {"execute":"qmp_capabilities","id":null}
      {"return": {}, "id": null}
      {"id":{"a":null,"b":[1,null]},"execute":"quit"}
      {"return": {}, "id": {"a": null, "b": [1, null]}}
      {"timestamp": {"seconds": 1427742379, "microseconds": 423128}, "event": "SHUTDOWN"}

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 481b002cc81ed7fc7b06e32e9d4d495d81739d14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Apr 29 15:35:05 2015 -0600

      qobject: Add a special null QObject

      I'm going to fix the JSON parser to recognize null.  The obvious
      representation of JSON null as (QObject *)NULL doesn't work, because
      the parser already uses it as an error value.  Perhaps we should
      change it to free NULL for null, but that's more than I can do right
      now.  Create a special null QObject instead.

      The existing QDict, QList, and QString all represent something that
      is a pointer in C and could therefore be associated with NULL.  But
      right now, all three of these sub-types are always non-null once
      created, so the new null sentinel object is intentionally unrelated
      to them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit a7c31816288a8f20fc387d69d441413e7a8c9ff1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Apr 29 15:35:04 2015 -0600

      qobject: Clean up around qtype_code

      QTYPE_NONE is a sentinel value.  No QObject has this type code.
      Document it properly.

      Fix dump_qobject() to abort() on QTYPE_NONE, just like for any other
      invalid type code.

      Fix to_json() to abort() on all invalid type codes, not just
      QTYPE_MAX.

      Clean up Property member qtype's type: it's a qtype_code.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 4cf2d837340589155acfda993c51e66eb5800416
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sat Apr 25 12:28:06 2015 -0300

      QJSON: Use OBJECT_CHECK

      The QJSON code used casts to (QJSON*) directly, instead of OBJECT_CHECK.
      There were even some functions using object_dynamic_cast() calls
      followed by assert(), which is exactly what OBJECT_CHECK does (by
      calling object_dynamic_cast_assert()).

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 9ad2c8cd41a086020e21aa6d616b73bd5e2a800b
  Merge: b951cda 0caef8f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 13:54:00 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-05-09' into staging

      trivial patches for 2015-05-09

      # gpg: Signature made Fri May  8 22:58:42 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-05-09:
        docs: update BLOCK_IMAGE_CORRUPTED documentation
        glib-compat.h: change assert to g_assert
        Remove various unused functions
        sheepdog: fix resource leak with sd_snapshot_create
        xhci: remove unused code

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3446a11181c6e8263dbd9c13c28986df4317099e
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:41:10 2015 +0200

      target-tricore: fix rfe not restoring the PC

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit bc72f8aaf23fa11833e0e04c10b5c0e1036c2609
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:39:18 2015 +0200

      target-tricore: fix rslcx restoring the upper context instead of the lower

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4959d6b3662d94a5add5811ba1ff5243116b8987
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue May 5 19:36:55 2015 +0200

      target-tricore: fix BO_OFF10_SEXT calculating the wrong offset

      The lower part of the combined offset was sign extended and could lead to
      wrong results.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 7bd0eaec311d188412123a034abb44595deb7dae
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Apr 3 14:29:22 2015 +0200

      target-tricore: fix SLR_LD_W and SLR_LD_W_POSTINC insn being a 2 byte memory access insted of 4

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 250ef8c76861c756354ed1c67f0a4524e5339369
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 9 16:04:46 2014 +0000

      target-tricore: Fix LOOP using wrong register for compare

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit b951cda21d6b232f138ccf008e12bce8ddc95465
  Merge: ec62ad1 ca44148
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 12:01:09 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - build bugfix from Fam and new configure check from Emilio
      - two improvements to "info mtere" from Gerd
      - KVM support for memory transaction attributes
      - one more small step towards unlocked MMIO dispatch
      - one piece of the qemu-nbd errno fixes
      - trivial-ish patches from Denis and Thomas

      # gpg: Signature made Fri May  8 13:47:29 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        qemu-nbd: only send a limited number of errno codes on the wire
        rules.mak: Force CFLAGS for all objects in DSO
        configure: require __thread support
        exec: move rcu_read_lock/unlock to address_space_translate callers
        kvm: add support for memory transaction attributes
        mtree: also print disabled regions
        mtree: tag & indent a bit better
        apic_common: improve readability of apic_reset_common
        kvm: Silence warning from valgrind

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ec62ad1e27ffd1f7ff2172a916d161cc385e73bd
  Merge: 4ae740c 1271f7f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 10:43:08 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150508-1' into staging

      gtk: add ui_info support, cleanups + fixes.

      # gpg: Signature made Fri May  8 12:47:04 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150508-1:
        gtk: update mouse position in mouse_set()
        gtk: create gtk.h
        gtk: add ui_info support
        console: add dpy_ui_info_supported
        console: delayed ui_info guest notification

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ae740cc0e4a123047b40c373e699e28031d420e
  Merge: fc85cf4 ca5a21c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon May 11 09:42:20 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150508-1' into staging

      usb: qomify, bugfixes for xhci & uhci.

      # gpg: Signature made Fri May  8 12:39:28 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150508-1:
        uhci: controller is halted after reset
        usb: usb-serial QOMify
        usb: usb-redir QOMify
        usb: usb-wacom-tablet QOMify
        usb: usb-uas QOMify
        usb: usb-storage QOMify
        usb: usb-ccid QOMify
        usb: usb-net QOMify
        usb-mtp: fix segmentation fault
        usb: usb-mtp QOMify
        usb: usb-hub QOMify
        usb: usb-hid QOMify
        usb: usb-bt QOMify
        usb: usb-audio QOMify
        uhci: QOMify
        xhci: fix events for setup trb.
        Revert "xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set"
        xhci: set timer to retry xfers
        usb: fix usb-net segfault

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc1f7c4c915a7c727741c4d27a2795e1039eacd3
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon May 11 09:21:37 2015 +0200

      acpi: update expected files for memory unplug

      commit c06b2ffb02bfcc642c67300d2c4dffd5aa54932b
          acpi: add hardware implementation for memory hot unplug

      Changed both the DSDT and the SSDT. Update the expected files
      accordingly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fc85cf4a8199a657fdfd5fb902f1835973406454
  Merge: f8340b3 3cda44f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun May 10 21:40:54 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150508' into staging

      Assorted s390x patches:
      - updates for virtio-ccw and s390-virtio, making them more similar
        to virtio-pci
      - improvements regarding per-vcpu interrupts and migration

      # gpg: Signature made Fri May  8 09:45:09 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150508:
        s390x/kvm: migrate vcpu interrupt state
        s390x: move fpu regs into a subsection of the vmstate
        s390x/kvm: use ioctl KVM_S390_IRQ for vcpu interrupts
        virtio-ccw: implement ->device_plugged
        virtio-ccw: change realization sequence
        s390-virtio: clear {used,avail}_event_idx on reset as well
        s390-virtio: use common features
        s390-virtio: Accommodate guests using virtqueues too early

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ca4414804114fd0095b317785bc0b51862e62ebb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu May 7 17:25:10 2015 +0200

      qemu-nbd: only send a limited number of errno codes on the wire

      Right now, NBD includes potentially platform-specific error values in
      the wire protocol.

      Luckily, most common error values are more or less universal: in
      particular, of all errno values <= 34 (up to ERANGE), they are all the
      same on supported platforms except for 11 (which is EAGAIN on Windows and
      Linux, but EDEADLK on Darwin and the *BSDs).  So, in order to guarantee
      some portability, only keep a handful of possible error codes and squash
      everything else to EINVAL.

      This patch defines a limited set of errno values that are valid for the
      NBD protocol, and specifies recommendations for what error to return
      in specific corner cases.  The set of errno values is roughly based on
      the errors listed in the read(2) and write(2) man pages, with some
      exceptions:

      - ENOMEM is added for servers that implement copy-on-write or other
        formats that require dynamic allocation.

      - EDQUOT is not part of the universal set of errors; it can be changed
        to ENOSPC on the wire format.

      - EFBIG is part of the universal set of errors, but it is also changed
        to ENOSPC because it is pretty similar to ENOSPC or EDQUOT.

      Incoming values will in general match system errno values, but not
      on the Hurd which has different errno values (they have a "subsystem
      code" equal to 0x10 in bits 24-31).  The Hurd is probably not something
      to which QEMU has been ported, but still do the right thing and
      reverse-map the NBD errno values to the system errno values.

      The corresponding patch to the NBD protocol description can be found at
      http://article.gmane.org/gmane.linux.drivers.nbd.general/3154.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d24697e1824467f3921c84a94f011f43d6466403
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu May 7 14:55:15 2015 +0800

      rules.mak: Force CFLAGS for all objects in DSO

      Because of the trick of process-archive-undefs, all .mo objects, even
      with --enable-modules, are dependencies of executables.

      This breaks CFLAGS propogation because the compiling of module object
      will happen too early before building for DSO.

      With GCC 5, the linking would fail because .o doesn't have -fPIC. Also,
      BUILD_DSO will be missed. (module-common.o will have it, so the stamp
      symbol was still liked in .so).

      Fix the problem by forcing the CFLAGS on individual .o-cflags during
      unnest-vars.

      Reported-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Cc: qemu-stable@nongnu.org # 2.3
      Message-Id: <1430981715-31465-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0caef8f6df4a9426bd6333ab843ce51ce005d7d0
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu May 7 17:58:26 2015 +0300

      docs: update BLOCK_IMAGE_CORRUPTED documentation

      Label the "size" and "offset" fields in BLOCK_IMAGE_CORRUPTED as
      optional, and clarify that the latter refers to the host's offset into
      the image.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f20f2a1f339b99f5b840367236ddce9d9736247c
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu May 7 13:38:02 2015 +0300

      glib-compat.h: change assert to g_assert

      include/glib-compat.h defines a bunch of functions based on glib primitives,
      and uses assert() without including assert.h.  Replace assert() with
      g_assert() to make the file more self-contained, and to fix compilation
      breakage after 28507a415a9b1e.

      Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

  commit ac9541579eb95b0b8c93ca58d0a074e1f22cd55a
  Author: Thomas Huth <huth@tuxfamily.org>
  Date:   Sun May 3 10:47:22 2015 +0200

      Remove various unused functions

      The functions tpm_backend_thread_tpm_reset() and iothread_find()
      are completely unused, let's remove them.

      Signed-off-by: Thomas Huth <huth@tuxfamily.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 973a8529c54f9e4410a0e4a18ca1dcb2b085ca7e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue May 5 09:48:03 2015 +0800

      sheepdog: fix resource leak with sd_snapshot_create

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e5a88b0cf3c902d6e9b342a90f0a4a4d5d954f7a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:03 2015 +0800

      xhci: remove unused code

      Value from xfer->packet.ep is assigned to ep here, but that
      stored value is not used before it is overwritten. Remove it.

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ca5a21c40d95d7a4e26ea0a304fd2cd8ad4e6ae1
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu May 7 09:24:00 2015 +0200

      uhci: controller is halted after reset

      ... and the status register should say so.

      Fixes "usbus0: controller did not stop" error printed by freebsd.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cdf0d7694d877f19936d7404fd10b580f6e9a9b1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:36 2015 +0800

      usb: usb-serial QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d371cbc778e1868b18faa8d6764602b1f4806100
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:35 2015 +0800

      usb: usb-redir QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 924e567e1e6641f4af7e927f9c420cc7b4464073
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:34 2015 +0800

      usb: usb-wacom-tablet QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b06d099b0ab9b055414508ca55133b200d675f8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:33 2015 +0800

      usb: usb-uas QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 79e2590cbf9887a99a65d2aa62da78c6dfd9cdb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:32 2015 +0800

      usb: usb-storage QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 61b4887b41b270bc837ead57bc502d904af023bb
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:31 2015 +0800

      usb: usb-ccid QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fe47db72210dc17b794954f978ef1d1236cbeb72
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:30 2015 +0800

      usb: usb-net QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e60baebd409d547292c778d599111ea1623dd4b5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:29 2015 +0800

      usb-mtp: fix segmentation fault

      When x-root property not be configured, will cause segfault
      because of null pointer accessing. Add a check for s->root
      property avoid segfault.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7c03a899e6e4030a88bd42c4d494e3a7521806ea
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:28 2015 +0800

      usb: usb-mtp QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e81b13ad94803bf13491bb71c8a76a5d7db9ddf1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:27 2015 +0800

      usb: usb-hub QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f56691295e38429bbfe476d57676c53bcb1fd437
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:26 2015 +0800

      usb: usb-hid QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a293e82bbef666f66be733993e276998319568e1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:25 2015 +0800

      usb: usb-bt QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0389a0b10967b639ac7444453274b910a4b6f2ed
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:24 2015 +0800

      usb: usb-audio QOMify

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49184b6253a50385c5e934cc4eb813b79cc956f2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed May 6 20:55:23 2015 +0800

      uhci: QOMify

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit df0f1692db9236a469496cc09fc7bd5faf31efad
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:31:44 2015 +0200

      xhci: fix events for setup trb.

      When we find a IOC bit set on a setup trb and therefore queue an event,
      that should not stop events being generated for following data trbs.
      So clear the 'reported' flag.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88dbed3f5946b74cf02c1bb0082b8c50037720ea
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:19:35 2015 +0200

      Revert "xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set"

      This makes xhci generate multiple short packet events in case of
      multi-trb transfers.  Which is wrong.  We need to fix this in a
      different way.

      This reverts commit aa6857891df614c620e6e9fc4bc4af6e0e49cafd.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4e8cfbe1143d8384387595b500212d7a7f11aeae
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 28 09:19:14 2015 +0200

      xhci: set timer to retry xfers

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e
  Author: Michal Kazior <michal.kazior@tieto.com>
  Date:   Wed Apr 29 11:34:59 2015 +0000

      usb: fix usb-net segfault

      The dev->config pointer isn't set until guest
      system initializes usb devices (via
      usb_desc_set_config). However qemu networking can
      go through some motions prior to that, e.g.:

       #0  is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653
       #1  0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315
       #2  0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470
       #3  0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101
       #4  0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470
       #5  0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172

      The command to reproduce most reliably was:

       qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0

      This wasn't strictly a problem with tap. Other
      networking endpoints (vde, user) could trigger
      this problem as well.

      Fixes: https://bugs.launchpad.net/qemu/+bug/1050823
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 768b7855c86c4f46b605183ae9451e9af64ca288
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Wed Apr 29 13:09:02 2015 +0200

      configure: require __thread support

      The codebase doesn't build without __thread support.
      Formalise this requirement by adding a check for it in the
      configure script.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3cda44f7bae5c9feddc11630ba6eecb2e3bed425
  Author: Jens Freimann <jfrei@linux.vnet.ibm.com>
  Date:   Mon Mar 2 17:44:24 2015 +0100

      s390x/kvm: migrate vcpu interrupt state

      This patch adds support to migrate vcpu interrupts.
      We use ioctl KVM_S390_GET_IRQ_STATE and _SET_IRQ_STATE
      to get/set the complete interrupt state for a vcpu.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 46c804def4bda2491c546e8e33b86fe4981e4b68
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Mon Mar 30 13:22:47 2015 +0200

      s390x: move fpu regs into a subsection of the vmstate

      Let's move the floating point registers into a seperate subsection and
      bump up the version id. This cleans up the current vmstate and will
      allow for a future extension with vector registers in a compatible way.

      This patch is based on a patch from Eric Farman.

      Reviewed-by: Eric Farman <farman@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 1191c94963f36b3f9631fcd1ec2e9296631b407e
  Author: Jens Freimann <jfrei@linux.vnet.ibm.com>
  Date:   Thu Dec 18 17:38:05 2014 +0100

      s390x/kvm: use ioctl KVM_S390_IRQ for vcpu interrupts

      KVM_S390_INT uses only two parameter fields. This is not
      enough to pass all required information for certain interrupts.

      A new ioctl KVM_S390_IRQ is available which allows us to
      inject all local interrupts as defined in the Principles of
      Operation. It takes a struct kvm_s390_irq as a parameter
      which can store interrupt payload data for all interrupts.

      Let's use the new ioctl for injecting vcpu interrupts.

      Tested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fb846a094fdee7bb6a88b48aeed0d97a8080a20d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Apr 21 16:36:56 2015 +0200

      virtio-ccw: implement ->device_plugged

      Let's move operations that are only valid after the backend has been
      realized to a ->device_plugged callback, just as virtio-pci does.
      Also reorder setting up the host feature bits to the sequence used
      by virtio-pci.

      While we're at it, also add a ->device_unplugged callback to stop
      ioeventfd, just to be on the safe side.

      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1429627016-30656-3-git-send-email-cornelia.huck@de.ibm.com>

  commit 1fa755234e24697cc76f326782edbb09bd0a3a53
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Apr 21 16:36:55 2015 +0200

      virtio-ccw: change realization sequence

      virtio-ccw has an odd sequence of realizing devices: first the
      device-specific relization (net, block, ...), then the generic
      realization. It feels less odd to have the generic realization
      callback trigger the device-specific realization instead (and this
      also matches what virtio-pci does).

      One thing to note: We need to defer initializing the cu model in the
      sense id data until after the device-specific realization has been
      performed, as we need to refer to the virtio device's device_id.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1429627016-30656-2-git-send-email-cornelia.huck@de.ibm.com>

  commit 77ae0b2a6e731ab7b97e9fae401c579397edb31c
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon May 4 15:27:25 2015 +0200

      s390-virtio: clear {used,avail}_event_idx on reset as well

      The old s390-virtio transport clears the vring used/avail indices in
      the shared area on reset. When we enabled event_idx for virtio-blk, we
      noticed that this is not enough: We also need to clear the published
      used/avail event indices, or reboot will fail.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f50616a81b7f88a9adac16f3ea0236311a748eca
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Apr 29 15:30:58 2015 +0200

      s390-virtio: use common features

      We used to avoid enabling event_idx for virtio-blk devices via
      s390-virtio, but we now have a workaround in place for guests trying
      to use the device before setting DRIVER_OK. Therefore, let's add
      DEFINE_VIRTIO_COMMON_FEATURES to the base device so all devices get
      those common features - and make s390-virtio use the same mechanism
      as the other transports do.

      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit cb927b8aee7c3993a43cb829f7341071f873857b
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Apr 30 17:53:13 2015 +0200

      s390-virtio: Accommodate guests using virtqueues too early

      Feature updates are not a synchronuous operation for the legacy
      s390-virtio transport. This transport syncs the guest feature bits
      (those from finalize) on the set_status hypercall. Before that qemu
      thinks that features are zero, which means QEMU will misbehave, e.g.
      it will not write the event index, even if the guest asks for it.

      Let's detect the case where a kick happens before the driver is ready
      and force sync the features.
      With this workaround, it is now safe to switch to the common feature
      bit handling code as used by all other transports.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f8340b360b9bc29d48716ba8aca79df2b9544979
  Author: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
  Date:   Wed Sep 10 18:33:58 2014 +1000

      hw/ptimer: Do not artificially limit timers when using icount

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 838686357b1a175e9a32569700a153b207a9e10f
  Merge: 38003ae 362ba4e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu May 7 18:22:03 2015 +0100

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150507-1' into staging

      migration/next for 20150507

      # gpg: Signature made Thu May  7 17:42:19 2015 BST using RSA key ID 5872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"

      * remotes/juanquintela/tags/migration/20150507-1:
        migration: Fix migration state update issue
        migration: avoid divide by zero in xbzrle cache miss rate
        migration: Add hmp interface to set and query parameters
        migration: Add qmp commands to set and query parameters
        migration: Use an array instead of 3 parameters
        migration: Add interface to control compression
        migration: Add the core code for decompression
        migration: Make compression co-work with xbzrle
        migration: Add the core code of multi-thread compression
        migration: Split save_zero_page from ram_save_page
        arch_init: Add and free data struct for decompression
        arch_init: Alloc and free data struct for compression
        qemu-file: Add compression functions to QEMUFile
        migration: Add the framework of multi-thread decompression
        migration: Add the framework of multi-thread compression
        docs: Add a doc about multiple thread compression

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 362ba4e3ee801e8f5e28d72d0009547384222927
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Fri May 8 02:31:22 2015 +0800

      migration: Fix migration state update issue

      If live migration is very fast and can be completed in 1 second,
      the dirty_sync_count of MigrationState will not be updated.
      Then you will see "dirty sync count: 0" in qemu monitor even if
      the actual dirty sync count is not 0.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 27ff42e29a1d12e9d9dbc473bbca36a50baf278b
  Author: Michael Chapman <mike@very.puzzling.org>
  Date:   Wed Apr 15 13:59:14 2015 +1000

      migration: avoid divide by zero in xbzrle cache miss rate

      This bug manifested itself as a VM that could not be resumed by libvirt
      following a migration:

        # virsh resume example
        error: Failed to resume domain example
        error: internal error: cannot parse json {"return":
          {"xbzrle-cache":
            {..., "cache-miss-rate": -nan, ...},
            ...
          }
        }: lexical error: malformed number, a digit is required after the minus sign.

      This patch also ensures xbzrle_cache_miss_prev and iterations_prev are
      cleared at the start of the migration.

      Signed-off-by: Michael Chapman <mike@very.puzzling.org>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 50e9a629c6c92e73260cd3d7c2e3f5bfd84e47e2
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:29 2015 +0800

      migration: Add hmp interface to set and query parameters

      Add the hmp interface to tune and query the parameters used in
      live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 85de83231ecde075c6b25897f2e74cd1767880e3
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:28 2015 +0800

      migration: Add qmp commands to set and query parameters

      Add the qmp commands to tune and query the parameters used in live
      migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 43c60a81ba15ea040709be5809a279a4ca59b26b
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:27 2015 +0800

      migration: Use an array instead of 3 parameters

      Put the three parameters related to multiple thread (de)compression
      into an int array, and use an enum type to index the parameter.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit dde4e694ae576462990b2ce711e62565e085c261
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:26 2015 +0800

      migration: Add interface to control compression

      The multiple compression threads can be turned on/off through
      qmp and hmp interface before doing live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 68ae113646dc84637359472e89669e5547dc5ee3
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:25 2015 +0800

      migration: Add the core code for decompression

      Implement the core logic of multiple thread decompression,
      the decompression can work now.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 98f1138902195bd9ab8a753d0ee2cf2a0a88b6e8
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:24 2015 +0800

      migration: Make compression co-work with xbzrle

      Now, multiple thread compression can co-work with xbzrle. when
      xbzrle is on, multiple thread compression will only work at the
      first round of RAM data sync.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 20eb617eacf7a0ce76d9dd10ff246d6ae7f0b4e1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:23 2015 +0800

      migration: Add the core code of multi-thread compression

      Implement the core logic of the multiple thread compression. At this
      point, multiple thread compression can't co-work with xbzrle yet.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e2102428c09901788a5e585f32f9e805137f5967
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:22 2015 +0800

      migration: Split save_zero_page from ram_save_page

      Split the function save_zero_page from ram_save_page so that we can
      reuse it later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3caf633dbde8a347cff49e960691c7fa6a82afa1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:21 2015 +0800

      arch_init: Add and free data struct for decompression

      Define the data structure and variables used to do multiple thread
      decompression, and add the code to initialize and free them.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 474ddaf6e3aebc470f4665ef4f7ce6578448c6d1
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:20 2015 +0800

      arch_init: Alloc and free data struct for compression

      Define the data structure and variables used to do multiple thread
      compression, and add the code to initialize and free them.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 44f0eadc338f55d3bffe4fccefb1d4241defa418
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:19 2015 +0800

      qemu-file: Add compression functions to QEMUFile

      qemu_put_compression_data() compress the data and put it to QEMUFile.
      qemu_put_qemu_file() put the data in the buffer of source QEMUFile to
      destination QEMUFile.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3fcb38c223510cf88c6101f5d218ce0840d1354c
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:18 2015 +0800

      migration: Add the framework of multi-thread decompression

      Add the code to create and destroy the multiple threads those will be
      used to do data decompression. Left some functions empty just to keep
      clearness, and the code will be added later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8706d2d566cbf4bad2c5597bb57358e3d5f5caf0
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:17 2015 +0800

      migration: Add the framework of multi-thread compression

      Add the code to create and destroy the multiple threads those will
      be used to do data compression. Left some functions empty to keep
      clearness, and the code will be added later.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 263170e679dfb456f8812a0100073990586cecb5
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Mon Mar 23 16:32:16 2015 +0800

      docs: Add a doc about multiple thread compression

      Give some details about the multiple thread (de)compression and
      how to use it in live migration.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
      Reviewed-by: Dr.David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 38003aee196a96edccd4d64471beb1b67e9b2b17
  Merge: 233353e 00c8fa9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed May 6 11:16:35 2015 +0100

      Merge remote-tracking branch 'remotes/rth/tags/tcg-next-20150505' into staging

      size reduction merge

      # gpg: Signature made Wed May  6 00:21:43 2015 BST using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-next-20150505:
        tcg: optimise memory layout of TCGTemp

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1271f7f7c60e0b0a3cc031921008a69dfd53bd34
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 1 19:12:45 2014 +0200

      gtk: update mouse position in mouse_set()

      Without that the next mouse motion event uses the old position
      as base for relative move calculation, giving wrong results and
      making your mouse pointer jump around.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit dc7ff344187db6a94294a87d63cf8332e8ed0e6f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Mar 4 15:37:27 2015 +0100

      gtk: create gtk.h

      Move various gtk bits (includes, data structures) to a header file.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1301e515eff267d4b8684e74a5b2c1b5cf03f103
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:47:00 2015 +0100

      gtk: add ui_info support

      Pass new display size to the guest after window resizes.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b7fb49f0c709a406f79372be397367ff2550373b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Mar 13 12:21:14 2015 +0100

      console: add dpy_ui_info_supported

      Allow ui code to check whenever the emulated
      display supports display change notifications.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf1ecc82ab84dbfb4b6eea02c329bf9c2aa856ec
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Mar 12 12:51:13 2015 +0100

      console: delayed ui_info guest notification

      So we don't flood the guest with display change notifications
      while the user resizes the window.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 233353ec93e4541fa7ab1c53a922a6d5c2bfce7a
  Merge: 874e9ae ff55d72
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 18:22:12 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-qmp-2015-05-05' into staging

      drop qapi nested structs

      # gpg: Signature made Tue May  5 17:40:40 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-qmp-2015-05-05: (40 commits)
        qapi: Check for member name conflicts with a base class
        qapi: Support (subset of) \u escapes in strings
        qapi: Tweak doc references to QMP when QGA is also meant
        qapi: Drop dead visitor code related to nested structs
        qapi: Drop support for inline nested types
        qapi: Drop inline nested structs in query-pci
        qapi: Drop inline nested struct in query-version
        qapi: Drop tests for inline nested structs
        qapi: Merge UserDefTwo and UserDefNested in tests
        qapi: Forbid 'type' in schema
        qapi: Use 'struct' instead of 'type' in schema
        qapi: Document 'struct' metatype
        qapi: Prefer 'struct' over 'type' in generator
        qapi: More rigorous checking for type safety bypass
        qapi: Whitelist commands that don't return dictionary
        qapi: Require valid names
        qapi: More rigourous checking of types
        qapi: Add some type check tests
        qapi: Unify type bypass and add tests
        qapi: Allow true, false and null in schema json
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff55d72eaf9628e7d58e7b067b361cdbf789c9f4
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:37 2015 -0600

      qapi: Check for member name conflicts with a base class

      Our type inheritance for both 'struct' and for flat 'union' merges
      key/value pairs from the base class with those from the type in
      question.  Although the C code currently boxes things so that there
      is a distinction between which member is referred to, the QMP wire
      format does not allow passing a key more than once in a single
      object.  Besides, if we ever change the generated C code to not be
      quite so boxy, we'd want to avoid duplicate member names there,
      too.

      Fix a testsuite entry added in an earlier patch, as well as adding
      a couple more tests to ensure we have appropriate coverage.  Ensure
      that collisions are detected, regardless of whether there is a
      difference in opinion on whether the member name is optional.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a7f5966b297330f6492020019544ae87c45d699b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:36 2015 -0600

      qapi: Support (subset of) \u escapes in strings

      The handling of \ inside QAPI strings was less than ideal, and
      really only worked JSON's \/, \\, \", and our extension of \'
      (an obvious extension, when you realize we use '' instead of ""
      for strings).  For other things, like '\n', it resulted in a
      literal 'n' instead of a newline.

      Of course, at the moment, we really have no use for escaped
      characters, as QAPI has to map to C identifiers, and we currently
      support ASCII only for that.  But down the road, we may add
      support for default values for string parameters to a command
      or struct; if that happens, it would be nice to correctly support
      all JSON escape sequences, such as \n or \uXXXX.  This gets us
      closer, by supporting Unicode escapes in the ASCII range.

      Since JSON does not require \OCTAL or \xXX escapes, and our QMP
      implementation does not understand them either, I intentionally
      reject it here, but it would be an easy addition if we desired it.
      Likewise, intentionally refusing the NUL byte means we don't have
      to worry about C strings being shorter than the qapi input.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 363b4262a10a52f6d7ac1073bab5e6648da4051b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:35 2015 -0600

      qapi: Tweak doc references to QMP when QGA is also meant

      We have more than one qapi schema in use by more than one protocol.
      Add a new term 'Client JSON Protocol' for use throughout the
      document, to avoid confusion on whether something refers only to
      QMP and not QGA.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a82b982e2bddf7cd7cb490f83643e952e17d4523
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:34 2015 -0600

      qapi: Drop dead visitor code related to nested structs

      Now that we no longer have nested structs to visit, the use of
      prefix strings is no longer required.  Remove the code that is
      no longer reachable.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6b5abc7df7ef9aadb3ff0eba6ccf4f1f0181e2e1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:33 2015 -0600

      qapi: Drop support for inline nested types

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit messages for more details why); but existing
      use of inline nested structs conflicts with that goal. Now that
      all commands have been changed to avoid inline nested structs,
      nuke support for them, and turn it into a hard error. Update the
      testsuite to reflect tighter parsing rules.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 9fa02cd194a131aca75ab646ece975b6835400e1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:32 2015 -0600

      qapi: Drop inline nested structs in query-pci

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit message for more details why); but existing
      use of inline nested structs conflicts with that goal. This patch
      fixes one of only two commands relying on nested types, by
      breaking the nesting into an explicit type; it means that the
      type is now boxed instead of unboxed in C code, but the QMP wire
      format is unaffected by this change.

      Prefer the safer g_new0() while making the conversion, and reduce
      some long lines.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 4752cdbbf330ac7c593a6f337b97a79648f3f878
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:31 2015 -0600

      qapi: Drop inline nested struct in query-version

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument
      (see previous commit message for more details why); but existing
      use of inline nested structs conflicts with that goal. This patch
      fixes one of only two commands relying on nested types, by
      breaking the nesting into an explicit type; it means that the
      type is now boxed instead of unboxed in C code, but the QMP wire
      format is unaffected by this change.

      Prefer the safer g_new0() while making the conversion.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6446a592760155bb3e2e248d56bab97a34af0336
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:30 2015 -0600

      qapi: Drop tests for inline nested structs

      A future patch will be using a 'name':{dictionary} entry in the
      QAPI schema to specify a default value for an optional argument;
      but existing use of inline nested structs conflicts with that goal.

      More precisely, a definition in the QAPI schema associates a name
      with a set of properties:

      Example 1: { 'struct': 'Foo', 'data': { MEMBERS... } }
      associates the global name 'Foo' with properties (meta-type struct)
      and MEMBERS...

      Example 2: 'mumble': TYPE
      within MEMBERS... above associates 'mumble' with properties (type
      TYPE) and (optional false) within type Foo

      The syntax of example 1 is extensible; if we need another property,
      we add another name/value pair to the dictionary (such as
      'base':TYPE).  The syntax of example 2 is not extensible, because
      the right hand side can only be a type.

      We have used name encoding to add a property: "'*mumble': 'int'"
      associates 'mumble' with (type int) and (optional true).  Nice,
      but doesn't scale.  So the solution is to change our existing uses
      to be syntactic sugar to an extensible form:

         NAME: TYPE   --> NAME:  { 'type': TYPE, 'optional': false }
         *ONAME: TYPE --> ONAME: { 'type': TYPE, 'optional': true }

      This patch fixes the testsuite to avoid inline nested types, by
      breaking the nesting into explicit types; it means that the type
      is now boxed instead of unboxed in C code, but makes no difference
      on the wire (and if desired, a later patch could change the
      generator to not do so much boxing in C).  When touching code to
      add new allocations, also convert existing allocations to
      consistently prefer typesafe g_new0 over g_malloc0 when a type
      name is involved.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit b6fcf32d9b851a83dedcb609091236b97cc4a985
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:29 2015 -0600

      qapi: Merge UserDefTwo and UserDefNested in tests

      In the testsuite, UserDefTwo and UserDefNested were identical
      structs other than the member names.  Reduce code duplication by
      having just one type, and choose names that also favor reuse.
      This will also make it easier for a later patch to get rid of
      inline nested types in QAPI.  When touching code related to
      allocations, convert g_malloc0(sizeof(Type)) to the more typesafe
      g_new0(Type, 1).

      Ensure that 'make check-qapi-schema check-unit' still passes.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3e391d355644b2bff7c9f187759aadb46c6e051f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:28 2015 -0600

      qapi: Forbid 'type' in schema

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Finish up the
      conversion to using "struct" in qapi schema by removing the hack
      in the generator that allowed 'type'.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 895a2a80e0e054f0d5d3715aa93d10d15e49f9f7
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:27 2015 -0600

      qapi: Use 'struct' instead of 'type' in schema

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Do the bulk of
      the conversion to "struct" in qapi schema, with a fairly
      mechanical:

      for f in `find -name '*.json'; do sed -i "s/'type'/'struct'/"; done

      followed by manually filtering out the places where we have a
      'type' embedded in 'data'.  Then tweak a couple of tests whose
      output changes slightly due to longer lines.

      I also verified that the generated files for QMP and QGA (such
      as qmp-commands.h) are the same before and after, as assurance
      that I didn't leave in any accidental member name changes.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3b2a8b85322f3677525a65c0b35deadf45fb704b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:26 2015 -0600

      qapi: Document 'struct' metatype

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  Now that the
      generator accepts 'struct' as a synonym for 'type', update all
      documentation to use saner wording.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fd41dd4eae5f7ea92f10c04cb3f217727fcee91f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:25 2015 -0600

      qapi: Prefer 'struct' over 'type' in generator

      Referring to "type" as both a meta-type (built-in, enum, union,
      alternate, or struct) and a specific type (the name that the
      schema uses for declaring structs) is confusing.  The confusion
      is only made worse by the fact that the generator mostly already
      refers to struct even when dealing with expr['type'].  This
      commit changes the generator to consistently refer to it as
      struct everywhere, plus a single back-compat tweak that allows
      accepting the existing .json files as-is, so that the meat of
      this change is separate from the mindless churn of that change.

      Fix the testsuite fallout for error messages that change, and
      in some cases, become more legible.  Improve comments to better
      match our intentions where a struct (rather than any complex
      type) is required.  Note that in some cases, an error message
      now refers to 'struct' while the schema still refers to 'type';
      that will be cleaned up in the later commit to the schema.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 2cbf09925ad45401673a79ab77f67de2f04a826c
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:24 2015 -0600

      qapi: More rigorous checking for type safety bypass

      Now that we have a way to validate every type, we can also be
      stricter about enforcing that callers that want to bypass
      type safety in generated code.  Prior to this patch, it didn't
      matter what value was associated with the key 'gen', but it
      looked odd that 'gen':'yes' could result in bypassing the
      generated code.  These changes also enforce the changes made
      earlier in the series for documentation and consolidation of
      using '**' as the wildcard type, as well as 'gen':false as the
      canonical spelling for requesting type bypass.

      Note that 'gen':false is a one-way switch away from the default;
      we do not support 'gen':true (similar for 'success-response').
      In practice, this doesn't matter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 10d4d997f86cf2a4ce89145df5658952d5722e56
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:23 2015 -0600

      qapi: Whitelist commands that don't return dictionary

      ...or an array of dictionaries.  Although we have to cater to
      existing commands, returning a non-dictionary means the command
      is not extensible (no new name/value pairs can be added if more
      information must be returned in parallel).  By making the
      whitelist explicit, any new command that falls foul of this
      practice will have to be self-documenting, which will encourage
      developers to either justify the action or rework the design to
      use a dictionary after all.

      It's a little bit sloppy that we share a single whitelist among
      three clients (it's too permissive for each).  If this is a
      problem, a future patch could tighten things by having the
      generator take the whitelist as an argument (as in
      scripts/qapi-commands.py --legacy-returns=...), or by having
      the generator output C code that requires explicit use of the
      whitelist (as in:
       #ifndef FROBNICATE_LEGACY_RETURN_OK
       # error Command 'frobnicate' should return a dictionary
       #endif
      then having the callers define appropriate macros).  But until
      we need such fine-grained separation (if ever), this patch does
      the job just fine.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c9e0a798691d8c45747b082206e789c8f50523c9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:22 2015 -0600

      qapi: Require valid names

      Previous commits demonstrated that the generator overlooked various
      bad naming situations:
      - types, commands, and events need a valid name
      - enum members must be valid names, when combined with prefix
      - union and alternate branches cannot be marked optional

      Valid upstream names match [a-zA-Z][a-zA-Z0-9_-]*; valid downstream
      names match __[a-zA-Z][a-zA-Z0-9._-]*.  Enumerations match the
      weaker [a-zA-Z0-9._-]+ (in part thanks to QKeyCode picking an enum
      that starts with a digit, which we can't change now due to
      backwards compatibility).  Rather than call out three separate
      regex, this patch just uses a broader combination that allows both
      upstream and downstream names, as well as a small hack that
      realizes that any enum name is merely a suffix to an already valid
      name prefix (that is, any enum name is valid if prepending _ fits
      the normal rules).

      We could reject new enumeration names beginning with a digit by
      whitelisting existing exceptions.  We could also be stricter
      about the distinction between upstream names (no leading
      underscore, no use of dot) and downstream (mandatory leading
      double underscore), but it is probably not worth the bother.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit dd883c6f0547f02ae805d02852ff3691f6d08f85
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:21 2015 -0600

      qapi: More rigourous checking of types

      Now that we know every expression is valid with regards to
      its keys, we can add further tests that those keys refer to
      valid types.  With this patch, all uses of a type (the 'data':
      of command, type, union, alternate, and event; the 'returns':
      of command; the 'base': of type and union) must resolve to an
      appropriate subset of metatypes  declared by the current qapi
      parse; this includes recursing into each member of a data
      dictionary.  Dealing with '**' and nested anonymous structs
      will be done in later patches.

      Update the testsuite to match improved output.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0d8b9fb5f296a96723d98a45a6a00bfd4e45e1b9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:20 2015 -0600

      qapi: Add some type check tests

      Demonstrate that the qapi generator silently parses confusing
      types, which may cause other errors later on. Later patches
      will update the expected results as the generator is made stricter.

      Most of the new tests focus on blatant errors.  But
      returns-whitelist is a case where we have historically allowed
      returning something other than a JSON object from particular
      commands; we have to keep that behavior to avoid breaking clients,
      but it would be nicer to avoid adding such commands in the future,
      because any return that is not an (array of) object cannot be
      easily extended if future qemu wants to return additional
      information.  The QMP protocol already documents that clients
      should ignore unknown dictionary keys, but does not require
      clients to have to handle more than one type of JSON object.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d708cdbe8792a55f53e90c1c787e871d527e8d4b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:19 2015 -0600

      qapi: Unify type bypass and add tests

      For a few QMP commands, we are forced to pass an arbitrary type
      without tracking it properly in QAPI.  Among the existing clients,
      this unnamed type was spelled 'dict', 'visitor', and '**'; this
      patch standardizes on '**', matching the documentation changes
      earlier in the series.

      Meanwhile, for the 'gen' key, we have been ignoring the value,
      although the schema consistently used "'no'" ('success-response'
      was hard-coded to checking for 'no').  But now that we can support
      a literal "false" in the schema, we might as well use that rather
      than ignoring the value or special-casing a random string.  Note
      that these are one-way switches (use of 'gen':true is not the same
      as omitting 'gen'). Also, the use of '**' requires 'gen':false,
      but the use of 'gen':false does not mandate the use of '**'.

      There is no difference to the generated code.  Add some tests on
      what we'd like to guarantee, although it will take later patches
      to clean up test results and actually enforce the use of a bool
      parameter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e53188ada516c814a729551be2448684d6d8ce08
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon May 4 09:05:18 2015 -0600

      qapi: Allow true, false and null in schema json

      In the near term, we will use it for a sensible-looking
      'gen':false inside command declarations, instead of the
      current ugly 'gen':'no'.

      In the long term, it will allow conversion from shorthand
      with defaults mentioned only in side-band documentation:
       'data':{'*flag':'bool', '*string':'str'}
      into an explicit default value documentation, as in:
       'data':{'flag':{'type':'bool', 'optional':true, 'default':true},
               'string':{'type':'str', 'optional':true, 'default':null}}

      We still don't parse integer values (also necessary before
      we can allow explicit defaults), but that can come in a later
      series.

      Update the testsuite to match an improved error message.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 4dc2e6906e1084fdd37bf67385c5dcd2c72ae22b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:17 2015 -0600

      qapi: Better error messages for duplicated expressions

      The previous commit demonstrated that the generator overlooked
      duplicate expressions:
      - a complex type or command reusing a built-in type name
      - redeclaration of a type name, whether by the same or different
      metatype
      - redeclaration of a command or event
      - collision of a type with implicit 'Kind' enum for a union
      - collision with an implicit MAX enum constant

      Since the c_type() function in the generator treats all names
      as being in the same namespace, this patch adds a global array
      to track all known names and their source, to prevent collisions
      before it can cause further problems.  While valid .json files
      won't trigger any of these cases, we might as well be nicer to
      developers that make a typo while trying to add new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cfdd5bcad515a8371af59dba9625e31a6f6f733e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:16 2015 -0600

      qapi: Add tests of redefined expressions

      Demonstrate that the qapi generator doesn't deal very well with
      redefined expressions.  At the parse level, they are silently
      accepted; and while the testsuite just stops at parsing, I've
      further tested that many of them cause generator crashes or
      invalid C code if they were appended to qapi-schema-test.json.
      A later patch will tighten things up and adjust the testsuite
      to match.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 0545f6b8874c28d97369f2c83e5077e0461d4f12
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:15 2015 -0600

      qapi: Better error messages for bad expressions

      The previous commit demonstrated that the generator overlooked some
      fairly basic broken expressions:
      - missing metataype
      - metatype key has a non-string value
      - unknown key in relation to the metatype
      - conflicting metatype (this patch treats the second metatype as an
      unknown key of the first key visited, which is not necessarily the
      first key the user typed)

      Add check_keys to cover these situations, and update testcases to
      match.  A couple other tests (enum-missing-data, indented-expr) had
      to change since the validation added here occurs so early.
      Conversely, changes to ident-with-escape results show that we still
      have problems where our handling of escape sequences differs from
      true JSON, which will matter down the road if we allow arbitrary
      default string values for optional parameters (but for now is not
      too bad, as we currently can avoid unicode escaping as we don't
      need to represent anything beyond C identifier material).

      While valid .json files won't trigger any of these cases, we might
      as well be nicer to developers that make a typo while trying to add
      new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 9050c65b71ac1d197330e6db221f63189e21bad5
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:14 2015 -0600

      qapi: Add some expr tests

      Demonstrate that the qapi generator doesn't deal well with
      expressions that aren't up to par. Later patches will improve
      the expected results as the generator is made stricter.  Only
      a few of the the added tests actually behave sanely at
      rejecting obvious problems or demonstrating success.

      Note that in some cases, we reject bad QAPI merely because our
      pseudo-JSON parser does not yet know how to parse numbers.  This
      series does not address that, but when a later series adds support
      for numeric defaults of integer fields, the testsuite will ensure
      that we don't lose the error (and hopefully that the error
      message quality is improved).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ab916faddd16f0165e9cc2551f90699be8efde53
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:13 2015 -0600

      qapi: Use 'alternate' to replace anonymous union

      Previous patches have led up to the point where I create the
      new meta-type "'alternate':'Foo'".  See the previous patches
      for documentation; I intentionally split as much work into
      earlier patches to minimize the size of this patch, but a lot
      of it is churn due to testsuite fallout after updating to the
      new type.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 7b1b98c420355ccea98d8bd55c9193ee6b7cef97
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:12 2015 -0600

      qapi: Document new 'alternate' meta-type

      The next patch will quit special-casing "'union':'Foo',
      'discriminator':{}" and instead use "'alternate':'Foo'".

      Separating docs from implementation makes it easier to focus
      on wording without holding up code.  In particular, making
      alternate a separate type makes for a nice type hierarchy:

                /-------- meta-type ------\
               /              |            \
          simple types    alternate     complex types
          |         |                   |           |
       built-in   enum             type(struct)   union
       |       \    /                            /    \
      numeric  string                         simple  flat

      A later patch will then clean up 'type' vs. 'struct'
      confusion.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ab045267447d52e63a79c0e18f89ae4411f5420b
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:11 2015 -0600

      qapi: Rename anonymous union type in test

      Reduce churn in the future patch that replaces anonymous unions
      with a new metatype 'alternate' by changing 'AnonUnion' to
      'Alternate'.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 811d04fd0cff1229480d3f5b2e349f646ab6e3c1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:10 2015 -0600

      qapi: Segregate anonymous unions into alternates in generator

      Special-casing 'discriminator == {}' for handling anonymous unions
      is getting awkward; since this particular type is not always a
      dictionary on the wire, it is easier to treat it as a completely
      different class of type, "alternate", so that if a type is listed
      in the union_types array, we know it is not an anonymous union.

      This patch just further segregates union handling, to make sure that
      anonymous unions are not stored in union_types, and splitting up
      check_union() into separate functions.  A future patch will change
      the qapi grammar, and having the segregation already in place will
      make it easier to deal with the distinct meta-type.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 268a1c5eb10832c2e4476d3fe199ea547dabecb7
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:09 2015 -0600

      qapi: Prepare for catching more semantic parse errors

      This patch widens the scope of a try block (with the attending
      reindentation required by Python) in preparation for a future
      patch adding more instances of QAPIExprError inside the block.
      It's easier to separate indentation from semantic changes, so
      this patch has no real behavior change.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 44bd1276a7dea747c41f250cb71ab65965343a7f
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:08 2015 -0600

      qapi: Tighten checking of unions

      Previous commits demonstrated that the generator had several
      flaws with less-than-perfect unions:
      - a simple union that listed the same branch twice (or two variant
      names that map to the same C enumerator, including the implicit
      MAX sentinel) ended up generating invalid C code
      - an anonymous union that listed two branches with the same qtype
      ended up generating invalid C code
      - the generator crashed on anonymous union attempts to use an
      array type
      - the generator was silently ignoring a base type for anonymous
      unions
      - the generator allowed unknown types or nested anonymous unions
      as a branch in an anonymous union

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit a8d4a2e4d7e1a0207699de47142c9bdbf2cc8675
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:07 2015 -0600

      qapi: Forbid base without discriminator in unions

      None of the existing QMP or QGA interfaces uses a union with a
      base type but no discriminator; it is easier to avoid this in the
      generator to save room for other future extensions more likely to
      be useful.  An earlier commit added a union-base-no-discriminator
      test to ensure that we eventually give a decent error message;
      likewise, removing UserDefUnion outright is okay, because we moved
      all the tests we wish to keep into the tests of the simple union
      UserDefNativeListUnion in the previous commit.  Now is the time to
      actually forbid simple union with base, and remove the last
      vestiges from the testsuite.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 805017b7791200f1b72deef17dc98fd272b941eb
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:06 2015 -0600

      qapi: Clean up test coverage of simple unions

      The tests of UserDefNativeListUnion serve to validate code
      generation of simple unions without a base type, except that it
      did not have full coverage in the strict test.  The next commits
      will remove tests and support for simple unions with a base type,
      so there is no real loss at repurposing that test here as
      opposed to churn of adding a new test then deleting the old one.

      Fix some indentation and long lines while at it.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3d0c48292633260269cb21551d9bab006b2f2781
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:05 2015 -0600

      qapi: Add some union tests

      Demonstrate that the qapi generator doesn't deal well with unions
      that aren't up to par. Later patches will update the expected
      reseults as the generator is made stricter.  A few tests work
      as planned, but most show poor or missing error messages.

      Of particular note, qapi-code-gen.txt documents 'base' only for
      flat unions, but the tests here demonstrate that we currently allow
      a 'base' to a simple union, although it is exercised only in the
      testsuite.  Later patches will remove this undocumented feature, to
      give us more flexibility in adding other future extensions to union
      types.  For example, one possible extension is the idea of a
      type-safe simple enum, where added fields tie the discriminator to
      a user-defined enum type rather than creating an implicit enum from
      the names in 'data'.  But adding such safety on top of a simple
      enum with a base type could look ambiguous with a flat enum;
      besides, the documentation also mentions how any simple union can
      be represented by an equivalent flat union.  So it will be simpler
      to just outlaw support for something we aren't using.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cf3935907b5df16f667d54ad6761c7e937dcf425
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:04 2015 -0600

      qapi: Better error messages for bad enums

      The previous commit demonstrated that the generator had several
      flaws with less-than-perfect enums:
      - an enum that listed the same string twice (or two variant
      strings that map to the same C enumerator) ended up generating
      an invalid C enum
      - because the generator adds a _MAX terminator to each enum,
      the use of an enum member 'max' can also cause this clash
      - if an enum omits 'data', the generator left a python stack
      trace rather than a graceful message
      - an enum that used a non-array 'data' was silently accepted by
      the parser
      - an enum that used non-string members in the 'data' member
      was silently accepted by the parser

      Add check_enum to cover these situations, and update testcases
      to match.  While valid .json files won't trigger any of these
      cases, we might as well be nicer to developers that make a typo
      while trying to add new QAPI code.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit ad11dbb93752ffd4bd1d5f31da7e2d9c40a68e8a
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:03 2015 -0600

      qapi: Add some enum tests

      Demonstrate that the qapi generator doesn't deal well with enums
      that aren't up to par. Later patches will update the expected
      results as the generator is made stricter.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit fe2a9303c9e511462f662a415c2e9d2defe9b7ca
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:02 2015 -0600

      qapi: Require ASCII in schema

      Python 2 and Python 3 have a wild history of whether strings
      default to ascii or unicode, where Python 3 requires checking
      isinstance(foo, basestr) to cover all strings, but where that
      code is not portable to Python 2.  It's simpler to just state
      that we don't care about Unicode strings, and to just always
      use the simpler isinstance(foo, str) everywhere.

      I'm no python expert, so I'm basing it on this conversation:
      https://lists.gnu.org/archive/html/qemu-devel/2014-09/msg05278.html

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit cb17f79eef0d161e81ac457e4c1f124405be2a18
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:01 2015 -0600

      qapi: Fix generation of 'size' builtin type

      We were missing the 'size' builtin type (which means that QAPI using
      [ 'size' ] would fail to compile).

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit b52c4b9cf0bbafdf8cede4ea1f62770d86815718
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:05:00 2015 -0600

      qapi: Simplify builtin type handling

      There was some redundancy between builtin_types[] and
      builtin_type_qtypes{}.  Merge them into one.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit e790e666518e68134ca0570b6b4a707169ea3cb1
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:04:59 2015 -0600

      qapi: Document type-safety considerations

      Go into more details about the various types of valid expressions
      in a qapi schema, including tweaks to document fixes being done
      later in the current patch series.  Also fix some stale and missing
      documentation in the QMP specification.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 6fb55451728e6dc74ae4e67e4f5ab557468f084e
  Author: Eric Blake <eblake@redhat.com>
  Date:   Mon May 4 09:04:58 2015 -0600

      qapi: Add copyright declaration on docs

      While our top-level COPYING with its GPLv2+ license applies to
      any documentation file that omits explicit instructions, these
      days it's better to be a good example of calling out our
      intentions.  Correct use of GPL requires the use of a copyright
      statement, so I'm adding notice to two QAPI documents, by
      attributing these files to the initial authors and major
      contributors.  I used:

      $ git blame --line-porcelain $file \
        | sed -n 's/^author //p' | sort | uniq -c | sort -rn

      to determine authorship of these two files.  qmp-spec.txt blames
      entirely to Red Hat (easy, since my contribution falls in that
      category); while qapi-code-gen.txt has multiple contributors
      representing multiple entities.  But since it was originally
      supplied by Michael Roth, the notice I added there copies the
      notice he has used in other files.  As there is no intended
      change in license from the implicit one previously present from
      the top level, I have not bothered to CC other contributors;
      if we want to weaken things to something looser (such as LGPL)
      so that there is no question that someone re-implementing the
      spec is not forced to use GPL, that would be a different commit.

      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 00c8fa9ffeee7458e5ed62c962faf638156c18da
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Thu Apr 2 20:07:53 2015 -0400

      tcg: optimise memory layout of TCGTemp

      This brings down the size of the struct from 56 to 32 bytes on 64-bit,
      and to 20 bytes on 32-bit. This leads to memory savings:

      Before:
      $ find . -name 'tcg.o' | xargs size
         text    data     bss     dec     hex filename
        41131   29800      88   71019   1156b ./aarch64-softmmu/tcg/tcg.o
        37969   29416      96   67481   10799 ./x86_64-linux-user/tcg/tcg.o
        39354   28816      96   68266   10aaa ./arm-linux-user/tcg/tcg.o
        40802   29096      88   69986   11162 ./arm-softmmu/tcg/tcg.o
        39417   29672      88   69177   10e39 ./x86_64-softmmu/tcg/tcg.o

      After:
      $ find . -name 'tcg.o' | xargs size
         text    data     bss     dec     hex filename
        40883   29800      88   70771   11473 ./aarch64-softmmu/tcg/tcg.o
        37473   29416      96   66985   105a9 ./x86_64-linux-user/tcg/tcg.o
        38858   28816      96   67770   108ba ./arm-linux-user/tcg/tcg.o
        40554   29096      88   69738   1106a ./arm-softmmu/tcg/tcg.o
        39169   29672      88   68929   10d41 ./x86_64-softmmu/tcg/tcg.o

      Note that using an entire byte for some enums that need less than
      that wastes a few bits (noticeable in 32 bits, where we use
      20 bytes instead of 16) but avoids extraction code, which overall
      is a win--I've tested several variations of the patch, and the appended
      is the best performer for OpenSSL's bntest by a very small margin:

      Before:
      $ taskset -c 0 perf stat -r 15 -- x86_64-linux-user/qemu-x86_64 img/bntest-x86_64 >/dev/null
      [...]
       Performance counter stats for 'x86_64-linux-user/qemu-x86_64 img/bntest-x86_64' (15 runs):

            10538.479833 task-clock (msec)  # 0.999 CPUs utilized  ( +-  0.38% )
                     772 context-switches   # 0.073 K/sec          ( +-  2.03% )
                       0 cpu-migrations     # 0.000 K/sec          ( +-100.00% )
                   2,207 page-faults        # 0.209 K/sec          ( +-  0.08% )
            10.552871687 seconds time elapsed                      ( +-  0.39% )

      After:
      $ taskset -c 0 perf stat -r 15 -- x86_64-linux-user/qemu-x86_64 img/bntest-x86_64 >/dev/null
       Performance counter stats for 'x86_64-linux-user/qemu-x86_64 img/bntest-x86_64' (15 runs):

            10459.968847 task-clock (msec)  # 0.999 CPUs utilized  ( +-  0.30% )
                     739 context-switches   # 0.071 K/sec          ( +-  1.71% )
                       0 cpu-migrations     # 0.000 K/sec          ( +- 68.14% )
                   2,204 page-faults        # 0.211 K/sec          ( +-  0.10% )
            10.473900411 seconds time elapsed                      ( +-  0.30% )

      Suggested-by: Stefan Weil <sw@weilnetz.de>
      Suggested-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 874e9aeeeb74c5459639a93439a502d262847e68
  Merge: b4c5df7 e444ea3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 14:06:12 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150505-1' into staging

      sdl2: add opengl support

      # gpg: Signature made Tue May  5 10:36:25 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150505-1:
        sdl2: Fix RGB555
        sdl2: add support for display rendering using opengl.
        sdl2: move SDL_* includes to sdl2.h
        console-gl: add opengl rendering helper functions
        opengl: add shader helper functions.
        opengl: add shader build infrastructure

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b4c5df7a15dad2417bc05d08a470b82ab89d56ea
  Merge: 5bccbb0 2e1c92d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue May 5 10:23:22 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-05-05' into staging

      coverity: fix address_space_rw model

      # gpg: Signature made Tue May  5 09:44:26 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-05-05:
        coverity: fix address_space_rw model

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e444ea34f8ec27acfa9ead7eaa9904238c831e69
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 12:25:27 2015 -0500

      sdl2: Fix RGB555

      Reproducable with:

      $ x86_64-softmmu/qemu-system-x86_64 \
          -kernel $vmlinuz_of_your_choice \
          -append vga=0x313 -sdl

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b71a5d5caa4f709d37fa1d7786dffc2c94f8414
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 16:54:45 2014 +0100

      sdl2: add support for display rendering using opengl.

      Add new sdl2-gl.c file, with display
      rendering functions using opengl.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 19dadfccd0124804e2790e7cb075c9df7cd3154f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 19 14:19:49 2014 +0100

      sdl2: move SDL_* includes to sdl2.h

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit cd2bc889e5b30c69926fc1511b6522e7cb4c705d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 11:40:23 2015 +0100

      console-gl: add opengl rendering helper functions

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 985e1c9b008e5e8b6eac41546266d3abcfa6282a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Apr 24 07:48:45 2015 +0200

      opengl: add shader helper functions.

      Helper functions to compile, link and run opengl shader programs.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e1c92daff752c056ae10087e6b1702b0460af88
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 4 14:18:09 2015 +0200

      coverity: fix address_space_rw model

      If the is_write argument is true, address_space_rw writes to memory
      and thus reads from the buffer.  The opposite holds if is_write is
      false.  Fix the model.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d98bc0b654b97d130338e76e0928296f84e6d6fd
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 16 13:59:17 2015 +0100

      opengl: add shader build infrastructure

      perl script to transform shader programs into c include files with
      static string constands containing the shader programs, so we can
      easily embed them into qemu.  Also some Makefile logic for them.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 5bccbb04a4abba7af4398de992bf06d585fd1333
  Merge: f90f5b9 4a4d614
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 20:34:54 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches

      # gpg: Signature made Thu Apr 30 19:51:16 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        Enable NVMe start controller for Windows guest.
        MAINTAINERS: Add qemu-block list where missing
        MAINTAINERS: make block layer core Kevin Wolf's responsibility
        MAINTAINERS: make image fuzzer Stefan Hajnoczi's responsibility
        MAINTAINERS: make block I/O path Stefan Hajnoczi's responsibility
        MAINTAINERS: split out image formats
        MAINTAINERS: make virtio-blk Stefan Hajnoczi's responsibility

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 41063e1e7afcb2f13e103720fe96221657f5dbbc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 18 14:21:43 2015 +0100

      exec: move rcu_read_lock/unlock to address_space_translate callers

      Once address_space_translate will be called outside the BQL, the returned
      MemoryRegion might disappear as soon as the RCU read-side critical section
      ends.  Avoid this by moving the critical section to the callers.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1426684909-95030-3-git-send-email-pbonzini@redhat.com>

  commit 4c6637525290dc863a00be7f58fc11d07b780bd4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 8 13:30:58 2015 +0200

      kvm: add support for memory transaction attributes

      Let kvm_arch_post_run convert fields in the kvm_run struct to MemTxAttrs.
      These are then passed to address_space_rw.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8a9f720dd2fa5c1560838c26c6dad396a0cef5b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 12:57:11 2015 +0200

      mtree: also print disabled regions

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e48816aac6eef50c851e3833add886f0403b6f11
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Apr 8 12:53:47 2015 +0200

      mtree: tag & indent a bit better

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 813297541196698f60525d611dd09007fa60b45b
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Tue Apr 7 16:53:52 2015 +0300

      apic_common: improve readability of apic_reset_common

      Replace call of cpu_is_bsp(s->cpu) which really returns
          !!(s->apicbase & MSR_IA32_APICBASE_BSP)
      with directly collected value. Due to this the tracepoint
        trace_cpu_get_apic_base((uint64_t)s->apicbase);
      will not be hit anymore in apic_reset_common.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Andreas Färber <afaerber@suse.de>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1428414832-3104-1-git-send-email-den@openvz.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03a96b83b539498510e22aab585e41015ba18247
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon Apr 27 18:59:04 2015 +0200

      kvm: Silence warning from valgrind

      valgrind complains here about uninitialized bytes with the following message:

      ==17814== Syscall param ioctl(generic) points to uninitialised byte(s)
      ==17814==    at 0x466A780: ioctl (in /usr/lib64/power8/libc-2.17.so)
      ==17814==    by 0x100735B7: kvm_vm_ioctl (kvm-all.c:1920)
      ==17814==    by 0x10074583: kvm_set_ioeventfd_mmio (kvm-all.c:574)

      Let's fix it by using a proper struct initializer in kvm_set_ioeventfd_mmio().

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-Id: <1430153944-24368-1-git-send-email-thuth@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f90f5b9a9aa41e5ea47dc7a0f3e1f99196f485c3
  Merge: 4981475 5530293
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 15:18:30 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-04-30' into staging

      trivial patches for 2015-04-30

      # gpg: Signature made Thu Apr 30 14:07:50 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-04-30: (42 commits)
        openrisc: cpu: Remove unused cpu_get_pc
        microblaze: fix memory leak
        tcg: Delete unused cpu_pc_from_tb()
        kvm: Silence warning from valgrind
        vhost-user: remove superfluous '\n' around error_report()
        target-mips: fix memory leak
        qmp-commands: Fix typo
        linux-user/elfload: use QTAILQ_FOREACH instead of open-coding it
        coroutine: remove unnecessary parentheses in qemu_co_queue_empty
        qemu-char: remove unused list node from FDCharDriver
        input: remove unused mouse_handlers list
        cpus: use first_cpu macro instead of QTAILQ_FIRST(&cpus)
        microblaze: cpu: delete unused cpu_interrupts_enabled
        microblaze: cpu: Renumber EXCP_* constants to close gap
        microblaze: cpu: Delete EXCP_NMI
        microblaze: cpu: Remove unused CC_OP enum
        microblaze: cpu: Remote unused cpu_get_pc
        microblaze: mmu: Delete flip_um fn prototype
        defconfigs: Piggyback microblazeel on microblaze
        libcacard: do not use full paths for include files in the same dir
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4a4d614ff56b4cf15e83629946afe51dc116053f
  Author: Daniel Stekloff <dan@wendan.org>
  Date:   Fri Apr 24 11:55:42 2015 -0700

      Enable NVMe start controller for Windows guest.

      Windows seems to send two separate calls to NVMe controller configuration. The
      first sends configuration info and the second the enable bit. I couldn't
      enable the Windows 8.1 in-box NVMe driver with base Qemu. I made the
      following change to store the configuration data and then handle enable and
      NVMe driver works on Windows 8.1.

      I am not a Windows expert and I'm not entirely sure this is the correct
      approach. I'm offering it for anyone who wishes to use NVMe on Windows 8.1
      using Qemu.

      I have tested this change with Linux and Windows guests with NVMe devices.

      Signed-off-by: Daniel Stekloff <dan@wendan.org>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 498147529d1f8e902e6528a0115143b53475791e
  Merge: 06feaac 2c80e99
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 14:15:56 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150430' into staging

      First pile of s390x patches for 2.4, including:
      - some cleanup patches
      - sort most of the s390x devices into categories
      - support for the new STSI post handler, used to insert vm name and
        friends
      - support for the new MEM_OP ioctl (including access register mode)
        for accessing guest memory

      # gpg: Signature made Thu Apr 30 12:56:58 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150430:
        kvm: better advice for failed s390x startup
        s390x/kvm: Support access register mode for KVM_S390_MEM_OP ioctl
        s390x/mmu: Use ioctl for reading and writing from/to guest memory
        s390x/kvm: Put vm name, extended name and UUID into STSI322 SYSIB
        linux-headers: update
        s390x/mmu: Use access type definitions instead of magic values
        s390x/ipl: sort into categories
        sclp: sort into categories
        s390-virtio: sort into categories
        virtio-ccw: sort into categories

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c95e4c0e53c774dd82a78ae751ea24f537e38778
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Apr 30 15:15:13 2015 +0200

      MAINTAINERS: Add qemu-block list where missing

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 17f1e8f5acf0016bf0b14ef9ec591d3f5081fc60
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:29 2015 +0100

      MAINTAINERS: make block layer core Kevin Wolf's responsibility

      Kevin is now sole maintainer of the core block layer, including
      BlockDriverState graphs and monitor commands.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit abfe4e9408a9e82bec9e9834eabc65f53907f281
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:28 2015 +0100

      MAINTAINERS: make image fuzzer Stefan Hajnoczi's responsibility

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d55053b16e22d46db0d98819814a31ae5c33e2c7
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:27 2015 +0100

      MAINTAINERS: make block I/O path Stefan Hajnoczi's responsibility

      The block I/O path includes the asynchronous I/O machinery and
      read/write/flush/discard processing.  It somewhat arbitrarily also
      includes block migration, which I've found myself reviewing patches for
      over the years.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e7c6e631b191c99eecb4a06fe19302e863f033c6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:26 2015 +0100

      MAINTAINERS: split out image formats

      Block driver submaintainers has proven to be a good model.  Kevin and
      Stefan are splitting up the unclaimed block drivers so each has a
      dedicated maintainer.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b457a5f54cd857815401dc4708a4c778481ec562
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 29 15:13:25 2015 +0100

      MAINTAINERS: make virtio-blk Stefan Hajnoczi's responsibility

      Cc: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 553029351bac9f5b4f9ea72793e55f02e7677ec2
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Thu Apr 30 00:38:52 2015 -0700

      openrisc: cpu: Remove unused cpu_get_pc

      This function is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4d850406a859d3a5dcfca74eb9caa76ccc064ab3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 5 11:05:20 2015 +0800

      microblaze: fix memory leak

      When not assign a -dtb argument, the variable dtb_filename
      storage returned from qemu_find_file(), which should be freed
      after use. Alternatively we define a local variable filename,
      with 'char *' type, free after use.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fee068e4f190a36ef3bda9aa7c802f90434ef8e5
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Wed Apr 29 00:52:21 2015 -0700

      tcg: Delete unused cpu_pc_from_tb()

      No code uses the cpu_pc_from_tb() function. Delete from tricore and
      arm which each provide an unused implementation. Update the comment
      in tcg.h to reflect that this is obsoleted by synchronize_from_tb.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ed0c3dad769ab747e1f5448b70eeaf134c76982
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Mon Apr 27 18:59:04 2015 +0200

      kvm: Silence warning from valgrind

      valgrind complains here about uninitialized bytes with the following message:

      ==17814== Syscall param ioctl(generic) points to uninitialised byte(s)
      ==17814==    at 0x466A780: ioctl (in /usr/lib64/power8/libc-2.17.so)
      ==17814==    by 0x100735B7: kvm_vm_ioctl (kvm-all.c:1920)
      ==17814==    by 0x10074583: kvm_set_ioeventfd_mmio (kvm-all.c:574)

      Let's fix it by using a proper struct initializer in kvm_set_ioeventfd_mmio().

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ab7c5aaf31213f5fc96018514e3d258e951d520f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:04 2015 +0800

      vhost-user: remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3ad9fd5a257794d516db515c217c78a5806112fe
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Apr 28 17:11:02 2015 +0800

      target-mips: fix memory leak

      Coveristy reports that variable prom_buf/params_buf going
      out of scope leaks the storage it points to.

      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5403432f39fc09ce1973cc8c1a62e16502358bf7
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:20:41 2015 -0400

      qmp-commands: Fix typo

      Just a trivial patch to correct a QMP example in qmp-commands.hx.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52a53afebd2604af957d50fd4f3ce2012350a40d
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:33 2015 -0400

      linux-user/elfload: use QTAILQ_FOREACH instead of open-coding it

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b1201addc7ceb8f1fcdc378071ec6f5ab5b3f7ab
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:32 2015 -0400

      coroutine: remove unnecessary parentheses in qemu_co_queue_empty

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 63d229c32b72767461262ade78a5cb98dbe0f1b4
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:30 2015 -0400

      qemu-char: remove unused list node from FDCharDriver

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dfbf272b77cfb6b74131746a67c82271ab009f2f
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:29 2015 -0400

      input: remove unused mouse_handlers list

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c28e399cadbeaa996e2a3d334368edd4cd6b6889
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Mon Apr 27 12:45:28 2015 -0400

      cpus: use first_cpu macro instead of QTAILQ_FIRST(&cpus)

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 93100f67c723f5812d0fa9a026208cf320ef46e6
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:24 2015 -0700

      microblaze: cpu: delete unused cpu_interrupts_enabled

      This function is unused. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2161be35ce57ed5b0da0b98f902d003bfebac2c9
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Apr 29 08:34:29 2015 +0300

      microblaze: cpu: Renumber EXCP_* constants to close gap

      After removal of EXCP_NMI there's a gap in EXCP_*
      numbering. Let's remove it.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 059ec9aa34fd3c5bfe65141741c671b3e80ac6e7
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:23 2015 -0700

      microblaze: cpu: Delete EXCP_NMI

      This define is unused. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 004f979fbb83397349c9158946ec5d4f0036632b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:22 2015 -0700

      microblaze: cpu: Remove unused CC_OP enum

      This enum is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b133b09a9d8ae280bba279a1aba9af73a805e198
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:21 2015 -0700

      microblaze: cpu: Remote unused cpu_get_pc

      This function is not used by anything. Remove.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 19191a6bc537b2290e18430e1877de9c2db20510
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:20 2015 -0700

      microblaze: mmu: Delete flip_um fn prototype

      This is not implemented or used.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a0970d91c94241c74b2b8027268d2a7e8fe19ae3
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 12:10:19 2015 -0700

      defconfigs: Piggyback microblazeel on microblaze

      Theres no difference in defconfig. Going forward microblazeel should
      superset microblaze so use an include.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f66759d3aec208651a7ad0cd37f4fec8d86fa7c1
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 16:29:58 2015 +0300

      libcacard: do not use full paths for include files in the same dir

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 28507a415a9b1e897aa8cdab658c6cdc00eff6cd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 27 12:34:18 2015 +0200

      libcacard: stop including qemu-common.h

      This is a small step towards making libcacard standalone.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d3e4abdddfcf70b2e678de1c6b9b1c6cd3ce541e
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Apr 27 13:32:35 2015 +0200

      docs/atomics.txt: fix two typos

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5ecaa4ed882aa6040d2ddbfc6f487d8b4bcd3b83
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 19:14:26 2015 -0700

      configure: alphabetize tricore in target list

      tricore was out of alphabetical order in the target list. Fix.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Acked-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ef1d27f4b17c4238ed3395724026910973026d2b
  Author: Peter Crosthwaite <crosthwaitepeter@gmail.com>
  Date:   Sun Apr 26 18:38:18 2015 -0700

      arm: cpu.h: Remove unused typdefs

      These CP accessor function prototypes are unused. Remove them.

      Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3bf2af7b40281f73d0e33ecca4095078feed07b1
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:33 2015 +0100

      util: Remove unused functions

      Delete the unused functions qemu_signalfd_available(),
      qemu_send_full() and qemu_recv_full().

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ec29ea1b2b5ffed569d52393ad8e8d3f4215b9b3
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:32 2015 +0100

      usb: Remove unused functions

      Delete set_usb_string(), usb_ep_get_ifnum(), usb_ep_get_max_packet_size()
      usb_ep_get_max_streams() and usb_ep_set_pipeline() since they are
      not used anymore.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 26b93109c0dff55aab67da66ebbace2cc39becfc
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:31 2015 +0100

      monitor: Remove unused functions

      The functions ringbuf_read_completion() and monitor_get_rs()
      are not used anywhere anymore, so let's remove them.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 04768b985e8da35cba67b60dab02865a4d8ecdca
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:30 2015 +0100

      pci: Remove unused function ich9_d2pbr_init()

      The function ich9_d2pbr_init() is completely unused and
      thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9dcfda1298662223af1b99f7aef1bcf94df134a8
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:29 2015 +0100

      vmxnet: Remove unused function vmxnet_rx_pkt_get_num_frags()

      The function is not used anymore and thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Dmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 825976153ee4c787326e0beb31144906f0a3c210
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 11:12:49 2015 +0300

      qemu-options: trivial spelling fix (messsage)

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit c2cb2b041b56e113e43da78528c9dfd8257e0206
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Fri Apr 24 19:41:26 2015 +0200

      hostmem: Fix mem-path property name in error report

      The subtle difference between "property not found" and "property not
      set" is already confusing enough.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 29b558d87710a962203a45d9dd57bf7eab19dca0
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Wed Apr 15 10:18:55 2015 -0400

      tpm: fix coding style

      Fix coding style in one instance.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1897b212b780a02a5605ad934a6dd16c76571fe3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 13 17:28:27 2015 +0200

      qemu-config: remove stray inclusions of hw/ files

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f2fbb40ea32445b281696a1b3f16de670951de2e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Apr 13 17:28:26 2015 +0200

      range: remove useless inclusions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 631b22ea206300f09b9d1bb9249169e0f0092639
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Thu Apr 9 20:32:39 2015 +0200

      misc: Fix new collection of typos

      All of them were reported by codespell.
      Most typos are in comments, one is in an error message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c9f88ce330c3d9107adfabdde33bdf10dcc05934
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:14 2015 +0800

      hw/display : remove 'struct' from 'typedef QXL struct'

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9425c004fe287bfe95e2bf64634d6a618c2b596c
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:13 2015 +0800

      ui/console : remove 'struct' from 'typedef struct' type

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4769a881cbe1130e7ba4650471ef37e2cf998a9c
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:12 2015 +0800

      ui/vnc : remove 'struct' of 'typedef struct'

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 494cb81741f867319f11ecfa0949168baf9f01d7
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:11 2015 +0800

      ui/vnc : fix coding style

          reported by checkpatch.pl

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4188e39055bfaf6d76b7d98294b0aeb8e4f3082d
  Author: Chih-Min Chao <cmchao@gmail.com>
  Date:   Thu Apr 9 02:04:10 2015 +0800

      bitops : fix coding style

          don't mix tab and space. The rule is 4 spaces

      Signed-off-by: Chih-Min Chao <cmchao@gmail.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4d1ba9c4f8a4d68b9d053946d551ffa8f1006b77
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue Mar 31 14:49:10 2015 -0400

      tpm: Modify DPRINTF to enable -Wformat checking

      Modify DPRINTF to always enable -Wformat checking.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 070c7607f62f9623be9ff14623a43b0ca195c572
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Tue Mar 31 14:49:09 2015 -0400

      tpm: Cast 64bit variables to int when used in DPRINTF

      Cast 64bit variables to int when used in DPRINTF. They only contain
      32bit of data.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c80e996e427ae31982f3405a762859578a6261d
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Apr 23 17:03:46 2015 +0200

      kvm: better advice for failed s390x startup

      If KVM_CREATE failed on s390x, we print a hint to enable the switch_amode
      kernel parameter. This only applies to old kernels, and only if the
      error was -EINVAL. Moreover, with new kernels, the most likely reason
      for -EINVAL is that pgstes were not enabled.

      Let's update the error message to give a better hint on where things
      may need fixing.

      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6cb1e49de58cab8f243b05a971a9a1f80ab3223d
  Author: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
  Date:   Thu Mar 5 12:36:48 2015 +0300

      s390x/kvm: Support access register mode for KVM_S390_MEM_OP ioctl

      Access register mode is one of the modes that control dynamic address
      translation. In this mode the address space is specified by values of
      the access registers. The effective address-space-control element is
      obtained from the result of the access register translation. See
      the "Access-Register Introduction" section of the chapter 5 "Program
      Execution" in "Principles of Operations" for more details.

      When the CPU is in AR mode, the s390_cpu_virt_mem_rw() function must
      know which access register number to use for address translation.
      This patch does several things:
      - add new parameter 'uint8_t ar' to that function
      - decode ar number from intercepted instructions
      - pass the ar number to s390_cpu_virt_mem_rw(), which in turn passes it
      to the KVM_S390_MEM_OP ioctl.

      Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit a9bcd1b8719dea2e91512238d810e2a0037e174d
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Fri Feb 6 15:54:58 2015 +0100

      s390x/mmu: Use ioctl for reading and writing from/to guest memory

      Add code to make use of the new ioctl for reading from / writing to
      virtual guest memory. By using the ioctl, the memory accesses are now
      protected with the so-called ipte-lock in the kernel.

      [CH: moved error message into kvm_s390_mem_op()]
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f07177a5599fb204e42a007db4820ceda1bc85ba
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Tue Mar 3 18:35:27 2015 +0100

      s390x/kvm: Put vm name, extended name and UUID into STSI322 SYSIB

      KVM prefills the SYSIB, returned by STSI 3.2.2. This patch allows
      userspace to intercept execution, and fill in the values, that are
      known to qemu: machine name (8 chars), extended machine name (256
      chars), extended machine name encoding (equals 2 for UTF-8) and UUID.

      STSI322 qemu handler also finds a highest virtualization level in
      level-3 virtualization stack that doesn't support Extended Names
      (Ext Name delimiter) and propagates zero Ext Name to all levels below,
      because this level is not capable of managing Extended Names of lower
      levels.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7a52ce8a160739c5d37469b0e344d3239eb86462
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 31 16:07:08 2015 +0200

      linux-headers: update

      This updates linux-headers against master 4.1-rc1 (commit
      b787f68c36d49bb1d9236f403813641efa74a031).

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 217a4acb211d603f33199cf94ada9fce3ac419b5
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 19 15:04:50 2015 +0100

      s390x/mmu: Use access type definitions instead of magic values

      Since there are now proper definitions for the MMU access type,
      let's use them in the s390x MMU code, too, instead of the
      hard-to-understand magic values.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b4ab4572b319f2c26435b2ed18cfd3fb602c7439
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 10:17:08 2015 +0100

      s390x/ipl: sort into categories

      The s390 ipl device has no real home (it's not really a storage device),
      so let's sort it into the misc category.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 183f6b8d7e7adf6b892523644e38b534c5954be1
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:44:39 2015 +0100

      sclp: sort into categories

      Sort the sclp consoles into the input category, just as virtio-serial.
      Various other sclp devices don't have an obvious category, sort them
      into misc.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 4d1866de9422c4b359f61819ee01efc9b988187b
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:43:26 2015 +0100

      s390-virtio: sort into categories

      Sort the various s390-virtio devices into the same categories as their
      virtio-pci counterparts.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit cd20d61634092a9fa19c8c6f0a749526e9958374
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Tue Mar 17 13:42:03 2015 +0100

      virtio-ccw: sort into categories

      Sort the various virtio-ccw devices into the same categories as their
      virtio-pci counterparts.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 06feaacfb4cfef10cc0c93d97df7bfc8a71dbc7e
  Merge: a1fe58f d064d9f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 12:04:11 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan)
      - next part in the thread-safe address_space_* saga: atomic access
        to the bounce buffer and the map_clients list, from Fam
      - optional support for linking with tcmalloc, also from Fam
      - reapplying Peter Crosthwaite's "Respect as_translate_internal
        length clamp" after fixing the SPARC fallout.
      - build system fix from Wei Liu
      - small acpi-build and ioport cleanup by myself

      # gpg: Signature made Wed Apr 29 09:34:00 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (22 commits)
        nbd/trivial: fix type cast for ioctl
        translate-all: use bitmap helpers for PageDesc's bitmap
        target-i386: disable LINT0 after reset
        Makefile.target: prepend $libs_softmmu to $LIBS
        milkymist: do not modify libs-softmmu
        configure: Add support for tcmalloc
        exec: Respect as_translate_internal length clamp
        ioport: reserve the whole range of an I/O port in the AddressSpace
        ioport: loosen assertions on emulation of 16-bit ports
        ioport: remove wrong comment
        ide: there is only one data port
        gus: clean up MemoryRegionPortio
        sb16: remove useless mixer_write_indexw
        sun4m: fix slavio sysctrl and led register sizes
        acpi-build: remove dependency from ram_addr.h
        memory: add memory_region_ram_resize
        dma-helpers: Fix race condition of continue_after_map_failure and dma_aio_cancel
        exec: Notify cpu_register_map_client caller if the bounce buffer is available
        exec: Protect map_client_list with mutex
        linux-user, bsd-user: Remove two calls to cpu_exec_init_all
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1fe58f6ad2282399da256b8579b49b43527e486
  Merge: 52b7aba c836867
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 30 10:10:31 2015 +0100

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Wed Apr 29 00:03:44 2015 BST using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        qtest: Add assertion that required environment variable is set
        qtest/ahci: add flush retry test
        libqos: add blkdebug_prepare_script
        libqtest: add qmp_async
        libqtest: add qmp_eventwait
        qtest/ahci: Allow override of default CLI options
        qtest/ahci: Add simple flush test
        qtest/ahci: test different disk sectors
        qtest/ahci: add qcow2 support to ahci-test
        fdc: remove sparc sun4m mutations

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d064d9f381b00538e41f14104b88a1ae85d78865
  Author: Bogdan Purcareata <bogdan.purcareata@freescale.com>
  Date:   Fri Apr 3 11:01:54 2015 +0000

      nbd/trivial: fix type cast for ioctl

      This fixes ioctl behavior on powerpc e6500 platforms with 64bit kernel and 32bit
      userspace. The current type cast has no effect there and the value passed to the
      kernel is still 0. Probably an issue related to the compiler, since I'm assuming
      the same configuration works on a similar setup on x86.

      Also ensure consistency with previous type cast in TRACE message.

      Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
      Message-Id: <1428058914-32050-1-git-send-email-bogdan.purcareata@freescale.com>
      Cc: qemu-stable@nongnu.org
      [Fix parens as noticed by Michael. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 510a647fa27a12b66be40da4c2c098430003225c
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Wed Apr 22 17:50:52 2015 -0400

      translate-all: use bitmap helpers for PageDesc's bitmap

      Here we have an open-coded byte-based bitmap implementation.
      Get rid of it since there's a ulong-based implementation to be
      used by all code.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b8eb5512fd8a115f164edbbe897cdf8884920ccb
  Author: Nadav Amit <namit@cs.technion.ac.il>
  Date:   Mon Apr 13 02:32:08 2015 +0300

      target-i386: disable LINT0 after reset

      Due to old Seabios bug, QEMU reenable LINT0 after reset. This bug is long gone
      and therefore this hack is no longer needed.  Since it violates the
      specifications, it is removed.

      Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
      Message-Id: <1428881529-29459-2-git-send-email-namit@cs.technion.ac.il>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7398dfc7799a50097803db4796c7edb6cd7d47a1
  Author: Wei Liu <wei.liu2@citrix.com>
  Date:   Mon Mar 9 14:54:33 2015 +0000

      Makefile.target: prepend $libs_softmmu to $LIBS

      I discovered a problem when trying to build QEMU statically with gcc.
      libm is an element of LIBS while libpixman-1 is an element in
      libs_softmmu. Libpixman references functions in libm, so the original
      ordering makes linking fail.

      This fix is to reorder $libs_softmmu and $LIBS to make -lm appear after
      -lpixman-1. However I'm not quite sure if this is the right fix, hence
      the RFC tag.

      Normally QEMU is built with c++ compiler which happens to link in libm
      (at least this is the case with g++), so building QEMU statically
      normally just works and nobody notices this issue.

      Signed-off-by: Wei Liu <wei.liu2@citrix.com>
      Message-Id: <1425912873-21215-1-git-send-email-wei.liu2@citrix.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 738e4171de478da2516180c7a139f1b762443618
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 10 11:17:48 2015 +0100

      milkymist: do not modify libs-softmmu

      This is better and prepares for the next patch.  When we copy
      libs_softmmu's value into LIBS with a := assignment, we cannot
      anymore modify libs_softmmu in the Makefiles.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2847b46958ab0bd604e1b3fcafba0f5ba4375833
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Mar 26 11:03:12 2015 +0800

      configure: Add support for tcmalloc

      This adds "--enable-tcmalloc" and "--disable-tcmalloc" to allow linking
      to libtcmalloc from gperftools.

      tcmalloc is a malloc implementation that works well with threads and is
      fast, so it is good for performance.

      It is disabled by default, because the MALLOC_PERTURB_ flag we use in
      tests doesn't work with tcmalloc. However we can enable tcmalloc
      specific heap checker and profilers later.

      An IOPS gain can be observed with virtio-blk-dataplane, other parts of
      QEMU will directly benefit from it as well:

      ==========================================================
                             glibc malloc
      ----------------------------------------------------------
      rw         bs         iodepth    bw     iops       latency
      read       4k         1          150    38511      24
      ----------------------------------------------------------

      ==========================================================
                               tcmalloc
      ----------------------------------------------------------
      rw         bs         iodepth    bw     iops       latency
      read       4k         1          156    39969      23
      ----------------------------------------------------------

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1427338992-27057-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c8368674980b299604e3cfe9215c4105acefa516
  Author: Ed Maste <emaste@freebsd.org>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest: Add assertion that required environment variable is set

      Signed-off-by: Ed Maste <emaste@freebsd.org>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1427911244-22565-1-git-send-email-emaste@freebsd.org
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit cf5aa89e9d32ae39bd9df27c9b2aec03c0d240b2
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: add flush retry test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-7-git-send-email-jsnow@redhat.com

  commit 72c85e949fd162b039614d588d94393ff3e2dae3
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqos: add blkdebug_prepare_script

      Pull this helper out of ide-test and into libqos,
      to be shared with ahci-test.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-6-git-send-email-jsnow@redhat.com

  commit ba4ed39346c1bdbfefd1d781b39009f90822b956
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqtest: add qmp_async

      Add qmp_async, which lets us send QMP commands asynchronously.
      This is useful when we want to send commands that will trigger
      event responses, but we don't know in what order to expect them.

      Sometimes the event responses may arrive even before the command
      confirmation will show up, so it is convenient to leave the responses
      in the stream.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-5-git-send-email-jsnow@redhat.com

  commit 8fe941f749b2db3735abade1c298552de4eab496
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      libqtest: add qmp_eventwait

      Allow the user to poll until a desired interrupt occurs.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-4-git-send-email-jsnow@redhat.com

  commit debaaa114a8877a939533ba846e64168fb287b7b
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: Allow override of default CLI options

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-3-git-send-email-jsnow@redhat.com

  commit 4e217074ca3f704d9a1c3bd1ebb03eb7621ab882
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: Add simple flush test

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1426018503-821-2-git-send-email-jsnow@redhat.com

  commit 727be1a7550b5caad0b94098a41de8033ad43f85
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: test different disk sectors

      Test sector offset 0, 1, and the last sector(s)
      in LBA28 and LBA48 modes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426274523-22661-3-git-send-email-jsnow@redhat.com

  commit 122fdf2d8822699482723e6f50f34c9c3933360b
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      qtest/ahci: add qcow2 support to ahci-test

      This will enable the testing of high offsets without
      wasting a lot of disk space, and does not impact the
      previous tests.

      mkimg and mkqcow2 are added to libqos for other tests.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426274523-22661-2-git-send-email-jsnow@redhat.com

  commit 24a5c62cfe3cbe3fb4722f79661b9900a2579316
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Tue Apr 28 15:27:51 2015 -0400

      fdc: remove sparc sun4m mutations

      They were introduced in 6f7e9aec5eb5bdfa57a9e458e391b785c283a007 and
      82407d1a4035e5bfefb53ffdcb270872f813b34c and lots of bug fixes were done after that.

      This fixes (at least) the detection of the floppy controller on Debian 4.0r9/SPARC,
      and SS-5's OBP initialization routine still works.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Message-id: 1426351846-6497-1-git-send-email-hpoussin@reactos.org
      Signed-off-by: John Snow <jsnow@redhat.com>

  commit 52b7aba62f02cf90f57ee7e02f67d2d8445e7e40
  Merge: a9392bc 5655f93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 18:58:15 2015 +0100

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150428.0' into staging

      VFIO updates
       - Correction to BAR overflow
       - Fix error sign
       - Reset workaround for AMD Bonaire & Hawaii GPUs

      # gpg: Signature made Tue Apr 28 18:26:43 2015 BST using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150428.0:
        vfio-pci: Reset workaround for AMD Bonaire and Hawaii GPUs
        vfio-pci: Fix error path sign
        vfio-pci: Further fix BAR size overflow

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5655f931abcfa5f100d12d021eaed606c2d4ef52
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Reset workaround for AMD Bonaire and Hawaii GPUs

      Somehow these GPUs manage not to respond to a PCI bus reset, removing
      our primary mechanism for resetting graphics cards.  The result is
      that these devices typically work well for a single VM boot.  If the
      VM is rebooted or restarted, the guest driver is not able to init the
      card from the dirty state, resulting in a blue screen for Windows
      guests.

      The workaround is to use a device specific reset.  This is not 100%
      reliable though since it depends on the incoming state of the device,
      but it substantially improves the usability of these devices in a VM.

      Credit to Alex Deucher <alexander.deucher@amd.com> for his guidance.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit c6d231e2fd3773ef9a566ca24962f2314cb78f73
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Fix error path sign

      This is an impossible error path due to the fact that we're reading a
      kernel provided, rather than user provided link, which will certainly
      always fit in PATH_MAX.  Currently it returns a fixed 26 char path
      plus %d group number, which typically maxes out at double digits.
      However, the caller of the initfn certainly expects a less-than zero
      return value on error, not just a non-zero value.  Therefore we
      should correct the sign here.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 07ceaf98800519ef9c5dc893af00f1fe1f9144e4
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Apr 28 11:14:02 2015 -0600

      vfio-pci: Further fix BAR size overflow

      In an analysis by Laszlo, the resulting type of our calculation for
      the end of the MSI-X table, and thus the start of memory after the
      table, is uint32_t.  We're therefore not correctly preventing the
      corner case overflow that we intended to fix here where a BAR >=4G
      could place the MSI-X table to end exactly at the 4G boundary.  The
      MSI-X table offset is defined by the hardware spec to 32bits, so we
      simply use a cast rather than changing data structure types.  This
      scenario is purely theoretically, typically the MSI-X table is located
      at the front of the BAR.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit a9392bc93c8615ad1983047e9f91ee3fa8aae75f
  Merge: 84cbd63 61007b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 16:55:03 2015 +0100

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches

      # gpg: Signature made Tue Apr 28 15:35:05 2015 BST using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (76 commits)
        block: move I/O request processing to block/io.c
        block: extract bdrv_setup_io_funcs()
        block: add bdrv_set_dirty()/bdrv_reset_dirty() to block_int.h
        block: replace bdrv_states iteration with bdrv_next()
        vmdk: Widen before shifting 32 bit header field
        block/dmg: make it modular
        block/mirror: Always call block_job_sleep_ns()
        iotests: add incremental backup granularity tests
        iotests: add incremental backup failure recovery test
        iotests: add simple incremental backup case
        iotests: add QMP event waiting queue
        iotests: add invalid input incremental backup tests
        hbitmap: truncate tests
        block: Resize bitmaps on bdrv_truncate
        block: Ensure consistent bitmap function prototypes
        block: add BdrvDirtyBitmap documentation
        qmp: Add dirty bitmap status field in query-block
        qmp: add block-dirty-bitmap-clear
        qmp: Add support of "dirty-bitmap" sync mode for drive-backup
        block: Add bitmap successors
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da2f84d1270d203027d82f778d5bcc1f7a49bab0
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue Apr 28 19:51:13 2015 +0800

      virtio-scsi: Move DEFINE_VIRTIO_SCSI_FEATURES to virtio-scsi

      So far virtio-scsi-device can't expose host features to guest while
      using virtio-mmio because it doesn't set DEFINE_VIRTIO_SCSI_FEATURES on
      backend or transport.

      The host features belong to the backends while virtio-scsi-pci,
      virtio-scsi-s390 and virtio-scsi-ccw set the DEFINE_VIRTIO_SCSI_FEATURES
      on transports. But they already have the ability to forward property
      accesses to the backend child. So if we move the host features to
      backends, it doesn't break the backwards compatibility for them and
      make host features work while using virtio-mmio.

      Move DEFINE_VIRTIO_SCSI_FEATURES to the backend virtio-scsi. The
      transports just sync the host features from backends.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit da3e8a23492dbc13c4b70d90b6ae42970624e63a
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Tue Apr 28 19:51:12 2015 +0800

      virtio-net: Move DEFINE_VIRTIO_NET_FEATURES to virtio-net

      So far virtio-net-device can't expose host features to guest while
      using virtio-mmio because it doesn't set DEFINE_VIRTIO_NET_FEATURES on
      backend or transport. So the performance is low.

      The host features belong to the backend while virtio-net-pci,
      virtio-net-s390 and virtio-net-ccw set the DEFINE_VIRTIO_NET_FEATURES
      on transports. But they already have the ability to forward property
      accesses to the backend child. So if we move the host features to
      backends, it doesn't break the backwards compatibility for them and
      make host features work while using virtio-mmio.

      Here we move DEFINE_VIRTIO_NET_FEATURES to the backend virtio-net. The
      transports just sync the host features from backend. Meanwhile move
      virtio_net_set_config_size to virtio-net to make sure the config size
      is correct and don't expose it.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51f7cb974ba1af9f68302f2bae4bf0161fb0ab03
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Tue Apr 28 12:50:07 2015 +0200

      pci: Merge pci_nic_init() into pci_nic_init_nofail()

      The error reporting in pci_nic_init() is quite erratic: Some errors
      are printed directly with error_report(), and some are passed back
      to the caller pci_nic_init_nofail() via an Error pointer.
      Since pci_nic_init() is only used by pci_nic_init_nofail(), the
      functions can be simply merged to clean up this inconsistency.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 61007b316cd71ee7333ff7a0a749a8949527575f
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:52 2015 +0100

      block: move I/O request processing to block/io.c

      The block.c file has grown to over 6000 lines.  It is time to split this
      file so there are fewer conflicts and the code is easier to maintain.

      Extract I/O request processing code:
       * Read
       * Write
       * Zero writes and making the image empty
       * Flush
       * Discard
       * ioctl
       * Tracked requests and queuing
       * Throttling and copy-on-read
       * Block status and allocated functions
       * Refreshing block limits
       * Reading/writing vmstate
       * qemu_blockalign() and friends

      The patch simply moves code from block.c into block/io.c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0eb7217e49b84553bb30f97bc34380633fd846fe
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:51 2015 +0100

      block: extract bdrv_setup_io_funcs()

      Move the code to install coroutine and aio emulation function pointers
      in a BlockDriver to its own function.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e0c47b6cb1de430fbc6f828f7acffa851c580840
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:50 2015 +0100

      block: add bdrv_set_dirty()/bdrv_reset_dirty() to block_int.h

      The dirty bitmap functions are called from the block I/O processing
      code.  Make them visible to block_int.h users so they can be used
      outside block.c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4f5472cb2d3d37ec3282cc3829612f9d696c2df7
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Apr 28 14:27:49 2015 +0100

      block: replace bdrv_states iteration with bdrv_next()

      The bdrv_states list is a static variable in block.c.

      bdrv_drain_all() and bdrv_flush_all() use this variable to iterate over
      all drives.

      The next patch will move bdrv_drain_all() and bdrv_flush_all() out of
      block.c so it's necessary to switch to the public bdrv_next() interface.

      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7237aecd7e8fcc3ccf7fded77b6c127b4df5d3ac
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Apr 27 22:23:01 2015 +0800

      vmdk: Widen before shifting 32 bit header field

      Coverity spotted this.

      The field is 32 bits, but if it's possible to overflow in 32 bit
      left shift.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5505e8b76f86f925c35ecc2b2d311886bb36534c
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Apr 27 14:51:56 2015 +0300

      block/dmg: make it modular

      dmg can optionally utilize libbz2, make it modular

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 001c95b740b2ed3d8b486952f68b5f06e609f1f2
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Apr 27 13:07:31 2015 +0200

      block/mirror: Always call block_job_sleep_ns()

      The mirror block job is trying to take a clever shortcut if delay_ns is
      0 and skips block_job_sleep_ns() in that case. But that function must be
      called in every block job iteration, because otherwise it is for example
      impossible to pause the job.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59fc5d844fe192494308d0f07507b712ec395129
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:09 2015 -0400

      iotests: add incremental backup granularity tests

      Test what happens if you fiddle with the granularity.

      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-22-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 24618f5381da650bd50c78feea07b35cf82e7d6c
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:08 2015 -0400

      iotests: add incremental backup failure recovery test

      Test the failure case for incremental backups.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-21-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a3d715958c4456afea402e891288864fe4e51547
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:07 2015 -0400

      iotests: add simple incremental backup case

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-20-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7898f74e78a5900fc079868e255b65d807fa8a8f
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:06 2015 -0400

      iotests: add QMP event waiting queue

      A filter is added to allow callers to request very specific
      events to be pulled from the event queue, while leaving undesired
      events still in the stream.

      This allows us to poll for completion data for multiple asynchronous
      events in any arbitrary order.

      A new timeout context is added to the qmp pull_event method's
      wait parameter to allow tests to fail if they do not complete
      within some expected period of time.

      Also fixed is a bug in qmp.pull_event where we try to retrieve an event
      from an empty list if we attempt to retrieve an event with wait=False
      but no events have occurred.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-19-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9f7264f57c8307bca32e78427348b8b323d5db21
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:05 2015 -0400

      iotests: add invalid input incremental backup tests

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a94e87c08cfff73ac4b179adc3d0d9c3b8d2ddef
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:04 2015 -0400

      hbitmap: truncate tests

      The general approach is to set bits close to the boundaries of
      where we are truncating and ensure that everything appears to
      have gone OK.

      We test growing and shrinking by different amounts:
      - Less than the granularity
      - Less than the granularity, but across a boundary
      - Less than sizeof(unsigned long)
      - Less than sizeof(unsigned long), but across a ulong boundary
      - More than sizeof(unsigned long)

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ce1ffea8cdcea41533bde87759b8390f0e3a9ad3
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:03 2015 -0400

      block: Resize bitmaps on bdrv_truncate

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20dca81075e712ebcbc151eed9b1a02d4e5d08f5
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:02 2015 -0400

      block: Ensure consistent bitmap function prototypes

      We often don't need the BlockDriverState for functions
      that operate on bitmaps. Remove it.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aa0c7ca506bb3f661be673b3d5c1320f37e52fdb
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:01 2015 -0400

      block: add BdrvDirtyBitmap documentation

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a113534ffb8f2580d323e6397e6908d5f4bfa0b7
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:50:00 2015 -0400

      qmp: Add dirty bitmap status field in query-block

      Add the "frozen" status booleans, to inform clients
      when a bitmap is occupied doing a task.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e74e6b78e6fe0c9ee426d1278fff45f5fa0af766
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:59 2015 -0400

      qmp: add block-dirty-bitmap-clear

      Add bdrv_clear_dirty_bitmap and a matching QMP command,
      qmp_block_dirty_bitmap_clear that enables a user to reset
      the bitmap attached to a drive.

      This allows us to reset a bitmap in the event of a full
      drive backup.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d58d84539784d27c826924a79d9436178b07ff69
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:58 2015 -0400

      qmp: Add support of "dirty-bitmap" sync mode for drive-backup

      For "dirty-bitmap" sync mode, the block job will iterate through the
      given dirty bitmap to decide if a sector needs backup (backup all the
      dirty clusters and skip clean ones), just as allocation conditions of
      "top" sync mode.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9bd2b08f27b9c27bb40d73b6466321b8c635086e
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:57 2015 -0400

      block: Add bitmap successors

      A bitmap successor is an anonymous BdrvDirtyBitmap that is intended to
      be created just prior to a sensitive operation (e.g. Incremental Backup)
      that can either succeed or fail, but during the course of which we still
      want a bitmap tracking writes.

      On creating a successor, we "freeze" the parent bitmap which prevents
      its deletion, enabling, anonymization, or creating a bitmap with the
      same name.

      On success, the parent bitmap can "abdicate" responsibility to the
      successor, which will inherit its name. The successor will have been
      tracking writes during the course of the backup operation. The parent
      will be safely deleted.

      On failure, we can "reclaim" the successor from the parent, unifying
      them such that the resulting bitmap describes all writes occurring since
      the last successful backup, for instance. Reclamation will thaw the
      parent, but not explicitly re-enable it.

      BdrvDirtyBitmap operations that target a single bitmap are protected
      by assertions that the bitmap is not frozen and/or disabled.

      BdrvDirtyBitmap operations that target a group of bitmaps, such as
      bdrv_{set,reset}_dirty will ignore frozen/disabled drives with a
      conditional instead.

      Internal functions that enable/disable dirty bitmaps have assertions
      added to them to prevent modifying frozen bitmaps.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8e6fb752e43b45b428487c244cab35f0ab94b10
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:56 2015 -0400

      block: Add bitmap disabled status

      Add a status indicating the enabled/disabled state of the bitmap.
      A bitmap is by default enabled, but you can lock the bitmap into
      a read-only state by setting disabled = true.

      A previous version of this patch added a QMP interface for changing
      the state of the bitmap, but it has since been removed for now until
      a use case emerges where this state must be revealed to the user.

      The disabled state WILL be used internally for bitmap migration and
      bitmap persistence.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit be58721dbf882fa8830f3669f499b0a5b501e90f
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:55 2015 -0400

      hbitmap: add hbitmap_merge

      We add a bitmap merge operation to assist in error cases
      where we wish to combine two bitmaps together.

      This is algorithmically O(bits) provided HBITMAP_LEVELS remains
      constant. For a full bitmap on a 64bit machine:
      sum(bits/64^k, k, 0, HBITMAP_LEVELS) ~= 1.01587 * bits

      We may be able to improve running speed for particularly sparse
      bitmaps by using iterators, but the running time for dense maps
      will be worse.

      We present the simpler solution first, and we can refine it later
      if needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8515efbef1759b9143f06e9722c8f4e145032181
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:54 2015 -0400

      hbitmap: cache array lengths

      As a convenience: between incremental backups, bitmap migrations
      and bitmap persistence we seem to need to recalculate these a lot.

      Because the lengths are a little bit-twiddly, let's just solidly
      cache them and be done with it.

      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 592fdd02ae987a439a2ba25a2a973673f1484805
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:53 2015 -0400

      block: Introduce bdrv_dirty_bitmap_granularity()

      This returns the granularity (in bytes) of dirty bitmap,
      which matches the QMP interface and the existing query
      interface.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 341ebc2f81b14862347e4d4c1fcb3759f815237a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:52 2015 -0400

      qmp: Add block-dirty-bitmap-add and block-dirty-bitmap-remove

      The new command pair is added to manage a user created dirty bitmap. The
      dirty bitmap's name is mandatory and must be unique for the same device,
      but different devices can have bitmaps with the same names.

      The granularity is an optional field. If it is not specified, we will
      choose a default granularity based on the cluster size if available,
      clamped to between 4K and 64K to mirror how the 'mirror' code was
      already choosing granularity. If we do not have cluster size info
      available, we choose 64K. This code has been factored out into a helper
      shared with block/mirror.

      This patch also introduces the 'block_dirty_bitmap_lookup' helper,
      which takes a device name and a dirty bitmap name and validates the
      lookup, returning NULL and setting errp if there is a problem with
      either field. This helper will be re-used in future patches in this
      series.

      The types added to block-core.json will be re-used in future patches
      in this series, see:
      'qapi: Add transaction support to block-dirty-bitmap-{add, enable, disable}'

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5fba6c0e50b66691568b34d5a2f4be0b39f5e20a
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:51 2015 -0400

      qmp: Ensure consistent granularity type

      We treat this field with a variety of different types everywhere
      in the code. Now it's just uint32_t.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0db6e54a8a2c6e16780356422da671b71f862341
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 17 19:49:50 2015 -0400

      qapi: Add optional field "name" to block dirty bitmap

      This field will be set for user created dirty bitmap. Also pass in an
      error pointer to bdrv_create_dirty_bitmap, so when a name is already
      taken on this BDS, it can report an error message. This is not global
      check, two BDSes can have dirty bitmap with a common name.

      Implemented bdrv_find_dirty_bitmap to find a dirty bitmap by name, will
      be used later when other QMP commands want to reference dirty bitmap by
      name.

      Add bdrv_dirty_bitmap_make_anon. This unsets the name of dirty bitmap.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1429314609-29776-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit efcfa278dca27f1c9db8b8283eac54f5e19074e7
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Apr 17 19:49:49 2015 -0400

      docs: incremental backup documentation

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1429314609-29776-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9eac3622a2b1159ab50b10540e822f3e58fdc383
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:33 2015 +0200

      block/iscsi: use the allocationmap also if cache.direct=on

      the allocationmap has only a hint character. The driver always
      double checks that blocks marked unallocated in the cache are
      still unallocated before taking the fast path and return zeroes.
      So using the allocationmap is migration safe and can
      also be enabled with cache.direct=on.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-10-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 03e40fef4678f9a42846c91a804b6d3c820e8b90
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:32 2015 +0200

      block/iscsi: bump year in copyright notice

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-9-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e380aff831c24b37c023010852e7ddd2ae1ec385
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:31 2015 +0200

      block/iscsi: handle SCSI_STATUS_TASK_SET_FULL

      a target may issue a SCSI_STATUS_TASK_SET_FULL status
      if there is more than one "BUSY" command queued already.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-8-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59dd0a22ca4c3ac70c37263208b9e49cfeacf2e4
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:30 2015 +0200

      block/iscsi: increase retry count

      The idea is that a command is retried in a BUSY condition
      up a time of approx. 60 seconds before it is failed. This should
      be far higher than any command timeout in the guest.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-7-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73b5394e2e4af3bbe01e221fa395373facc67f78
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:29 2015 +0200

      block/iscsi: optimize WRITE10/16 if cache.writeback is not set

      SCSI allowes to tell the target to not return from a write command
      if the date is not written to the disk. Use this so called FUA
      bit if it is supported to optimize WRITE commands if writeback is
      not allowed.

      In this case qemu always issues a WRITE followed by a FLUSH. This
      is 2 round trip times. If we set the FUA bit we can ignore the
      following FLUSH.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-6-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 752ce45150d3d70aabc4eb46a7a9cdfd8b4640fd
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:28 2015 +0200

      block/iscsi: store DPOFUA bit from the modesense command

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-5-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7191f2080c70228c6483b6604cc1c18943d8d766
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:27 2015 +0200

      block/iscsi: rename iscsi_write_protected and let it return void

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-4-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a386e48527d16e5dedbc1ff62aa0042a1cbdac5
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:26 2015 +0200

      block/iscsi: change all iscsilun properties from uint8_t to bool

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-3-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20474e9aa040b9a255c63127f1eb873c29c54f68
  Author: Peter Lieven <pl@kamp.de>
  Date:   Thu Apr 16 16:08:25 2015 +0200

      block/iscsi: do not forget to logout from target

      We actually were always impolitely dropping the connection and
      not cleanly logging out.

      CC: qemu-stable@nongnu.org
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1429193313-4263-2-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d5a8ee60a0fbc20a2c2d02f3bda1bb1bd365f1ee
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Apr 17 14:52:43 2015 +0300

      qmp: fill in the image field in BlockDeviceInfo

      The image field in BlockDeviceInfo is supposed to contain an ImageInfo
      object. However that is being filled in by bdrv_query_info(), not by
      bdrv_block_device_info(), which is where BlockDeviceInfo is actually
      created.

      Anyone calling bdrv_block_device_info() directly will get a null image
      field. As a consequence of this, the HMP command 'info block -n -v'
      crashes QEMU.

      This patch moves the code that fills in that field from
      bdrv_query_info() to bdrv_block_device_info().

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1429271563-3765-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9419874f709469de16c1bced7731bfecb07fe1cf
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 22 11:15:10 2015 +0100

      Revert "hmp: fix crash in 'info block -n -v'"

      This reverts commit 638b8366200130cc7cf7a026630bc6bfb63b0c4c.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit dc881b441d74b8fc6c9c007cd03d5d05bca388dd
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:20 2015 +0300

      block: add 'node-name' field to BLOCK_IMAGE_CORRUPTED

      Since this event can occur in nodes that cannot have a device name
      associated, include also a field with the node name.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 147cec5b3594f4bec0cb41c98afe5fcbfb67567c.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 81e5f78a9f4f13548ec1edddaf780d339f18e2d2
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:19 2015 +0300

      block: use bdrv_get_device_or_node_name() in error messages

      There are several error messages that identify a BlockDriverState by
      its device name. However those errors can be produced in nodes that
      don't have a device name associated.

      In those cases we should use bdrv_get_device_or_node_name() to fall
      back to the node name and produce a more meaningful message. The
      messages are also updated to use the more generic term 'node' instead
      of 'device'.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 9823a1f0514fdb0692e92868661c38a9e00a12d6.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9b2aa84f87f5b95cb0295dcae38fbfbf115df2be
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Wed Apr 8 12:29:18 2015 +0300

      block: add bdrv_get_device_or_node_name()

      This function gets the device name associated with a BlockDriverState,
      or its node name if the device name is empty.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 4fa30aa8d61d9052ce266fd5429a59a14e941255.1428485266.git.berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ec683d604069dcdaaa516789274bc0cdc14e5247
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 15 11:43:42 2015 +0100

      block: document block-stream in qmp-commands.hx

      The 'block-stream' QMP command is documented in block-core.json but not
      qmp-commands.hx.  Add a summary of the command to qmp-commands.hx
      (similar to the documentation for 'block-commit').

      Reported-by: Kashyap Chamarthy <kchamart@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1429094622-26218-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c485cf9c9277ca9b3d5227c99a13c374e812f42b
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Apr 15 10:43:44 2015 +0100

      m25p80: fix s->blk usage before assignment

      Delay the call to blk_blockalign() until s->blk has been assigned.

      This never caused a crash because blk_blockalign(NULL, size) defaults to
      4096 alignment but it's technically incorrect.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1429091024-25098-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d07063e46047242c4f010ff9ddbff5e02f15d9e7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Apr 14 17:29:47 2015 +0200

      m25p80: add missing blk_attach_dev_nofail

      Of the block devices that poked into -drive options via drive_get_next,
      m25p80 was the only one who also did not attach itself to the BlockBackend.

      Since sd does it, and all other devices go through a "drive" property,
      with this change all block backends attached to the guest will have a
      non-NULL result for blk_get_attached_dev().

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1429025387-11077-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4eb867e98c1815d9d7a2a9380182005df12064a7
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Apr 12 17:55:17 2015 +0200

      virtio_blk: comment fix

      update virtio blk header from latest linux, include comment fixups.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 1428854036-12806-1-git-send-email-mst@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b5a24454fc551f0294fe93821e8c643214a55f5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Mar 28 07:37:18 2015 +0100

      block: avoid unnecessary bottom halves

      bdrv_aio_* APIs can use coroutines to achieve asynchronicity.  However,
      the coroutine may terminate without having yielded back to the caller
      (for example because of something that invokes a nested event loop,
      or because the coroutine is doing nothing at all).  In this case,
      the bdrv_aio_* API must delay the completion to the next iteration
      of the main loop, because bdrv_aio_* will never invoke the callback
      before returning.

      This can be done with a bottom half, and indeed bdrv_aio_* is always
      using one for simplicity.  It is possible to gain some performance
      (~3%) by avoiding this in the common case.  A new field in the
      BlockAIOCBCoroutine struct is set to true until the first time the
      corotine has yielded to its creator, and completion goes through a
      new function bdrv_co_complete.  If the flag is false, bdrv_co_complete
      invokes the callback immediately.  If it is true, the caller will
      notice that the coroutine has completed and schedule the bottom
      half itself.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427524638-28157-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a7282330c01364ef00260749bc6a37c7f16ec047
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:21 2015 +0800

      blockjob: Update function name in comments

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e62303a437af72141c8d04c36799521a56d6f4f6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:20 2015 +0800

      qemu-iotests: Test that "stop" doesn't drain block jobs

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 69da3b0b47c8f6016e9109fcfa608e9e7e99bc05
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:19 2015 +0800

      block: Pause block jobs in bdrv_drain_all

      This is necessary to suppress more IO requests from being generated from
      block job coroutines.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 751ebd76e654bd1e65da08ecf694325282b4cfcc
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Apr 3 22:05:18 2015 +0800

      blockjob: Allow nested pause

      This patch changes block_job_pause to increase the pause counter and
      block_job_resume to decrease it.

      The counter will allow calling block_job_pause/block_job_resume
      unconditionally on a job when we need to suspend the IO temporarily.

      From now on, each block_job_resume must be paired with a block_job_pause
      to keep the counter balanced.

      The user pause from QMP or HMP will only trigger block_job_pause once
      until it's resumed, this is achieved by adding a user_paused flag in
      BlockJob.

      One occurrence of block_job_resume in mirror_complete is replaced with
      block_job_enter which does what is necessary.

      In block_job_cancel, the cancel flag is good enough to instruct
      coroutines to quit loop, so use block_job_enter to replace the unpaired
      block_job_resume.

      Upon block job IO error, user is notified about the entering to the
      pause state, so this pause belongs to user pause, set the flag
      accordingly and expect a matching QMP resume.

      [Extended doc comments as suggested by Paolo Bonzini
      <pbonzini@redhat.com>.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1428069921-2957-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 199667a8c843d268f0fe80f09041b8c7193f1ba5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:40 2015 +0800

      MAINTAINERS: Add Fam Zheng as Null block driver maintainer

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1c2b49a17282f3abd9ccf71b65d0be62d3b3192e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:39 2015 +0800

      block/null: Support reopen

      Reopen is used in block-commit. With this always-succeed operation, it
      is now possible to test committing to a null drive, by specifying
      "null-aio://" or "null-co://" as the backing image when creating the
      qcow2 image.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e5e51dd3af6a0872dedce290ee41437b5aeed109
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Apr 1 09:45:38 2015 +0800

      block/null: Latency simulation by adding new option "latency-ns"

      Aio context switch should just work because the requests will be
      drained, so the scheduled timer(s) on the old context will be freed.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427852740-24315-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9eddd6a4b3b187ba50038800b6e4aeda4973b365
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 26 22:42:34 2015 +0000

      scripts: add 'qemu coroutine' command to qemu-gdb.py

      The 'qemu coroutine <coroutine-address>' GDB command prints the
      backtrace for a CoroutineUContext.  This is useful for peeking inside
      yielded coroutines that are waiting for file descriptor events, timers,
      etc.

      For example:

        $ gdb tests/test-coroutine
        (gdb) b test_yield
        (gdb) r
        (gdb) b qemu_coroutine_enter
        (gdb) c
        (gdb) c
        Continuing.

        Breakpoint 2, qemu_coroutine_enter (co=0x555555c66520, opaque=0x0) at qemu-coroutine.c:103
        103	{
        (gdb) source scripts/qemu-gdb.py
        (gdb) qemu coroutine 0x555555c66520
        #0  0x000055555557a740 in qemu_coroutine_switch (from_=<optimized out>, to_=0x7ffff7f90a70, action=COROUTINE_YIELD) at coroutine-ucontext.c:177
        #1  0x0000555555566af9 in yield_5_times (opaque=0x7fffffffdbb7) at tests/test-coroutine.c:107
        #2  0x000055555557a7aa in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at coroutine-ucontext.c:80
        #3  0x00007ffff08de000 in __start_context () at /lib64/libc.so.6

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427409754-8556-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1faa5bb73247339bf3d797433a9ade990ef0fb32
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Apr 2 17:39:22 2015 +0100

      thread-pool: clean up thread_pool_completion_bh()

      This patch simplifies thread_pool_completion_bh().

      The function first checks elem->state:

        if (elem->state != THREAD_DONE) {
            continue;
        }

      It then goes on to check elem->state == THREAD_DONE although we already
      know this must be the case.

      The QLIST_REMOVE() is duplicated down both branches of an if-else
      statement so that can be lifted out as well.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1427992762-10126-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d1a126c53ddc563b7b731cee013e0362f7a5f22f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 14 16:36:16 2015 +0200

      vhdx: Fix zero-fill iov length

      Fix the length of the zero-fill for the back, which was accidentally
      using the same value as for the front. This is caught by qemu-iotests
      033.

      For consistency, change the code for the front as well to use the length
      stored in the iov (it is the same value, copied four lines above).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Acked-by: Jeff Cody <jcody@redhat.com>

  commit 8eedfbd4a50299f03b3630659c34ad1b01f69370
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 14 16:32:45 2015 +0200

      blkdebug: Add bdrv_truncate()

      This is, amongst others, required for qemu-iotests 033 to run as
      intended on VHDX, which uses explicit bdrv_truncate() calls to bs->file
      when allocating new blocks.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>

  commit e4f587492331df0ac50bad6131ea273d527af796
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:33 2015 +0100

      qemu-iotests: Some qemu-img convert tests

      This adds a regression test for some problems that the qemu-img convert
      rewrite just fixed.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 690c7301600162421b928c7f26fd488fd8fa464e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:32 2015 +0100

      qemu-img convert: Rewrite copying logic

      The implementation of qemu-img convert is (a) messy, (b) buggy, and
      (c) less efficient than possible. The changes required to beat some
      sense into it are massive enough that incremental changes would only
      make my and the reviewers' life harder. So throw it away and reimplement
      it from scratch.

      Let me give some examples what I mean by messy, buggy and inefficient:

      (a) The copying logic of qemu-img convert has two separate branches for
          compressed and normal target images, which roughly do the same -
          except for a little code that handles actual differences between
          compressed and uncompressed images, and much more code that
          implements just a different set of optimisations and bugs. This is
          unnecessary code duplication, and makes the code for compressed
          output (unsurprisingly) suffer from bitrot.

          The code for uncompressed ouput is run twice to count the the total
          length for the progress bar. In the first run it just takes a
          shortcut and runs only half the loop, and when it's done, it toggles
          a boolean, jumps out of the loop with a backwards goto and starts
          over. Works, but pretty is something different.

      (b) Converting while keeping a backing file (-B option) is broken in
          several ways. This includes not writing to the image file if the
          input has zero clusters or data filled with zeros (ignoring that the
          backing file will be visible instead).

          It also doesn't correctly limit every iteration of the copy loop to
          sectors of the same status so that too many sectors may be copied to
          in the target image. For -B this gives an unexpected result, for
          other images it just does more work than necessary.

          Conversion with a compressed target completely ignores any target
          backing file.

      (c) qemu-img convert skips reading and writing an area if it knows from
          metadata that copying isn't needed (except for the bug mentioned
          above that ignores a status change in some cases). It does, however,
          read from the source even if it knows that it will read zeros, and
          then search for non-zero bytes in the read buffer, if it's possible
          that a write might be needed.

      This reimplementation of the copying core reorganises the code to remove
      the duplication and have a much more obvious code flow, by essentially
      splitting the copy iteration loop into three parts:

      1. Find the number of contiguous sectors of the same status at the
         current offset (This can also be called in a separate loop before the
         copying loop in order to determine the total sectors for the progress
         bar.)

      2. Read sectors. If the status implies that there is no data there to
         read (zero or unallocated cluster), don't do anything.

      3. Write sectors depending on the status. If it's data, write it. If
         we want the backing file to be visible (with -B), don't write it. If
         it's zeroed, skip it if you can, otherwise use bdrv_write_zeroes() to
         optimise the write at least where possible.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0df89e8e6f62aea32a7302e73a86b7bfe5821018
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Mar 19 13:33:31 2015 +0100

      block-backend: Expose bdrv_write_zeroes()

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit a0710f7995f914e3044e5899bd8ff6c43c62f916
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:52 2015 +0100

      iothread: release iothread around aio_poll

      This is the first step towards having fine-grained critical sections in
      dataplane threads, which resolves lock ordering problems between
      address_space_* functions (which need the BQL when doing MMIO, even
      after we complete RCU-based dispatch) and the AioContext.

      Because AioContext does not use contention callbacks anymore, the
      unit test has to be changed.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 49110174f8835ec3d5ca7fc076ee1f51c18564fe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:51 2015 +0100

      AioContext: acquire/release AioContext during aio_poll

      This is the first step in pushing down acquire/release, and will let
      rfifolock drop the contention callback feature.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e98ab097092e54999f046e9efa1ca1dd52f0c9e5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 20 17:26:50 2015 +0100

      aio-posix: move pollfds to thread-local storage

      By using thread-local storage, aio_poll can stop using global data during
      g_poll_ns.  This will make it possible to drop callbacks from rfifolock.

      [Moved npfd = 0 assignment to end of walking_handlers region as
      suggested by Paolo.  This resolves the assert(npfd == 0) assertion
      failure in pollfds_cleanup().
      --Stefan]

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424449612-18215-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit de50a20a4cc368d241d67c600f8c0f667186a8b5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Mar 25 15:27:26 2015 +0800

      block: Switch to host monotonic clock for IO throttling

      Currently, throttle timers won't make any progress when VCPU is not
      running, which would stall the request queue in utils, qtest, vm
      suspending, and live migration, without special handling.

      Block jobs are confusingly inconsistent between with and without
      throttling: if user sets a bps limit, stops the vm, then start a block
      job, the block job will not make any progress; in contrary, if user
      unsets the bps limit, or if it's not set, the block job will run
      normally.

      After this patch, with the host clock, even if the VCPUs are stopped,
      the throttle queues will be processed.

      This patch also enables potential to add throttle to bdrv_drain_all.
      Currently all requests are drained immediately. In other words whenever
      it is called, IO throttling goes ineffective (examples: system reset,
      migration and many block job operations.). This is a loophole that guest
      could exploit. If we use the host clock, we can later just trust the
      nested poll. This could be done on top.

      Note that for qemu-iotests case 093, which uses qtest, we still keep vm
      clock so the script can control the clock stepping in order to be
      deterministic.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427268446-6426-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8b6ee9aeb3f0508ed2a41381cde13bdb8707b7be
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:31 2015 +0000

      checkpatch: complain about ffs(3) calls

      The ffs(3) family of functions is not portable.  MinGW doesn't always
      provide the function.

      Use ctz32() or ctz64() instead.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-10-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f450a85899585776ccd0913d2361dd8f82666e44
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:30 2015 +0000

      os-win32: drop ffs(3) prototype

      The lack of ffs(3) in the MinGW headers is a hint that we shouldn't rely
      on it.  MinGW 4.9.2 does not make it available for linking when QEMU's
      ./configure --enable-debug is used (release builds are fine though).

      Now that all QEMU code has been switched to ctz32() there is no need for
      ffs(3).

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-9-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 41074f3d3ff0e9a3c6f638627c12ebbf6d757cea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 15:29:29 2015 +0000

      omap_intc: convert ffs(3) to ctz32() in omap_inth_sir_update()

      Rewrite the loop using level &= level - 1 to clear the least significant
      bit after each iteration.  This simplifies the loop and makes it easy to
      replace ffs(3) with ctz32().

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-8-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c9d933185181cb1cf81bc4c9e5c3a10a5934b017
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:28 2015 +0000

      sd: convert sd_normal_command() ffs(3) call to ctz32()

      ffs() cannot be replaced with ctz32() when the argument might be zero,
      because ffs(0) returns 0 while ctz32(0) returns 32.

      The ffs(3) call in sd_normal_command() is a special case though.  It can
      be converted to ctz32() + 1 because the argument is never zero:

        if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
            ~~~~~~~~~~~~~~~
                  ^--------------- req.arg cannot be zero

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-7-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd2a88840e2496e29442f333c8fdd6491e831a35
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:27 2015 +0000

      Convert ffs() != 0 callers to ctz32()

      There are a number of ffs(3) callers that do roughly:

        bit = ffs(val);
        if (bit) {
            do_something(bit - 1);
        }

      This pattern can be converted to ctz32() like this:

        zeroes = ctz32(val);
        if (zeroes != 32) {
            do_something(zeroes);
        }

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-6-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 786a4ea82ec9c87e3a895cf41081029b285a5fe5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:26 2015 +0000

      Convert (ffs(val) - 1) to ctz32(val)

      This commit was generated mechanically by coccinelle from the following
      semantic patch:

      @@
      expression val;
      @@
      - (ffs(val) - 1)
      + ctz32(val)

      The call sites have been audited to ensure the ffs(0) - 1 == -1 case
      never occurs (due to input validation, asserts, etc).  Therefore we
      don't need to worry about the fact that ctz32(0) == 32.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-5-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5863d374a32c98a7adb4c5e49d62de3cdc16d2ea
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:25 2015 +0000

      uninorth: convert ffs(3) to ctz32()

      It is not clear from the code how a 0 parameter should be handled by the
      hardware.  Keep the same behavior as ffs(0) - 1 == -1.

      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-4-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ad5f5fdca83cccd1a4c269b1fd8ba2fce8d1ba26
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:24 2015 +0000

      hw/arm/nseries: convert ffs(3) to ctz32()

      It is not clear from the code how a 0 parameter should be handled by the
      hardware.  Keep the same behavior as ffs(0) - 1 == -1.

      Cc: Andrzej Zaborowski <balrog@zabor.org>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 588ef9d411339012fc3c94bfad8911e9d0a517a2
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 23 15:29:23 2015 +0000

      bt-sdp: fix broken uuids power-of-2 calculation

      The binary search in sdp_uuid_match() only works when the number of
      elements to search is a power of two.

        lo = record->uuid;
        hi = record->uuids;
        while (hi >>= 1)
            if (lo[hi] <= val)
                lo += hi;

        return *lo == val;

      I noticed that the record->uuids calculation in
      sdp_service_record_build() was suspect:

        record->uuids = 1 << ffs(record->uuids - 1);

      Unlike most ffs(val) - 1 users, the expression is ffs(val - 1)!

      Actually ffs() is the wrong function to use for power-of-2.  Use
      pow2ceil() to achieve the correct effect.  Now the record->uuid[] array
      is sized correctly and the binary search in sdp_uuid_match() should
      work.

      I'm not sure how to run/test this code.

      Cc: Andrzej Zaborowski <balrog@zabor.org>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1427124571-28598-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ecdda9e03d73d2cc1c82c00cccc02f087741b6a5
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Mon Mar 16 18:22:05 2015 +0200

      MAINTAINERS: Add myself as the maintainer of the Quorum driver

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1426522925-14444-1-git-send-email-berto@igalia.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 407bc15033b2a8faeb7ca42aab63b7bcede76e10
  Author: Yi Wang <up2wing@gmail.com>
  Date:   Thu Mar 12 22:54:42 2015 +0800

      savevm: create snapshot failed when id_str already exists

      The command "virsh create" will fail in such condition: vm has two
      disks: vda and vdb. vda has snapshot s1 with id "1", vdb doesn't have
      s1 but has snapshot s2 with id "1".  When we want to run command "virsh
      create s1", del_existing_snapshots() only deletes s1 in vda, and
      bdrv_snapshot_create() tries to create vdb's snapshot s1 with id "1",
      but id "1" alreay exists in vdb with name "s2"!

      The simplest way is call find_new_snapshot_id() unconditionally.

      Signed-off-by: Yi Wang <up2wing@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 84cbd63f87c1d246f51ec8eee5367a5588f367fd
  Merge: 54965ee 726a8ff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 12:22:20 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue, 2015-04-27 (v2)

      # gpg: Signature made Mon Apr 27 19:42:39 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Remove AMD feature flag aliases from CPU model table
        target-i386: X86CPU::xlevel2 QOM property
        target-i386: Make "level" and "xlevel" properties static
        qemu-config: Accept empty option values
        MAINTAINERS: Change status of X86 to Maintained
        MAINTAINERS: Add myself to X86

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54965ee61dbc114e98777f456b7cd6a778fbb412
  Merge: da378d0 2f54eb9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 11:33:47 2015 +0100

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA queue, 2015-04-27

      # gpg: Signature made Mon Apr 27 19:02:19 2015 BST using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/numa-pull-request:
        MAINTAINERS: Add myself as NUMA code maintainer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da378d014d27fe3a243bd8e7e060e9eb8c1a272b
  Merge: 3d27b09 4eb2764
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 28 10:31:03 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150427' into staging

      target-arm queue:
       * memory system updates to support transaction attributes
       * set user-mode and secure attributes for accesses made by ARM CPUs
       * rename c1_coproc to cpacr_el1
       * adjust id_aa64pfr0 when has_el3 CPU property disabled
       * allow ARMv8 SCR.SMD updates

      # gpg: Signature made Mon Apr 27 16:14:30 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150427:
        Allow ARMv8 SCR.SMD updates
        target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled
        target-arm: rename c1_coproc to cpacr_el1
        target-arm: Check watchpoints against CPU security state
        target-arm: Use attribute info to handle user-only watchpoints
        target-arm: Add user-mode transaction attribute
        target-arm: Use correct memory attributes for page table walks
        target-arm: Honour NS bits in page tables
        Switch non-CPU callers from ld/st*_phys to address_space_ld/st*
        exec.c: Capture the memory attributes for a watchpoint hit
        exec.c: Add new address_space_ld*/st* functions
        exec.c: Make address_space_rw take transaction attributes
        exec.c: Convert subpage memory ops to _with_attrs
        Add MemTxAttrs to the IOTLB
        Make CPU iotlb a structure rather than a plain hwaddr
        memory: Replace io_mem_read/write with memory_region_dispatch_read/write
        memory: Define API for MemoryRegionOps to take attrs and return status

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7824df3889499acc7466317175a3fb24a0824002
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Tue Apr 21 11:26:12 2015 +0300

      acpi: add a missing backslash to the \_SB scope.

      A predefined scope in the ACPI specs is precede with a backslash.

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit bc09e06113e79e5d70cf2b37015a26f2102cc03e
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:22 2015 +0800

      qmp-event: add event notification for memory hot unplug error

      When memory hot unplug fails, this patch adds support to send
      QMP event to notify mgmt about this failure.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c06b2ffb02bfcc642c67300d2c4dffd5aa54932b
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:21 2015 +0800

      acpi: add hardware implementation for memory hot unplug

      - implements QEMU hardware part of memory hot unplug protocol
        described at "docs/spec/acpi_mem_hotplug.txt"
      - handles memory remove notification event
      - handles device eject notification

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 660e8ec70065c8b1fd68b2cb137de16d831959f4
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:20 2015 +0800

      acpi: fix "Memory device control fields" register

      0 bit in Memory device control fields must be cleared before writing to
      register. But now this field isn't cleared when other fields are written.

      To solve this bug, This patch fixes UpdateRule to WriteAsZeros in "Memory
      device control fields" register.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af5098973136029211848b4999ad5d38bc90180f
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:19 2015 +0800

      acpi: extend aml_field() to support UpdateRule

      The flags field is declared with default update rule 'Preserve',
      this patch extends aml_field() to support UpdateRule so that we
      can specify different values per field.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f7d3e29db5a5900a1f0ed10f8313f7c3f28e5b59
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:18 2015 +0800

      acpi, mem-hotplug: add unplug cb for memory device

      This patch adds unplug cb for memory device. It resets memory status
      "is_enabled" in acpi_memory_unplug_cb(), removes the corresponding
      memory region, unregisters vmstate, and unparents the object.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 64fec58e8ab62490edd2638e4214d8c9f84518c9
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:17 2015 +0800

      acpi, mem-hotplug: add unplug request cb for memory device

      This patch adds unplug request cb for memory device, and adds the
      is_removing boolean field to MemStatus. This field is used to indicate
      whether the memory device in slot has been requested to be ejected.
      This field is set to true in acpi_memory_unplug_request_cb().

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4aae99b63333e71b2097b106bb15a6fde7f9b55b
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:16 2015 +0800

      acpi, mem-hotplug: add acpi_memory_slot_status() to get MemStatus

      Add a new API named acpi_memory_slot_status() to obtain a single memory
      slot status. Doing this is because this procedure will be used by other
      functions in the next coming patches.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4fccb4834d0455519ff6d7a81551a8dfd360fefa
  Author: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
  Date:   Mon Apr 27 16:47:15 2015 +0800

      docs: update documentation for memory hot unplug

      Add specification about how to use memory hot unplug, and add
      a flow diagram to explain memory hot unplug process.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 850d00700ba787988b6c5404e8c1a3add7141db1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Apr 27 21:01:20 2015 +0200

      virtio: coding style tweak

      no space needed after *.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a0ccd2123ee2f83a1f081e4c39013c3316f9ec7a
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:49 2015 +0800

      pci: remove hard-coded bar size in msix_init_exclusive_bar()

      This patch lets msix_init_exclusive_bar() can calculate the bar and
      pba size based on the number of MSI-X vectors other than using a
      hard-coded limit 4096. This is needed to allow device to have more
      than 128 MSI_X vectors. To keep migration compatibility, keep using
      4096 as bar size and 2048 for pba offset.

      Notes: We don't care about the case that using vectors > 128 for
      legacy machine type. Since we limit the queue max to 64, so vectors >=
      65 is meaningless.

      Virtio device will be the first user for this.

      Cc: Keith Busch <keith.busch@intel.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 851c2a75a6e80c8aa5e713864d98cfb512e7229b
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:47 2015 +0800

      virtio-pci: speedup MSI-X masking and unmasking

      This patch tries to speed up the MSI-X masking and unmasking through
      the mapping between vector and queues. With this patch it will there's
      no need to go through all possible virtqueues, which may help to
      reduce the time spent when doing MSI-X masking/unmasking a single
      vector when more than hundreds or even thousands of virtqueues were
      supported.

      Tested with 80 queue pairs virito-net-pci by changing the smp affinity
      in the background and doing netperf in the same time:

      Before the patch:
      5711.70 Gbits/sec
      After the patch:
      6830.98 Gbits/sec

      About 19.6% improvements in throughput.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e0d686bf4b9d018ba5449f057b486bb5e1fa1a0d
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:46 2015 +0800

      virtio: introduce vector to virtqueues mapping

      Currently we will try to traverse all virtqueues to find a subset that
      using a specific vector. This is sub optimal when we will support
      hundreds or even thousands of virtqueues. So this patch introduces a
      method which could be used by transport to get all virtqueues that
      using a same vector. This is done through QLISTs and the number of
      QLISTs was queried through a transport specific method. When guest
      setting vectors, the virtqueue will be linked and helpers for traverse
      the list was also introduced.

      The first user will be virtio pci which will use this to speed up
      MSI-X masking and unmasking handling.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 955cc8c9541779e09895a9c5ccbf8ace15d884f5
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:40 2015 +0800

      virtio-ccw: using VIRTIO_NO_VECTOR instead of 0 for invalid virtqueue

      It's a bad idea to need to use vector 0 for invalid virtqueue. So this patch
      changes to using VIRTIO_NO_VECTOR instead.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      CC: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit bcfa4d60144fb879f0ffef0a6d174faa37b2df82
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:39 2015 +0800

      monitor: check return value of qemu_find_net_clients_except()

      qemu_find_net_clients_except() may return a value which is greater
      than the size of array we provided. So we should check this value
      before using it, otherwise this may cause unexpected memory access.

      This patch fixes the net related command completion when we have a
      virtio-net nic with more than 255 queues.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit eaed483c1b3db1ac312116fca5d20c45b4b418b2
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:38 2015 +0800

      monitor: replace the magic number 255 with MAX_QUEUE_NUM

      This patch replace the magic number 255, and increase it to
      MAX_QUEUE_NUM which is maximum number of queues supported by a nic.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d25228e7befac33b665cd9250292de47ae6b78b5
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:37 2015 +0800

      ppc: spapr: add 2.4 machine type

      The following patches will limit the following things to legacy
      machine type:

      - maximum number of virtqueues for virtio-pci were limited to 64

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      Reviewed-by: Alexander Graf <agraf@suse.de>

  commit 3d27b09cf6f62ec61c1330d0a811811a91e7514d
  Merge: 3f9d69b 700cd85
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 20:00:57 2015 +0100

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150427-1' into staging

      spice: misc fixes.

      # gpg: Signature made Mon Apr 27 12:03:16 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150427-1:
        spice: learn to hide cursor
        spice: set pointer position on hotspot
        spice: fix mouse cursor position
        spice: fix simple display on bigendian hosts
        monitor: Make client_migrate_info synchronous

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b0e966d0209fa5c93d510d1756a87dd4229b1f8a
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:36 2015 +0800

      spapr: add machine type specific instance init function

      This patches adds machine type specific instance initialization
      functions. Those functions will be used by following patches to compat
      class properties for legacy machine types.

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 5cb50e0acc7ba6063b87664404103cce217c0493
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:35 2015 +0800

      pc: add 2.4 machine types

      The following patches will limit the following things to legacy
      machine type:

      - maximum number of virtqueues for virtio-pci were limited to 64
      - auto msix bar size for virtio-net-pci were disabled by default

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 27a46dcf5038e20451101ed2d5414aebf3846e27
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Apr 23 14:21:34 2015 +0800

      virtio-net: fix the upper bound when trying to delete queues

      Virtqueue were indexed from zero, so don't delete virtqueue whose
      index is n->max_queues * 2 + 1.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 294ce717e0f212ed0763307f3eab72b4a1bdf4d0
  Author: Luke Gorrie <luke@snabb.co>
  Date:   Sun Apr 26 15:00:49 2015 +0200

      vhost-user: Send VHOST_RESET_OWNER on vhost stop

      Ensure that the vhost-user slave knows when the vrings are valid and
      when they are invalid, for example during a guest reboot.

      The vhost-user protocol says this of VHOST_RESET_OWNER:

            Issued when a new connection is about to be closed. The Master
            will no longer own this connection (and will usually close it).

      Send this message to tell the vhost-user slave that the vhost session
      has ended and that session state (e.g. vrings) is no longer valid.

      Signed-off-by: Luke Gorrie <luke@snabb.co>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 658c27181bf3b08a9cf2fab00ecce7f76065f6af
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Apr 3 18:03:34 2015 +0800

      hw/i386/acpi-build: move generic acpi building helpers into dedictated file

      Move generic acpi building helpers into dedictated file and this
      can be shared with other machines.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 395e5fb4421a03c9d3a002bbb55d56b74024a568
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Fri Apr 3 18:03:33 2015 +0800

      hw/i386: Move ACPI header definitions in an arch-independent location

      The ACPI related header file acpi-defs.h, includes definitions that
      apply on other architectures as well. Move it in `include/hw/acpi/`
      to sanely include it from other architectures.

      Signed-off-by: Alvise Rigo <a.rigo@virtualopensystems.com>
      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 853cff8e2815c99429d53baa71110416c1de2798
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Apr 15 10:55:46 2015 +0200

      acpi-build: close } in comment

      missing } confuses editors

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 726a8ff68677d8d5fba17eb0ffb85076bfb598dc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Apr 10 14:45:00 2015 -0300

      target-i386: Remove AMD feature flag aliases from CPU model table

      When CPU vendor is AMD, the AMD feature alias bits on
      CPUID[0x80000001].EDX are already automatically copied from CPUID[1].EDX
      on x86_cpu_realizefn(). When CPU vendor is Intel, those bits are
      reserved and should be zero. On either case, those bits shouldn't be set
      in the CPU model table.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 01431f3ce0f31e123172cc99c12c98c0ddbe9917
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 2 17:22:27 2015 -0300

      target-i386: X86CPU::xlevel2 QOM property

      We already have "level" and "xlevel", only "xlevel2" is missing.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b9472b76d273c7796d877c49af50969c0a879c50
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Apr 2 17:21:53 2015 -0300

      target-i386: Make "level" and "xlevel" properties static

      Static properties require only 1 line of code, much simpler than the
      existing code that requires writing new getters/setters.

      As a nice side-effect, this fixes an existing bug where the setters were
      incorrectly allowing the properties to be changed after the CPU was
      already realized.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d9f7e29ee5a6915caa049ba64c0a9f28766351d2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 14:57:31 2015 -0300

      qemu-config: Accept empty option values

      Currently it is impossible to set an option in a config file to an empty
      string, because the parser matches only lines containing non-empty
      strings between double-quotes.

      As sscanf() "[" conversion specifier only matches non-empty strings, add
      a special case for empty strings.

      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit b203a4ba93fc25bf1eb49039a8ec4b260b446211
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:36:24 2015 -0300

      MAINTAINERS: Change status of X86 to Maintained

      "Odd Fixes" doesn't reflect the current status of target-i386. We have
      people looking after it, now.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e1a0433956bbe68b56853e6ae633a5004b1f6351
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:34:56 2015 -0300

      MAINTAINERS: Add myself to X86

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3f9d69ba12da6f2874631f6e426a7ef148ba4c82
  Merge: 0d81cdd 1a01716
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 19:06:08 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150427-1' into staging

      gtk: support text consoles without vte, bugfixes.

      # gpg: Signature made Mon Apr 27 14:34:15 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150427-1:
        gtk: Avoid accel key leakage into guest on console switch
        gtk: Fix VTE focus grabbing
        console/gtk: add qemu_console_get_label
        gtk: bind to text terminal consoles too
        gtk: handle switch_surface(NULL) properly

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2f54eb98c3255154dc6bdbb8b38982af9b3f3a8f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Apr 8 08:34:33 2015 -0300

      MAINTAINERS: Add myself as NUMA code maintainer

      The "srat" and "numa" keywords will help get_maintainer.pl catch
      NUMA-related code in other files too.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0d81cdddaa40a1988b24657aeac19959cfad0fde
  Merge: e1a5476 2d5a834
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 27 17:28:41 2015 +0100

      Merge remote-tracking branch 'remotes/qmp-unstable/tags/for-upstream' into staging

      Four little fixes

      # gpg: Signature made Fri Apr 24 19:56:51 2015 BST using RSA key ID E24ED5A7
      # gpg: Good signature from "Luiz Capitulino <lcapitulino@gmail.com>"

      * remotes/qmp-unstable/tags/for-upstream:
        qmp: Give saner messages related to qmp_capabilities misuse
        qmp-commands: fix incorrect uses of ":O" specifier
        qapi: Drop dead genlist parameter
        balloon: improve error msg when adding second device

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 23820dbfc79d1c9dce090b4c555994f2bb6a69b3
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 16 22:35:54 2015 -0700

      exec: Respect as_translate_internal length clamp

      address_space_translate_internal will clamp the *plen length argument
      based on the size of the memory region being queried. The iommu walker
      logic in addresss_space_translate was ignoring this by discarding the
      post fn call value of *plen. Fix by just always using *plen as the
      length argument throughout the fn, removing the len local variable.

      This fixes a bootloader bug when a single elf section spans multiple
      QEMU memory regions.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1426570554-15940-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4080a13c11398d684668d286da27b6f8ee668e44
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:35:00 2015 +0200

      ioport: reserve the whole range of an I/O port in the AddressSpace

      When an I/O port is more than 1 byte long, ioport.c is currently
      creating "short" regions, for example 0x1ce-0x1ce for the 16-bit
      Bochs index port.  When I/O ports are memory mapped, and thus
      accessed via a subpage_ops memory region, subpage_accepts gets
      confused because it finds a hole at 0x1cf and rejects the access.

      In order to fix this, modify registration of the region to cover
      the whole size of the I/O port.  Attempts to access an invalid
      port will be blocked by find_portio returning NULL.

      This only affects the VBE DISPI regions.  For all other cases,
      the MemoryRegionPortio entries for 2- or 4-byte accesses overlap
      an entry for 1-byte accesses, thus the size of the memory region
      is not affected.

      Reported-by: Zoltan Balaton <balaton@eik.bme.hu>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 147ed379838176d4780688157891c06f49403b19
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:49:40 2015 +0200

      ioport: loosen assertions on emulation of 16-bit ports

      Right now, ioport.c assumes that the entire range specified with
      MemoryRegionPortio includes a region with size == 1.  This however
      is not true for the VBE DISPI ports, which are 16-bit only.  The
      next patch will make these regions' length equal to two, which can
      cause the assertions to trigger.  Replace them with simple conditionals.

      Also, ioport.c will emulate a 16-bit ioport with two distinct reads
      or writes, even if one of the two accesses is out of the bounds given
      by the MemoryRegionPortio array.  Do not do this anymore, instead
      discard writes to the incorrect register and read it as all-ones.
      This ensures that the mrp->read and mrp->write callbacks get an
      in-range ioport number.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 30476b2282c69c9ec1e44e33a4c0b5d5f4bc884e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:50:36 2015 +0200

      ioport: remove wrong comment

      ioport.c has not been using an alias since commit b40acf9 (ioport:
      Switch dispatching to memory core layer, 2013-06-24).  Remove the
      obsolete comment.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e477317cce98c399a2299d025bcb6bf0fd69df49
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 13:19:16 2015 +0200

      ide: there is only one data port

      IDE PIO data must be written, for example, at 0x1f0.  You cannot
      do word or dword writes to 0x1f1..0x1f3 to access the data register.
      Adjust the ide_portio_list accordingly.

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 54da54e543eea8e689a625fcb3dada1b296f5d3d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 13:12:32 2015 +0200

      gus: clean up MemoryRegionPortio

      Remove 16-bit reads/writes, since ioport.c is able to synthesize them.
      Remove the two MIDI registers (0x300 and 0x301) from gus_portio_list1,
      and add the second MIDI register (0x301) to gus_portio_list2.

      Tested with Second Reality.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3337d0b2794131425d0b5cb525e67c5989f4a9dd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 30 12:34:17 2015 +0200

      sb16: remove useless mixer_write_indexw

      ioport.c is already able to split a 16-bit access into two 8-bit
      accesses to consecutive ports.  Tested with Epic Pinball.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0e1cd6576c55269b6e5251dc739a7fc819f9b4a6
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Apr 2 16:09:30 2015 +0100

      sun4m: fix slavio sysctrl and led register sizes

      These were being incorrectly declared as MISC_SIZE (1 byte) rather than
      4 bytes and 2 bytes respectively. As a result accesses clamped to the
      real register size would unexpectedly fail.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      CC: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1427987370-15897-1-git-send-email-mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 339240b5cd42bd13d4f6629f2aedf8b4b07459fb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:24:16 2015 +0100

      acpi-build: remove dependency from ram_addr.h

      ram_addr_t is an internal interface, everyone should go through
      MemoryRegion.  Clean it up by making rom_add_blob return a
      MemoryRegion* and using the new qemu_ram_resize infrastructure.

      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 37d7c08413cd4307f53c83d43b1b06cf2701d7a7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 10:21:46 2015 +0100

      memory: add memory_region_ram_resize

      This is a simple MemoryRegion wrapper for qemu_ram_resize.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e95205e1f9cd2c4262b7a7b1c992a94512c86d0e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:37 2015 +0800

      dma-helpers: Fix race condition of continue_after_map_failure and dma_aio_cancel

      If DMA's owning thread cancels the IO while the bounce buffer's owning thread
      is notifying the "cpu client list", a use-after-free happens:

           continue_after_map_failure               dma_aio_cancel
           ------------------------------------------------------------------
           aio_bh_new
                                                    qemu_bh_delete
           qemu_bh_schedule (use after free)

      Also, the old code doesn't run the bh in the right AioContext.

      Fix both problems by passing a QEMUBH to cpu_register_map_client.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1426496617-10702-6-git-send-email-famz@redhat.com>
      [Remove unnecessary forward declaration. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 33b6c2edf6214f02b9beaea61b169506c01f90aa
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:36 2015 +0800

      exec: Notify cpu_register_map_client caller if the bounce buffer is available

      The caller's workflow is like

          if (!address_space_map()) {
              ...
              cpu_register_map_client();
          }

      If bounce buffer became available after address_space_map() but before
      cpu_register_map_client(), the caller could miss it and has to wait for the
      next bounce buffer notify, which may never happen in the worse case.

      Just notify the list in cpu_register_map_client().

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-5-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 38e047b50d2bfd1df99fbbca884c9f1db0785ff4
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:35 2015 +0800

      exec: Protect map_client_list with mutex

      So that accesses from multiple threads are safe.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-4-git-send-email-famz@redhat.com>
      [Remove #if from cpu_exec_init_all. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 02f4035c47b4d34cdc61780292ee288f400b9c49
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:34 2015 +0800

      linux-user, bsd-user: Remove two calls to cpu_exec_init_all

      The function is a nop for user mode, so just remove them.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c2cba0ffe495b60c4cc58080281e99c7a6580d4b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 16 17:03:33 2015 +0800

      exec: Atomic access to bounce buffer

      There could be a race condition when two processes call
      address_space_map concurrently and both want to use the bounce buffer.

      Add an in_use flag in BounceBuffer to sync it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426496617-10702-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e3a0abfda71db1fa83be894dcff7c4871b36cc8d
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Thu Apr 9 16:07:33 2015 -0400

      translate-all: use glib for all page descriptor allocations

      Since commit

        b7b5233a "bsd-user/mmap.c: Don't try to override g_malloc/g_free"

      the exception we make here for usermode has been unnecessary.
      Get rid of it.

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Message-Id: <1428610053-26148-1-git-send-email-cota@braap.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 700cd855def54c2a9f2b6a016dcebf75fe19c238
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:13 2015 +0100

      spice: learn to hide cursor

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit dc8dceee64f45820c20f3ffa3c3fecd7b6539990
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:12 2015 +0100

      spice: set pointer position on hotspot

      The Spice protocol uses cursor position on hotspot: the client is
      applying hotspot offset when drawing the cursor.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d0df04a1569c75f6442123fdda0b2e9aadc3fcc7
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Mar 24 17:50:11 2015 +0100

      spice: fix mouse cursor position

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c1d37cd353be3ea4c5773fc227ba8459c1f20470
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Apr 14 08:56:21 2015 +0200

      spice: fix simple display on bigendian hosts

      Denis Kirjanov is busy getting spice run on ppc64 and trapped into this
      one.  Spice wire format is little endian, so we have to explicitly say
      we want little endian when letting pixman convert the data for us.

      Reported-by: Denis Kirjanov <kirjanov@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3b5704b2f80189b2f9fdddf1690998e566eeacab
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 5 09:30:16 2015 +0100

      monitor: Make client_migrate_info synchronous

      Live migration with spice works like this today:

        (1) client_migrate_info monitor cmd
        (2) spice server notifies client, client connects to target host.
        (3) qemu waits until spice client connect is finished.
        (4) send over vmstate (i.e. main part of live migration).
        (5) spice handover to target host.

      (3) is implemented by making client_migrate_info a async monitor
      command.  This is the only async monitor command we have.

      The original reason to implement this dance was that qemu did not accept
      new tcp connections while the incoming migration was running, so (2) and
      (4) could not be done in parallel.  That issue was fixed long ago though.
      Qemu version 1.3.0 (released Dec 2012) and newer happily accept tcp
      connects while the incoming migration runs.

      Time to drop step (3).  This patch does exactly that, by making the
      monitor command synchronous and removing the code needed to handle the
      async monitor command in ui/spice-core.c

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1a01716a307387e5cf1336f61a96f772dddadc90
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Apr 26 21:04:21 2015 +0200

      gtk: Avoid accel key leakage into guest on console switch

      GTK2 sends the accel key to the guest when switching to the graphic
      console via that shortcut. Resolve this by ignoring any keys until the
      next key-release event. However, do not ignore keys when switching via
      the menu or when on GTK3.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9d677e1c2fa479336fb7a2b90aea78c10d037e98
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Sun Apr 26 21:04:20 2015 +0200

      gtk: Fix VTE focus grabbing

      At least on GTK2, the VTE terminal has to be specified as target of
      gtk_widget_grab_focus. Otherwise, switching from one VTE terminal to
      another causes the focus to get lost.

      CC: John Snow <jsnow@redhat.com>
      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

      [ kraxel: fixed build with CONFIG_VTE=n ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4eb276408363aef5435a72a8e818f24220b5edd0
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Sun Apr 26 16:49:26 2015 +0100

      Allow ARMv8 SCR.SMD updates

      Updated scr_write to always allow updates to the SCR.SMD bit on ARMv8
      regardless of whether virtualization (EL2) is enabled or not.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1429888797-4378-1-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d5c84ff21a8a7a3bfb3a75154be8905e62f51db
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Sun Apr 26 16:49:26 2015 +0100

      target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Message-id: 1429669112-29835-1-git-send-email-serge.fdrv@gmail.com
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7ebd5f2e03a00889619bb97e83062d27066d4a26
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: rename c1_coproc to cpacr_el1

      Rename the field holding CPACR_EL1 system register state in AArch64
      naming style.

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      [PMM: also fixed a couple of missed occurrences in cpu.c]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ef7bab8d73580b48bda83b8d16b5eea8a3ac43fe
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Check watchpoints against CPU security state

      Fix a TODO in bp_wp_matches() now that we have a function for
      testing whether the CPU is currently in Secure mode or not.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 9e1fc5bdfdf94564abf7621c0ef644599196360f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Use attribute info to handle user-only watchpoints

      Now that we have memory access attribute information in the watchpoint
      checking code, we can correctly implement handling of watchpoints
      which should match only on userspace accesses, where LDRT/STRT/LDT/STT
      from EL1 are treated as userspace accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 0995bf8cd91b81ec9c1078e37b808794080dc5c0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Add user-mode transaction attribute

      Add a transaction attribute indicating that a memory access is being
      done from user-mode (unprivileged). This corresponds to an equivalent
      signal in ARM AMBA buses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit ebca90e4c3aaaae5ed1ee7c569dea00d5d6ed476
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Use correct memory attributes for page table walks

      Factor out the page table walk memory accesses into their own function,
      so that we can specify the correct S/NS memory attributes for them.
      This will also provide a place to use the correct endianness and
      handle the need for a stage-2 translation when virtualization is
      supported.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 8bf5b6a9c1911d2c8473385fc0cebfaaeef42dbc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:25 2015 +0100

      target-arm: Honour NS bits in page tables

      Honour the NS bit in ARM page tables:
       * when adding entries to the TLB, include the Secure/NonSecure
         transaction attribute
       * set the NS bit in the PAR when doing ATS operations

      Note that we don't yet correctly use the NSTable bit to
      cause the page table walk itself to use the right attributes.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 42874d3a8c6267ff7789a0396843c884b1d0933a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      Switch non-CPU callers from ld/st*_phys to address_space_ld/st*

      Switch all the uses of ld/st*_phys to address_space_ld/st*,
      except for those cases where the address space is the CPU's
      (ie cs->as). This was done with the following script which
      generates a Coccinelle patch.

      A few over-80-columns lines in the result were rewrapped by
      hand where Coccinelle failed to do the wrapping automatically,
      as well as one location where it didn't put a line-continuation
      '\' when wrapping lines on a change made to a match inside
      a macro definition.

      ===begin===
      #!/bin/sh -e
      # Usage:
      # ./ldst-phys.spatch.sh > ldst-phys.spatch
      # spatch -sp_file ldst-phys.spatch -dir . | sed -e '/^+/s/\t/        /g' > out.patch
      # patch -p1 < out.patch

      for FN in ub uw_le uw_be l_le l_be q_le q_be uw l q; do
      cat <<EOF
      @ cpu_matches_ld_${FN} @
      expression E1,E2;
      identifier as;
      @@

      ld${FN}_phys(E1->as,E2)

      @ other_matches_ld_${FN} depends on !cpu_matches_ld_${FN} @
      expression E1,E2;
      @@

      -ld${FN}_phys(E1,E2)
      +address_space_ld${FN}(E1,E2, MEMTXATTRS_UNSPECIFIED, NULL)

      EOF

      done

      for FN in b w_le w_be l_le l_be q_le q_be w l q; do
      cat <<EOF
      @ cpu_matches_st_${FN} @
      expression E1,E2,E3;
      identifier as;
      @@

      st${FN}_phys(E1->as,E2,E3)

      @ other_matches_st_${FN} depends on !cpu_matches_st_${FN} @
      expression E1,E2,E3;
      @@

      -st${FN}_phys(E1,E2,E3)
      +address_space_st${FN}(E1,E2,E3, MEMTXATTRS_UNSPECIFIED, NULL)

      EOF

      done
      ===endit===

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 66b9b43c42049bcae37668e890fedde9a72c8167
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Capture the memory attributes for a watchpoint hit

      Capture the memory attributes for the transaction which triggered
      a watchpoint; this allows CPU specific code to implement features
      like ARM's "user-mode only WPs also hit for LDRT/STRT accesses
      made from privileged code". This change also correctly passes
      through the memory attributes to the underlying device when
      a watchpoint access doesn't hit.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 500131154d677930fce35ec3a6f0b5a26bcd2973
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Add new address_space_ld*/st* functions

      Add new address_space_ld*/st* functions which allow transaction
      attributes and error reporting for basic load and stores. These
      are named to be in line with the address_space_read/write/rw
      buffer operations.

      The existing ld/st*_phys functions are now wrappers around
      the new functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 5c9eb0286c819c1836220a32f2e1a7b5004ac79a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Make address_space_rw take transaction attributes

      Make address_space_rw take transaction attributes, rather
      than always using the 'unspecified' attributes.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit f25a49e0057bbfcc2b1111f60785d919b6ddaeea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      exec.c: Convert subpage memory ops to _with_attrs

      Convert the subpage memory ops to _with_attrs; this will allow
      us to pass the attributes through to the underlying access
      functions. (Nothing uses the attributes yet.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit fadc1cbe85c6b032d5842ec0d19d209f50fcb375
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:24 2015 +0100

      Add MemTxAttrs to the IOTLB

      Add a MemTxAttrs field to the IOTLB, and allow target-specific
      code to set it via a new tlb_set_page_with_attrs() function;
      pass the attributes through to the device when making IO accesses.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit e469b22ffda40188954fafaf6e3308f58d50f8f8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      Make CPU iotlb a structure rather than a plain hwaddr

      Make the CPU iotlb a structure rather than a plain hwaddr;
      this will allow us to add transaction attributes to it.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 3b6434953934e6d4a776ed426d8c6d6badee176f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      memory: Replace io_mem_read/write with memory_region_dispatch_read/write

      Rather than retaining io_mem_read/write as simple wrappers around
      the memory_region_dispatch_read/write functions, make the latter
      public and change all the callers to use them, since we need to
      touch all the callsites anyway to add MemTxAttrs and MemTxResult
      support. Delete io_mem_read and io_mem_write entirely.

      (All the callers currently pass MEMTXATTRS_UNSPECIFIED
      and convert the return value back to bool or ignore it.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit cc05c43ad942165ecc6ffd39e41991bee43af044
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Apr 26 16:49:23 2015 +0100

      memory: Define API for MemoryRegionOps to take attrs and return status

      Define an API so that devices can register MemoryRegionOps whose read
      and write callback functions are passed an arbitrary pointer to some
      transaction attributes and can return a success-or-failure status code.
      This will allow us to model devices which:
       * behave differently for ARM Secure/NonSecure memory accesses
       * behave differently for privileged/unprivileged accesses
       * may return a transaction failure (causing a guest exception)
         for erroneous accesses

      This patch defines the new API and plumbs the attributes parameter through
      to the memory.c public level functions io_mem_read() and io_mem_write(),
      where it is currently dummied out.

      The success/failure response indication is also propagated out to
      io_mem_read() and io_mem_write(), which retain the old-style
      boolean true-for-error return.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit e1a5476354d396773e4c555f126d752d4ae58fa9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Apr 25 22:05:07 2015 +0100

      Open 2.4 development tree

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2d5a8346a484250934526a15b3a522bdba7e6772
  Author: Eric Blake <eblake@redhat.com>
  Date:   Wed Apr 15 09:19:23 2015 -0600

      qmp: Give saner messages related to qmp_capabilities misuse

      Pretending that QMP doesn't understand a command merely because
      we are not in the right mode doesn't help first-time users figure
      out what to do to correct things.  Although the documentation for
      QMP calls out capabilities negotiation, we should also make it
      clear in our error messages what we were expecting.  With this
      patch, I now get the following transcript:

      $ ./x86_64-softmmu/qemu-system-x86_64 -qmp stdio -nodefaults
      {"QMP": {"version": {"qemu": {"micro": 93, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
      {"execute":"huh"}
      {"error": {"class": "CommandNotFound", "desc": "The command huh has not been found"}}
      {"execute":"quit"}
      {"error": {"class": "CommandNotFound", "desc": "Expecting capabilities negotiation with 'qmp_capabilities' before command 'quit'"}}
      {"execute":"qmp_capabilities"}
      {"return": {}}
      {"execute":"qmp_capabilities"}
      {"error": {"class": "CommandNotFound", "desc": "Capabilities negotiation is already complete, command 'qmp_capabilities' ignored"}}
      {"execute":"quit"}
      {"return": {}}
      {"timestamp": {"seconds": 1429110729, "microseconds": 181935}, "event": "SHUTDOWN"}

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Tested-By: Kashyap Chamarthy <kchamart@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 43d0a2c1af5bc77ed067636db956209779351dfe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 15 13:30:04 2015 +0200

      qmp-commands: fix incorrect uses of ":O" specifier

      As far as the QMP parser is concerned, neither the 'O' nor the 'q' format specifiers
      put any constraint on the command.  However, there are two differences:

      1) from a documentation point of view 'O' says that this command takes
      a dictionary.  The dictionary will be converted to QemuOpts in the
      handler to match the corresponding HMP command.

      2) 'O' sets QMP_ACCEPT_UNKNOWNS, resulting in the command accepting invalid
      extra arguments.  For example the following is accepted:

         { "execute": "send-key",
              "arguments": { "keys": [ { "type": "qcode", "data": "ctrl" },
                                       { "type": "qcode", "data": "alt" },
                                       { "type": "qcode", "data": "delete" } ], "foo": "bar" } }

      Neither send-key nor migrate-set-capabilities take a QemuOpts-like
      dictionary; they take an array of dictionaries.  And neither command
      really wants to have extra unknown arguments.  Thus, the right
      specifier to use in this case is 'q'; with this patch the above
      command fails with

         {"error": {"class": "GenericError", "desc": "Invalid parameter 'foo'"}}

      as intended.

      Reported-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alberto Garcia <berto@igalia.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 6540e9f35bfeea2baf4509745516172070dca412
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri Apr 10 15:07:59 2015 -0600

      qapi: Drop dead genlist parameter

      Defaulting a parameter to True, then having all callers omit or
      pass an explicit True for that parameter, is pointless. Looks
      like it has been dead since introduction in commit 06d64c6, more
      than 4 years ago.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 46abb8124006887d071921c5e657eeec3c50a9e2
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Tue Mar 31 13:00:26 2015 -0400

      balloon: improve error msg when adding second device

      A VM supports only one balloon device, but due to several changes
      in infrastructure the error message got messed up when trying
      to add a second device. Fix it.

      Before this fix

      Command-line:

      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Another balloon device already registered
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Adding balloon handler failed
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Device 'virtio-balloon-pci' could not be initialized

      HMP:

      Another balloon device already registered
      Adding balloon handler failed
      Device 'virtio-balloon-pci' could not be initialized

      QMP:

      { "execute": "device_add", "arguments": { "driver": "virtio-balloon-pci", "id": "balloon0" } }
      {
      	"error": {
      		"class": "GenericError",
      		"desc": "Adding balloon handler failed"
      	}
      }

      After this fix

      Command-line:

      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Only one balloon device is supported
      qemu-qmp: -device virtio-balloon-pci,id=balloon0: Device 'virtio-balloon-pci' could not be initialized

      HMP:

      (qemu) device_add virtio-balloon-pci,id=balloon0
      Only one balloon device is supported
      Device 'virtio-balloon-pci' could not be initialized
      (qemu)

      QMP:

      { "execute": "device_add",
                "arguments": { "driver": "virtio-balloon-pci", "id": "balloon0" } }
      {
          "error": {
              "class": "GenericError",
              "desc": "Only one balloon device is supported"
          }
      }

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit e5b3a24181ea0cebf1c5b20f44d016311b7048f0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 24 15:05:06 2015 +0100

      Update version for v2.3.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 779ce88fbd3f977112bc77ccb028b0ace762105e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 10:41:08 2015 +0100

      console/gtk: add qemu_console_get_label

      Add a new function to get a nice label for a given QemuConsole.
      Drop the labeling code in gtk.c and use the new function instead.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f8c223f69ac58488ea830597281b7ddd33037c4c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu May 22 11:08:54 2014 +0200

      gtk: bind to text terminal consoles too

      This way gtk has text terminal consoles even when building without vte.
      Most notably you'll get a monitor tab on windows now.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f98f43eab0fcc536c5f95df3a94943d5dff5ccdc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Feb 27 14:36:09 2015 +0100

      gtk: handle switch_surface(NULL) properly

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f2a581010cb8e3a2564a45a2863a33a732cc2fc7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 20 17:13:16 2015 +0100

      Update version for v2.3.0-rc4 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e05ca8200216149008fa1b1d1d847bf16691f6b4
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Fri Apr 17 17:13:24 2015 +0200

      vhost: fix log base address

      VHOST_SET_LOG_BASE got an incorrect address, causing
      migration errors and potentially even memory corruption.

      Reported-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Message-id: 1429283565-32265-1-git-send-email-mst@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 638b8366200130cc7cf7a026630bc6bfb63b0c4c
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Apr 17 15:44:48 2015 +0300

      hmp: fix crash in 'info block -n -v'

      The image field in BlockDeviceInfo should never be null, however
      bdrv_block_device_info() is not filling it in.

      This makes the 'info block -n -v' command crash QEMU.

      The proper solution is probably to move the relevant code from
      bdrv_query_info() to bdrv_block_device_info(), but since we're too
      close to the release for that this simpler workaround solves the
      crash.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Message-id: 1429274688-8115-1-git-send-email-berto@igalia.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 87a8adc0876c11a434d3ecdfb10cd797259ddaaa
  Merge: b6df74c 0ca4f94
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 17 12:54:46 2015 +0100

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150417-2' into staging

      MIPS patches 2015-04-17

      Changes:
      * fix broken fulong2e

      # gpg: Signature made Fri Apr 17 12:14:37 2015 BST using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150417-2:
        mips: fix broken fulong2e machine

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b6df74c46528646f3163890cf16b74af551c3494
  Merge: 993ebe4 6cec43e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 17 12:37:38 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-fwcfg-20150414-1' into staging

      fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      # gpg: Signature made Tue Apr 14 12:22:20 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-fwcfg-20150414-1:
        fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ca4f94195cce77b624edc6d9abcf14a3bf01f06
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 16 21:11:23 2015 +0100

      mips: fix broken fulong2e machine

      After commit 5312bd8 the bonito_readl() and bonito_writel() have been
      accessing incorrect addresses. Consequently QEMU is crashing when trying
      to boot Linux kernel on fulong2e machine.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 993ebe4a0be9aa4e4821818a81fab00b1ab1a79a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Fri Apr 17 08:16:49 2015 +0100

      target-ppc: don't invalidate msr MSR_HVB bit in cpu_post_load

      The invalidation code introduced in commit 2360b works by inverting most bits
      of env->msr to ensure that hreg_store_msr() will forcibly update the CPU env
      state to reflect the new msr value post-migration. Unfortunately
      hreg_store_msr() is called with alter_hv set to 0 which preserves the MSR_HVB
      state from the CPU env which is now the opposite value to what it should be.

      Ensure that we don't invalidate the msr MSR_HVB bit during cpu_post_load so
      that the correct value is restored. This fixes suspend/resume for PPC64.

      Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1429255009-12751-1-git-send-email-mark.cave-ayland@ilande.co.uk
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6cec43e178cde38a3eac43a2cd741ce741b10f36
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Thu Apr 9 10:40:01 2015 -0400

      fw_cfg: add documentation file (docs/specs/fw_cfg.txt)

      This document covers the guest-side hardware interface, as
      well as the host-side programming API of QEMU's firmware
      configuration (fw_cfg) device.

      Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b8df9208f357d2b36e1b19634aea973618dc7ba8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Apr 13 17:35:44 2015 +0100

      Update version for v2.3.0-rc3 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ae6e8ef11e6cb43ec83a5846e8f3b266834cf280
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Apr 10 13:58:01 2015 +0100

      Revert seccomp tests that allow it to be used on non-x86 architectures

      Unfortunately it turns out that libseccomp 2.2 still does not work
      correctly on non-x86 architectures; return to the previous configure
      setup of insisting on libseccomp 2.1 or better and i386/x86_64 and
      disabling seccomp support in all other situations.

      This reverts the two commits:
       * "seccomp: libseccomp version varying according to arch"
         (commit 896848f0d3e2393905845ef2b244bb2601f9df0c)
       * "seccomp: update libseccomp version and remove arch restriction"
         (commit 8e27fc200457e3f2473d0069263774d4ba17bd85)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1428670681-23032-1-git-send-email-peter.maydell@linaro.org

  commit 4d0ecde44ae6dab3aa9d10c23e61d9d43789731a
  Author: Thomas Huth <thuth@redhat.com>
  Date:   Thu Apr 9 15:32:45 2015 +0200

      pci: Fix crash with illegal "-net nic, model=xxx" option

      Current QEMU crashes when specifying an illegal model with the
      "-net nic,model=xxx" option, e.g.:

       $ qemu-system-x86_64 -net nic,model=n/a
       qemu-system-x86_64: Unsupported NIC model: n/a

       Program received signal SIGSEGV, Segmentation fault.

      The gdb backtrace looks like this:

      0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
      152	    return err->msg;
      (gdb) bt
       0  0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
       1  0x0000555555965ffd in error_report_err (err=0x0) at util/error.c:157
       2  0x0000555555809c90 in pci_nic_init_nofail (nd=0x555555e49860 <nd_table>, rootbus=0x5555564409b0,
          default_model=0x55555598c37b "e1000", default_devaddr=0x0) at hw/pci/pci.c:1663
       3  0x0000555555691e42 in pc_nic_init (isa_bus=0x555556f71900, pci_bus=0x5555564409b0)
          at hw/i386/pc.c:1506
       4  0x000055555569396b in pc_init1 (machine=0x5555562abbf0, pci_enabled=1, kvmclock_enabled=1)
          at hw/i386/pc_piix.c:248
       5  0x0000555555693d27 in pc_init_pci (machine=0x5555562abbf0) at hw/i386/pc_piix.c:310
       6  0x000055555572ddf5 in main (argc=3, argv=0x7fffffffe018, envp=0x7fffffffe038) at vl.c:4226

      The problem is that pci_nic_init_nofail() does not check whether the err
      parameter from pci_nic_init has been set up and thus passes a NULL pointer
      to error_report_err(). Fix it by correctly checking the err parameter.

      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 342b0711cd62ddc08d334d879eac57b68f925fd5
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Apr 10 16:37:56 2015 +0200

      stm32f205: Fix SoC type name

      The type name for the SoC device, unlike those of its sub-devices,
      did not follow the QOM naming conventions. While the usage is internal
      only, this is exposed through QMP and HMP, so fix it before release.

      Cc: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Alistair Francis <alistair@alistair23.me>
      Message-id: 1428676676-23056-1-git-send-email-afaerber@suse.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c0c8584142a13e728178e51f2477c23a84ce74b4
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:15:10 2015 +0200

      cris: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 58c24a4775ef7ccf16cfcd695753dfdf149fe29d
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:14:14 2015 +0200

      alpha: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Cc: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Acked-by: Richard Henderson <rth@twiddle.net>
      Message-id: CAL5wTH64_ykF17cw2T1Axq8P3vCWm=6WbUJ3qJrLF-u+-MmzUw@mail.gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b7ccb83f44eca09e48c61866a090425c762598f0
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:16:18 2015 +0200

      lm32: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Acked-by: Michael Walle <michael@walle.cc>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 81b23ef82cd1be29ca3d69ab7e98b5b5e55926ce
  Author: Jan Beulich <jbeulich@suse.com>
  Date:   Tue Mar 31 15:18:03 2015 +0100

      xen: limit guest control of PCI command register

      Otherwise the guest can abuse that control to cause e.g. PCIe
      Unsupported Request responses (by disabling memory and/or I/O decoding
      and subsequently causing [CPU side] accesses to the respective address
      ranges), which (depending on system configuration) may be fatal to the
      host.

      This is CVE-2015-2756 / XSA-126.

      Signed-off-by: Jan Beulich <jbeulich@suse.com>
      Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Ian Campbell <ian.campbell@citrix.com>
      Message-id: alpine.DEB.2.02.1503311510300.7690@kaball.uk.xensource.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6a460ed18a3fda0eb2d9c96b8b01817b4dcbded4
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Apr 9 14:52:18 2015 +0100

      configure: disable Archipelago by default and warn about libxseg GPLv3 license

      libxseg has changed license to GPLv3.  QEMU includes GPL "v2 only" code
      which is not compatible with GPLv3.  This means the resulting binaries
      may not be redistributable!

      Disable Archipelago (libxseg) by default to prevent accidental license
      violations.  Also warn if linking against libxseg is enabled to remind
      the user.

      Note that this commit does not constitute any advice about software
      licensing.  If you have doubts you should consult a lawyer.

      Cc: Chrysostomos Nanakos <cnanakos@grnet.gr>
      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Reported-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1428587538-8765-1-git-send-email-stefanha@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a6f2cb037a82fb8679e70e175cfbc879dd829e06
  Merge: cf811ff 05b685f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 9 12:05:00 2015 +0100

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Apr  9 10:55:11 2015 BST using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block/iscsi: handle zero events from iscsi_which_events
        aio: strengthen memory barriers for bottom half scheduling
        virtio-blk: correctly dirty guest memory
        qcow2: Fix header update with overridden backing file

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cf811fff2ae20008f00455d0ab2212a4dea0b56f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 8 20:57:09 2015 +0100

      tcg/tcg-op.c: Fix ld/st of 64 bit values on 32-bit bigendian hosts

      Commit 951c6300f7 out-of-lined the 32-bit-host versions of
      tcg_gen_{ld,st}_i64, but in the process it inadvertently changed
      an #ifdef HOST_WORDS_BIGENDIAN to #ifdef TCG_TARGET_WORDS_BIGENDIAN.
      Since the latter doesn't get defined anywhere this meant we always
      took the "LE host" codepath, and stored the two halves of the value
      in the wrong order on BE hosts. This typically breaks any 64-bit
      guest on a 32-bit BE host completely, and will have possibly more
      subtle effects even for 32-bit guests.

      Switch the ifdef back to HOST_WORDS_BIGENDIAN.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1428523029-13620-1-git-send-email-peter.maydell@linaro.org

  commit 05b685fbabb7fdcab72cb42b27db916fd74b2265
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Apr 7 22:08:15 2015 +0200

      block/iscsi: handle zero events from iscsi_which_events

      newer libiscsi versions may return zero events from iscsi_which_events.

      In this case iscsi_service will return immediately without any progress.
      To avoid busy waiting for iscsi_which_events to change we deregister all
      read and write handlers in this case and schedule a timer to periodically
      check iscsi_which_events for changed events.

      Next libiscsi version will introduce async reconnects and zero events
      are returned while libiscsi is waiting for a reconnect retry.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1428437295-29577-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e8d3b1a25f284cdf9705b7cf0412281cc9ee3a36
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Apr 7 17:16:19 2015 +0200

      aio: strengthen memory barriers for bottom half scheduling

      There are two problems with memory barriers in async.c.  The fix is
      to use atomic_xchg in order to achieve sequential consistency between
      the scheduling of a bottom half and the corresponding execution.

      First, if bh->scheduled is already 1 in qemu_bh_schedule, QEMU does
      not execute a memory barrier to order any writes needed by the callback
      before the read of bh->scheduled.  If the other side sees req->state as
      THREAD_ACTIVE, the callback is not invoked and you get deadlock.

      Second, the memory barrier in aio_bh_poll is too weak.  Without this
      patch, it is possible that bh->scheduled = 0 is not "published" until
      after the callback has returned.  Another thread wants to schedule the
      bottom half, but it sees bh->scheduled = 1 and does nothing.  This causes
      a lost wakeup.  The memory barrier should have been changed to smp_mb()
      in commit 924fe12 (aio: fix qemu_bh_schedule() bh->ctx race condition,
      2014-06-03) together with qemu_bh_schedule()'s.  Guess who reviewed
      that patch?

      Both of these involve a store and a load, so they are reproducible on
      x86_64 as well.  It is however much easier on aarch64, where the
      libguestfs test suite triggers the bug fairly easily.  Even there the
      failure can go away or appear depending on compiler optimization level,
      tracing options, or even kernel debugging options.

      Paul Leveille however reported how to trigger the problem within 15
      minutes on x86_64 as well.  His (untested) recipe, reproduced here
      for reference, is the following:

         1) Qcow2 (or 3) is critical – raw files alone seem to avoid the problem.

         2) Use “cache=directsync” rather than the default of
         “cache=none” to make it happen easier.

         3) Use a server with a write-back RAID controller to allow for rapid
         IO rates.

         4) Run a random-access load that (mostly) writes chunks to various
         files on the virtual block device.

            a. I use ‘diskload.exe c:25’, a Microsoft HCT load
               generator, on Windows VMs.

            b. Iometer can probably be configured to generate a similar load.

         5) Run multiple VMs in parallel, against the same storage device,
         to shake the failure out sooner.

         6) IvyBridge and Haswell processors for certain; not sure about others.

      A similar patch survived over 12 hours of testing, where an unpatched
      QEMU would fail within 15 minutes.

      This bug is, most likely, also the cause of failures in the libguestfs
      testsuite on AArch64.

      Thanks to Laszlo Ersek for initially reporting this bug, to Stefan
      Hajnoczi for suggesting closer examination of qemu_bh_schedule, and to
      Paul for providing test input and a prototype patch.

      Reported-by: Laszlo Ersek <lersek@redhat.com>
      Reported-by: Paul Leveille <Paul.Leveille@stratus.com>
      Reported-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1428419779-26062-1-git-send-email-pbonzini@redhat.com
      Suggested-by: Paul Leveille <Paul.Leveille@stratus.com>
      Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c8623c0215e18eb4a8ec73eba014d97e51ed707e
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Sat Apr 4 14:24:38 2015 +0200

      arm: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-id: CAL5wTH4UHYKpJF=dLJfFzxpufjY189chnCow47-ySuLf8GLbug@mail.gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2a6cdd6d35158bc7a6aacd92b5b0302f28ec480e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 2 19:50:44 2015 +0200

      virtio-blk: correctly dirty guest memory

      After qemu_iovec_destroy, the QEMUIOVector's size is zeroed and
      the zero size ultimately is used to compute virtqueue_push's len
      argument.  Therefore, reads from virtio-blk devices did not
      migrate their results correctly.  (Writes were okay).

      Save the size in virtio_blk_handle_request, and use it when the request
      is completed.

      Based on a patch by Wen Congyang.

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Li Zhijian <lizhijian@cn.fujitsu.com>
      Message-id: 1427997044-392-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4603fe139e2161464d7e75faa3a650e31f057fc
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Apr 7 15:03:16 2015 +0200

      qcow2: Fix header update with overridden backing file

      In recent qemu versions, it is possible to override the backing file
      name and format that is stored in the image file with values given at
      runtime. In such cases, the temporary override could end up in the
      image header if the qcow2 header was updated, while obviously correct
      behaviour would be to leave the on-disk backing file path/format
      unchanged.

      Fix this and add a test case for it.

      Reported-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1428411796-2852-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5a24f20a7208a58fb80d78ca0521bba6f4d7b145
  Merge: f2155a0 9be6e69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Apr 7 14:33:46 2015 +0100

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-04-04' into staging

      trivial patches for 2015-04-04

      # gpg: Signature made Sat Apr  4 08:07:49 2015 BST using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-04-04:
        vhost: fix typo in vq_index description
        gitignore: Ignore more .pod files.
        target-tricore: Fix check which was always false
        target-i386: remove superfluous TARGET_HAS_SMC macro
        pcspk: Fix I/O port name

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9be6e69f12bc65e9c43ee5b8eb026412f11b8b71
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Thu Mar 26 12:10:29 2015 +0100

      vhost: fix typo in vq_index description

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Acked-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 085feb61dbc6130bfd2e6c3f59d03220ff9e1bb3
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri Mar 20 10:30:44 2015 -0600

      gitignore: Ignore more .pod files.

      kvm_stat.{1,pod} started showing up as untracked files in my
      directory, and I nearly accidentally merged them into a commit
      with my usual habit of 'git add .'.  Rather than spelling out
      each such file, just ignore the entire pattern.

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7b4b0b5795e934a9b7efb916af86715b68555be9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 21 14:44:58 2015 +0100

      target-tricore: Fix check which was always false

      With a mask value of 0x00400000, the result will never be 1.
      This fixes a Coverity warning.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c04146ad4696b20c440bfbb4a6ab27ea254e7ca
  Author: Emilio G. Cota <cota@braap.org>
  Date:   Sat Mar 21 13:29:09 2015 -0400

      target-i386: remove superfluous TARGET_HAS_SMC macro

      Signed-off-by: Emilio G. Cota <cota@braap.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ecf2e5a46d7559f258a2c914131ba25d3c5326bf
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Mar 19 13:08:40 2015 +0100

      pcspk: Fix I/O port name

      Probably a copy&paste bug. Fixing it helps identifying the device model
      behind port 0x61.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f2155a089600e80cf7bcdc814520ef3304882cc4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 18:02:02 2015 +0100

      Update version for v2.3.0-rc2 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 14655e9a18276d67eebad62a9c388ca5964bb353
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Apr 2 17:17:45 2015 +0200

      glib-compat: fix problems with not-quite glib 2.22

      Commit 89b516d8b9444ece8ccabb322a9389587c7a7b83 ("glib: add
      compatibility interface for g_get_monotonic_time()") aimed
      at making qemu build with old glib versions. At least SLES11SP3,
      however, contains a backport of g_get_monotonic_time() while
      keeping the reported glib version at 2.22.

      Let's work around this by a strategically placed #define.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-id: 1427987865-433-2-git-send-email-cornelia.huck@de.ibm.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8a7ef145d6e97853ce4ecc9277475e1726ff757
  Merge: 913fbe9 fb8597b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 15:53:16 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Another round of small fixes.  I am not including the
      virtio-blk fix, because Wen only posted a prototype and the changes
      I made were pretty large.  It definitely needs another pair of eyes
      (but it is a 2.3 regression and a blocker).

      # gpg: Signature made Thu Apr  2 14:59:56 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        Use $(MAKE) for recursive make
        kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap
        util/qemu-config: fix regression of qmp_query_command_line_options
        target-i386: clear bsp bit when designating bsp
        qga: fitering out -fstack-protector-strong
        target-i386: save 64-bit CR3 in 64-bit SMM state save area

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb8597bb65eff5c868db52668d21888e4fe7c27a
  Author: Ed Maste <emaste@freebsd.org>
  Date:   Wed Apr 1 13:58:38 2015 -0400

      Use $(MAKE) for recursive make

      On BSDs "make" is typically BSD make, while "gmake" is GNU make.

      Signed-off-by: Ed Maste <emaste@freebsd.org>
      Message-Id: <1427911118-21905-1-git-send-email-emaste@freebsd.org>
      [Fix $(INSTALLER) too as reported by Fam Zheng. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4cc856fabae1447d53890e707c70f257a7691174
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Apr 2 19:26:31 2015 +0000

      kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap

      Sometimes, we destroy the dirty_bitmap in kvm_memory_slot before any sync action
      occur, this bit in dirty_bitmap will be missed, and which will lead the corresponding
      dirty pages to be missed in migration.

      This usually happens when do migration during VM's Start-up or Reboot.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      [Use s->migration_log instead of exec.c's in_migration. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0a7cf217d81161e36af2344e911d56d4f9fef9c5
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Apr 1 19:47:21 2015 +0300

      util/qemu-config: fix regression of qmp_query_command_line_options

      Commit 49d2e64 (machine: remove qemu_machine_opts global list)
      made machine options specific to machine sub-type, leaving
      the qemu_machine_opts desc array empty. Sadly this is the place
      qmp_query_command_line_options is looking for supported options.

      As a fix for for 2.3 the machine_qemu_opts (the generic ones)
      are restored only for qemu-config scope.
      We need to find a better fix for 2.4.

      Reported-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Message-Id: <1427906841-1576-1-git-send-email-marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9cb11fd7539b5b787d8fb3834004804a58dd16ae
  Author: Nadav Amit <namit@cs.technion.ac.il>
  Date:   Thu Apr 2 02:58:36 2015 +0300

      target-i386: clear bsp bit when designating bsp

      Since the BSP bit is writable on real hardware, during reset all the CPUs which
      were not chosen to be the BSP should have their BSP bit cleared. This fix is
      required for KVM to work correctly when it changes the BSP bit.

      An additional fix is required for QEMU tcg to allow software to change the BSP
      bit.

      Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
      Message-Id: <1427932716-11800-1-git-send-email-namit@cs.technion.ac.il>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 420957a5982113416c5e442687de5e1ffaffeafc
  Author: Joseph Hindin <jhindin@daynix.com>
  Date:   Wed Apr 1 19:38:57 2015 +0300

      qga: fitering out -fstack-protector-strong

      configure script may add -fstack-protector-strong option instead
      of -fstack-protector-all, depending on availability ( see
      commit 63678e17c ). Both options have to by filtered out for
      qga-vss.dll, otherwise MinGW cross-compilation fails at linking
      stage.

      Signed-off-by: Joseph Hindin <jhindin@daynix.com>
      Message-Id: <1427906337-20805-2-git-send-email-jhindin@daynix.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cbea0c26e718191b57783f847ad2c805670439e8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Apr 2 14:13:55 2015 +0200

      target-i386: save 64-bit CR3 in 64-bit SMM state save area

      The x86_64 CR3 register is 64 bits wide, save all of them!

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 913fbe9a6a05296132b5fab431bf1c377a0bbf1a
  Merge: 11f10cf 9f9bdf4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 14:36:57 2015 +0100

      Merge remote-tracking branch 'remotes/armbru/tags/pull-hw-2015-04-02' into staging

      hw: Contain drive, serial, parallel, net misuse

      # gpg: Signature made Thu Apr  2 14:32:00 2015 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-hw-2015-04-02:
        sysbus: Make devices picking up backends unavailable with -device
        sdhci: Make device "sdhci-pci" unavailable with -device
        hw: Mark device misusing nd_table[] FIXME
        hw: Mark devices picking up char backends actively FIXME
        hw: Mark devices picking up block backends actively FIXME

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9f9bdf43cac28251f8cb33b77fed5e19225375c4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:34:40 2015 +0100

      sysbus: Make devices picking up backends unavailable with -device

      Device models aren't supposed to go on fishing expeditions for
      backends.  They should expose suitable properties for the user to set.
      For onboard devices, board code sets them.

      A number of sysbus devices pick up block backends in their init() /
      instance_init() methods with drive_get_next() instead: sl-nand,
      milkymist-memcard, pl181, generic-sdhci.

      Likewise, a number of sysbus devices pick up character backends in
      their init() / realize() methods with qemu_char_get_next_serial():
      cadence_uart, digic-uart, etraxfs,serial, lm32-juart, lm32-uart,
      milkymist-uart, pl011, stm32f2xx-usart, xlnx.xps-uartlite.

      All these mistakes are already marked FIXME.  See the commit that
      added these FIXMEs for a more detailed explanation of what's wrong.

      Fortunately, only machines ppce500 and pseries-* support -device with
      sysbus devices, and none of the devices above is supported with these
      machines.

      Set cannot_instantiate_with_device_add_yet to preserve our luck.

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: Antony Pavlov <antonynpavlov@gmail.com>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19109131ca2701de1b4e083bd51172f376f7a5ef
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:22:10 2015 +0100

      sdhci: Make device "sdhci-pci" unavailable with -device

      Device models aren't supposed to go on fishing expeditions for
      backends.  They should expose suitable properties for the user to set.
      For onboard devices, board code sets them.

      "sdhci-pci" picks up its block backend in its realize() method with
      drive_get_next() instead.  Already marked FIXME.  See the commit that
      added the FIXME for a more detailed explanation of what's wrong.

      We can't fix this in time for the release, but since the device is new
      in 2.3, we can set cannot_instantiate_with_device_add_yet to disable
      it before this mistake becomes ABI, and we have to support command
      lines like

          $ qemu -drive if=sd -drive if=sd,file=sd.img -device sdhci-pci -device sdhci-pci

      forever.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 19f33f16890fc5ec0d43841625ca44ef28767d1a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 11:35:25 2015 +0100

      hw: Mark device misusing nd_table[] FIXME

      NICs defined with -net nic are for board initialization to wire up.
      Board code examines nd_table[] to find them, and creates devices with
      their qdev NIC properties set accordingly.

      Except "allwinner-a10" goes on a fishing expedition for NIC
      configuration instead of exposing the usual NIC properties for board
      code to set: it uses nd_table[0] in its instance_init() method.

      Picking up the first -net nic option's configuration that way works
      when the device is created by board code.  But it's inappropriate for
      -device and device_add.  Not only is it inconsistent with how the
      other block device models work (they get their configuration from
      properties "mac", "vlan", "netdev"), it breaks when nd_table[0] has
      been picked up by the board or a previous -device / device_add
      already.

      Example:

          $ qemu-system-arm -S -M cubieboard -device allwinner-a10
          qemu-system-arm: -device allwinner-a10: Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use
          Aborted (core dumped)

      It also breaks in other entertaining ways:

          $ qemu-system-arm -M highbank -device allwinner-a10
          qemu-system-arm: -device allwinner-a10: Unsupported NIC model: xgmac
          $ qemu-system-arm -M highbank -net nic,model=allwinner-emac -device allwinner-a10
          qemu-system-arm: Unsupported NIC model: allwinner-emac

      Mark the mistake with a FIXME comment.

      Cc: Li Guang <lig.fnst@cn.fujitsu.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit d71b22bb6ae281e66dfa17733105468f830a8c6a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 09:29:20 2015 +0100

      hw: Mark devices picking up char backends actively FIXME

      Character devices defined with -serial and -parallel are for board
      initialization to wire up.  Board code examines serial_hds[] and
      parallel_hds[] to find them, and creates devices with their qdev
      chardev properties set accordingly.

      Except a few devices go on a fishing expedition for a suitable backend
      instead of exposing a chardev property for board code to set: they use
      serial_hds[] (often via qemu_char_get_next_serial()) or parallel_hds[]
      in their realize() or init() method to connect to a backend.

      Picking up backends that way works when the devices are created by
      board code.  But it's inappropriate for -device or device_add.  Not
      only is it inconsistent with how the other characrer device models
      work (they connect to a backend explicitly identified by a "chardev"
      property), it breaks when the backend has been picked up by the board
      or a previous -device / device_add already.

      Example:

          $ qemu-system-ppc64 -M bamboo -S -device i82378 -device pc87312 -device pc87312
          qemu-system-ppc64: -device pc87312: Property 'isa-parallel.chardev' can't take value 'parallel0', it's in use

      Mark them with suitable FIXME comments.

      Cc: Li Guang <lig.fnst@cn.fujitsu.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: Antony Pavlov <antonynpavlov@gmail.com>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: "Andreas Färber" <andreas.faerber@web.de>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit af9e40aa8f36e30e89f16323b3d341ee59309b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 23 19:03:13 2015 +0100

      hw: Mark devices picking up block backends actively FIXME

      Drives defined with if!=none are for board initialization to wire up.
      Board code calls drive_get() or similar to find them, and creates
      devices with their qdev drive properties set accordingly.

      Except a few devices go on a fishing expedition for a suitable backend
      instead of exposing a drive property for board code to set: they call
      driver_get() or drive_get_next() in their realize() or init() method
      to implicitly connect to the "next" backend with a certain interface
      type.

      Picking up backends that way works when the devices are created by
      board code.  But it's inappropriate for -device or device_add.  Not
      only is this inconsistent with how the other block device models work
      (they connect to a backend explicitly identified by a "drive"
      property), it breaks when the "next" backend has been picked up by the
      board already.

      Example:

          $ qemu-system-arm -S -M connex -pflash flash.img -device ssi-sd
          Aborted (core dumped)

      Mark them with suitable FIXME comments.

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Cc: "Andreas Färber" <andreas.faerber@web.de>
      Cc: Michael Walle <michael@walle.cc>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 11f10cf8057dd5392171da061381f6c890b1e21d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Apr 2 10:52:14 2015 +0100

      hw/arm/vexpress: Don't double-free flash filename

      Commits 6e05a12f8f7f and db25a1581 both attempt to fix the
      same "failed to free memory containing flash filename" bug,
      with the effect that when they were both applied we ended
      up freeing the memory twice. Delete the spurious extra free.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1427968334-14527-1-git-send-email-peter.maydell@linaro.org

  commit c408d27a42318227092128b04cca555f78cf703d
  Author: Shannon Zhao <shannon.zhao@linaro.org>
  Date:   Thu Apr 2 11:07:06 2015 +0800

      hw/arm/virt: Fix corruption due to double free

      As 4de9a88(hw/arm/virt: Fix memory leak reported by Coverity)
      and 6e05a12(arm: fix memory leak) both handle the memory leak
      reported by Coverity, this cause qemu corruption due to
      double free.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1427944026-8968-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 289494da25c5d6270e66a40267fd761ee8f54a90
  Merge: fde069f 25b9fb1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 18:13:21 2015 +0100

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150401' into staging

      target-arm:
       * Fix broken migration on AArch64 KVM
       * Fix minor memory leaks in virt, vexpress, highbank
       * Honour requested filename when loading highbank rom image

      # gpg: Signature made Wed Apr  1 18:06:09 2015 BST using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150401:
        target-arm: kvm64 fix save/restore of SPSR regs
        target-arm: kvm64 sync FP register state
        hw/intc: arm_gic_kvm.c restore config first
        target-arm: kvm: save/restore mp state
        target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)
        hw/arm/virt: Fix memory leak reported by Coverity
        hw/arm/vexpress: Fix memory leak reported by Coverity
        hw/arm/highbank: Fix resource leak and wrong image loading

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25b9fb107bc1f6735fdb3fce537792f5db95f78d
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm64 fix save/restore of SPSR regs

      The current code was negatively indexing the cpu state array and not
      synchronizing banked spsr register state with the current mode's spsr
      state, causing occasional failures with migration.

      Some munging is done to take care of the aarch64 mapping and also to
      ensure the most current value of the spsr is updated to the banked
      registers (relevant for KVM<->TCG migration).

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0e4b586932768107448f342ae4a314beedfa8f11
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm64 sync FP register state

      For migration to work we need to sync all of the register state. This is
      especially noticeable when GCC starts using FP registers as spill
      registers even with integer programs.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 74fdb781c19ef4b781cb6fda48f1f9ebd11257fe
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      hw/intc: arm_gic_kvm.c restore config first

      As there is logic to deal with the difference between edge and level
      triggered interrupts in the kernel we must ensure it knows the
      configuration of the IRQs before we restore the pending state.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a1753f747544d20b999d466b1017721668bfb82
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Wed Apr 1 17:57:30 2015 +0100

      target-arm: kvm: save/restore mp state

      This adds the saving and restore of the current Multi-Processing state
      of the machine. While the KVM_GET/SET_MP_STATE API exposes a number of
      potential states for x86 we only use two for ARM. Either the process is
      running or not. We then save this state into the cpu_powered TCG state
      to avoid changing the serialisation format.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)

      The AArch64 SPSR_EL1 register is architecturally mandated to
      be mapped to the AArch32 SPSR_svc register. This means its
      state should live in QEMU's env->banked_spsr[1] field.
      Correct the various places in the code that incorrectly
      put it in banked_spsr[0].

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4de9a883be653f02f8c1d5dcd1066f614d9606b6
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/virt: Fix memory leak reported by Coverity

      As the conditional statement had to be split anyway, we can also
      add a better error report message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426877982-3603-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit db25a15817f98c46c5f0eea4f414249d8fbb96b1
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/vexpress: Fix memory leak reported by Coverity

      As the conditional statement had to be split anyway, we can also
      add a better error report message.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426877963-3556-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 60ff4e63e2ea4738f114cbaf1f17e6e0184fc09c
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Wed Apr 1 17:57:29 2015 +0100

      hw/arm/highbank: Fix resource leak and wrong image loading

      Coverity reports a resource leak for sysboot_filename which is allocated
      by qemu_find_file.

      In addition, that name is used to get the size of the image, but a
      different image name was used to load it.

      In addition, instead of passing the maximum allowed image size the actual
      image size was passed to load_image_targphys.

      Fix all three issues.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426326781-2488-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fde069f751a9aa7e597c9d297a9995eca418a403
  Merge: b8a86c4 2cdb5e1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 17:18:51 2015 +0100

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2015-1779-20150401-2' into staging

      vnc: fix websocket security issues (cve-2015-1779).

      # gpg: Signature made Wed Apr  1 16:14:34 2015 BST using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-cve-2015-1779-20150401-2:
        CVE-2015-1779: limit size of HTTP headers from websockets clients
        CVE-2015-1779: incrementally decode websocket frames

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2cdb5e142fb93e875fa53c52864ef5eb8d5d8b41
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Mon Mar 23 22:58:22 2015 +0000

      CVE-2015-1779: limit size of HTTP headers from websockets clients

      The VNC server websockets decoder will read and buffer data from
      websockets clients until it sees the end of the HTTP headers,
      as indicated by \r\n\r\n. In theory this allows a malicious to
      trick QEMU into consuming an arbitrary amount of RAM. In practice,
      because QEMU runs g_strstr_len() across the buffered header data,
      it will spend increasingly long burning CPU time searching for
      the substring match and less & less time reading data. So while
      this does cause arbitrary memory growth, the bigger problem is
      that QEMU will be burning 100% of available CPU time.

      A novnc websockets client typically sends headers of around
      512 bytes in length. As such it is reasonable to place a 4096
      byte limit on the amount of data buffered while searching for
      the end of HTTP headers.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2bebfd6e09d285aa793cae3fb0fc3a39a9fee6e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Mon Mar 23 22:58:21 2015 +0000

      CVE-2015-1779: incrementally decode websocket frames

      The logic for decoding websocket frames wants to fully
      decode the frame header and payload, before allowing the
      VNC server to see any of the payload data. There is no
      size limit on websocket payloads, so this allows a
      malicious network client to consume 2^64 bytes in memory
      in QEMU. It can trigger this denial of service before
      the VNC server even performs any authentication.

      The fix is to decode the header, and then incrementally
      decode the payload data as it is needed. With this fix
      the websocket decoder will allow at most 4k of data to
      be buffered before decoding and processing payload.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

      [ kraxel: fix frequent spurious disconnects, suggested by Peter Maydell ]

        @@ -361,7 +361,7 @@ int vncws_decode_frame_payload(Buffer *input,
        -        *payload_size = input->offset;
        +        *payload_size = *payload_remain;

      [ kraxel: fix 32bit build ]

        @@ -306,7 +306,7 @@ struct VncState
        -    uint64_t ws_payload_remain;
        +    size_t ws_payload_remain;

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b8a86c4ac4d04c106ba38fbd707041cba334a155
  Merge: 033a203 4025446
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Apr 1 11:31:31 2015 +0100

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Fix for object_del of in-use memory, pvpanic
      regression, PPC regression and bogus error message with
      Oxygen theme.

      # gpg: Signature made Wed Apr  1 09:08:20 2015 BST using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        Revert "exec: Respect as_tranlsate_internal length clamp"
        rcu: do not create thread in pthread_atfork callback
        pc: acpi: fix pvpanic regression
        hostmem: Prevent removing an in-use memory backend
        qom: Add can_be_deleted callback to UserCreatableClass

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4025446f0ac6213335c22ec43f3c3d8362ce7286
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Apr 1 09:57:45 2015 +0200

      Revert "exec: Respect as_tranlsate_internal length clamp"

      This reverts commit c3c1bb99d1c11978d9ce94d1bdcf0705378c1459.
      It causes problems with boards that declare memory regions shorter
      than the registers they contain.

      Reported-by: Zoltan Balaton <balaton@eik.bme.hu>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a59629fcc6f603e19b516dc08f75334e5c480bd0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 31 13:01:05 2015 +0200

      rcu: do not create thread in pthread_atfork callback

      If QEMU forks after the CPU threads have been created, qemu_mutex_lock_iothread
      will not be able to do qemu_cpu_kick_thread.  There is no solution other than
      assuming that forks after the CPU threads have been created will end up in an
      exec.  Forks before the CPU threads have been created (such as -daemonize)
      have to call rcu_after_fork manually.

      Notably, the oxygen theme for GTK+ forks and shows a "No such process" error
      without this patch.

      This patch can be reverted once the iothread loses the "kick the TCG thread"
      magic.

      User-mode emulation does not use the iothread, so it can also call
      rcu_after_fork.

      Reported by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e65bef6954415b24ee17184b959333d9456bece8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Mar 30 14:18:27 2015 +0200

      pc: acpi: fix pvpanic regression

      Commit cd61cb2  pc: acpi-build: generate pvpanic device description dynamically

      introduced regression changing pvpanic device HID from
      QEMU0001 to QEMU0002.
      Fix AML generated code so that pvpanic device
      would keep its original HID. i.e. QEMU0001

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reported-by: Gal Hammer <ghammer@redhat.com>
      Message-Id: <1427717907-25027-1-git-send-email-imammedo@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 36bce5ca5da7a7dbdc5001dc65b40b7439472106
  Author: Lin Ma <lma@suse.com>
  Date:   Mon Mar 30 16:36:29 2015 +0800

      hostmem: Prevent removing an in-use memory backend

      showing a memory device whose memdev is removed leads an assert:

      (qemu) object_add memory-backend-ram,id=ram0,size=128M
      (qemu) device_add pc-dimm,id=d0,memdev=ram0
      (qemu) object_del ram0
      (qemu) info memory-devices
      **
      ERROR:qom/object.c:1274:object_get_canonical_path_component:\
                                  assertion failed: (obj->parent != NULL)
      Aborted

      The patch prevents removing an in-use mem backend and error out.

      Signed-off-by: Lin Ma <lma@suse.com>
      Message-Id: <1427704589-7688-3-git-send-email-lma@suse.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d6edb15576643ab348a9f73e115c2e037edf7460
  Author: Lin Ma <lma@suse.com>
  Date:   Mon Mar 30 16:36:28 2015 +0800

      qom: Add can_be_deleted callback to UserCreatableClass

      If backends implement the can_be_deleted and it returns false,
      Then the qmp_object_del won't delete the given backends.

      Signed-off-by: Lin Ma <lma@suse.com>
      Message-Id: <1427704589-7688-2-git-send-email-lma@suse.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 033a20359aaf93f4d8aa2be12558901e8e028baa
  Merge: 9e0ad34 a18bb41
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 12:12:22 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Fix for adding alias properties with [*]

      # gpg: Signature made Tue Mar 31 11:59:00 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qom: Fix object_property_add_alias() with [*]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a18bb417e954ceea0a30b46c38b0d58c3a7ca6a1
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Mar 27 17:34:10 2015 +0100

      qom: Fix object_property_add_alias() with [*]

      Commit 8074264 (qom: Add description field in ObjectProperty struct)
      introduced property descriptions and copied them for alias properties.

      Instead of using the caller-supplied property name, use the returned
      property name for setting the description. This avoids an Error when
      setting a property description for a property with literal "[*]" that
      doesn't exist due to automatic property naming in object_property_add().

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable@nongnu.org (v2.2+)
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 9e0ad3472dae5236052d455948396d8579bfc904
  Merge: adbeb45 6ca90ff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 10:55:33 2015 +0100

      Merge remote-tracking branch 'remotes/afaerber/tags/qtest-for-2.3' into staging

      QTest cleanups

      * Change fw_cfg-test and i440fx-test GTester paths
      * Extend libqtest API as necessary

      # gpg: Signature made Mon Mar 30 18:29:39 2015 BST using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qtest-for-2.3:
        i440fx-test: Fix test paths to include architecture
        qtest: Add qtest_add() wrapper macro
        qtest: Add qtest_add_data_func() wrapper function
        fw_cfg-test: Fix test path to include architecture

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adbeb458eece2263039e5a1f6501b87ae3713319
  Merge: d4892d9 f1fdaf5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 31 09:56:48 2015 +0100

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150330' into staging

      TriCore bugfixes

      # gpg: Signature made Mon Mar 30 12:40:50 2015 BST using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150330:
        target-tricore: fix CACHEA/I_POSTINC/PREINC using data register..

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d4892d935b035c2220827145524d0cf0573d1fea
  Merge: 627f91b fa92e21
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 30 22:55:51 2015 +0100

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150330' into staging

      s390x fixes:
      - virtqueue index issues in virtio-ccw
      - cleanup and sign extension fix for the ipl device

      # gpg: Signature made Mon Mar 30 08:52:54 2015 BST using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150330:
        s390x/ipl: avoid sign extension
        s390x: do not include ram_addr.h
        virtio-ccw: range check in READ_VQ_CONF
        virtio-ccw: fix range check for SET_VQ

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6ca90ffeec8e3b4e306be32efd930d75a6d0b295
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 24 19:35:22 2015 +0100

      i440fx-test: Fix test paths to include architecture

      Replace g_test_add_func() with new qtest_add_func() and g_test_add()
      macro with qtest_add() macro. This effectively changes GTester paths:

        /i440fx/foo -> /x86_64/i440fx/foo etc.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 45b0f830dd1817277eeb97032ce64b3103fe0b6c
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Mar 25 16:52:45 2015 +0100

      qtest: Add qtest_add() wrapper macro

      It extends g_test_add() macro with the architecture path.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7949c0e39f7638a85515a1dcbd8bc96d13fca6de
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Tue Mar 24 19:33:34 2015 +0100

      qtest: Add qtest_add_data_func() wrapper function

      It calls g_test_add_data_func() with a path supplemented by the
      architecture, like qtest_add_func() does.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 53850b8894cfca3cbe405979ba8a55539cd17516
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 19 18:35:23 2015 +0100

      fw_cfg-test: Fix test path to include architecture

      Use qtest_add_func() instead of g_test_add_func() to reflect
      the architecture tested, changing GTester paths as follows:

        /fw_cfg/foo -> /x86_64/fw_cfg/foo etc.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f1fdaf552974ee2ef6ec1ba3cf1e18c2951533e1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Mar 27 14:55:22 2015 +0100

      target-tricore: fix CACHEA/I_POSTINC/PREINC using data register..

      ..for address calculation instead address registers.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit fa92e218df1d7fcc01e1e5d8bbd77acdaf53c18b
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Mar 26 10:41:45 2015 +0100

      s390x/ipl: avoid sign extension

      Make s390_update_iplstate() return uint32_t to avoid sign extensions
      for cssids > 127. While this doesn't matter in practice yet (as
      nobody supports MCSS-E and thus won't see the real cssid), play safe.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f65025caab916aa8a5b8de270a59078e0b6e2866
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 15:56:29 2015 +0100

      s390x: do not include ram_addr.h

      ram_addr.h is an internal interface and it is not needed anyway by
      hw/s390x/ipl.c.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Thomas Huth <huth@tuxfamily.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1427295389-5054-1-git-send-email-pbonzini@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d03a363054f1cc58d4e6653ff09fbbe8121a0302
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 13:16:20 2015 +0100

      virtio-ccw: range check in READ_VQ_CONF

      Processing for READ_VQ_CONF needs to check whether the requested queue
      value is actually in the supported range and post a channel program
      check if not.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 590fe5722b522e492a9c78adadae4def35b137dd
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Mar 20 13:08:36 2015 +0100

      virtio-ccw: fix range check for SET_VQ

      VIRTIO_PCI_QUEUE_MAX is already too big; a malicious guest would be
      able to trigger a write beyond the VirtQueue structure.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 627f91b1f80fecc73d00727181a9ddb6162cc30e
  Merge: b27e767 fc3d8e1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Mar 28 10:10:04 2015 +0000

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Fri Mar 27 22:19:31 2015 GMT using RSA key ID AAFC390E
      # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
      #      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

      * remotes/jnsnow/tags/ide-pull-request:
        AHCI: Protect cmd register
        AHCI: Do not (re)map FB/CLB buffers while not running

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc3d8e1138cd0c843d6fd75272633a31be6554ef
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Mar 27 15:48:11 2015 -0400

      AHCI: Protect cmd register

      Many bits in the CMD register are supposed to be strictly read-only.
      We should not be deleting them on every write.

      As a side-effect: pay explicit attention to when a guest marks off
      the FIS Receive or Start bits, and disable the status bits ourselves,
      instead of letting them implicitly fall off.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426283454-15590-3-git-send-email-jsnow@redhat.com

  commit a13ab5a35bc0435fcfdacb3e171ceedcc077573d
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Mar 27 15:48:11 2015 -0400

      AHCI: Do not (re)map FB/CLB buffers while not running

      The FIS Receive Buffer and Command List Buffer pointers
      should not be edited while the FIS receive engine or
      Command Receive engines are running.

      Currently, we attempt to re-map the buffers every time they
      are adjusted, but while the AHCI engines are off, these registers
      may contain stale values, so we should not attempt to re-map these
      values until the engines are reactivated.

      Reported-by: Jordan Hargrave <jharg93@gmail.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1426283454-15590-2-git-send-email-jsnow@redhat.com

  commit b27e767e8c8d56cb7c9d0b78eadd89521bdf836c
  Merge: 500d76a 4e60a25
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 27 12:12:27 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri Mar 27 11:59:41 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        hw/net/e1000: fix integer endianness

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 500d76a093b81f0aa9a368039518ab333d5dbf7a
  Merge: 4ad9e2b da2cf4e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 27 10:30:48 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri Mar 27 10:13:35 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        block: Document blockdev-add's immaturity
        qemu-iotests: Test unaligned 4k zero write
        block: Fix unaligned zero write
        nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e60a250d395ef0d04eb8b6489cc5f7615a8909b
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Fri Mar 13 13:21:59 2015 +0800

      hw/net/e1000: fix integer endianness

      It's detected by coverity.In is_vlan_packet s->mac_reg[VET] is
      unsigned int but is dereferenced as a narrower unsigned short.
      This may lead to unexpected results depending on machine
      endianness.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Message-id: 1426224119-8352-1-git-send-email-zhaoshenglong@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit da2cf4e80355e42fbaeb8bcfa2b07f5bceddd323
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 20 14:32:17 2015 +0100

      block: Document blockdev-add's immaturity

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1426858337-21423-1-git-send-email-armbru@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 61815d6e0aa1a549ad55f6621b6816aa6b1ab757
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Mar 24 09:23:50 2015 +0800

      qemu-iotests: Test unaligned 4k zero write

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427160230-4489-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Mar 24 09:23:49 2015 +0800

      block: Fix unaligned zero write

      If the zero write is not aligned, bdrv_co_do_pwritev will segfault
      because of accessing to the NULL qiov passed in by bdrv_co_write_zeroes.
      Fix this by allocating a local qiov in bdrv_co_do_pwritev if the request
      is not aligned. (In this case the padding iovs are necessary anyway, so
      it doesn't hurt.)

      Also add a check at the end of bdrv_co_do_pwritev to clear the zero flag
      if padding is involved.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1427160230-4489-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2115f2a1d8c77c2a735add1ed02ae0c1feae0d9a
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 17:00:44 2015 +0100

      nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

      The shift operation on nlb gives a 32 bit result if no type cast is
      applied. This bug was reported by Coverity.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1426348844-8793-1-git-send-email-sw@weilnetz.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4ad9e2b36e1e00fe5b96c3448ecd673e11c4d6d8
  Merge: f75d4f8 4cdfc93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 18:35:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150326-1' into staging

      gtk: do not call gtk_widget_get_window if drawing area is not initialized

      # gpg: Signature made Thu Mar 26 16:59:55 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gtk-20150326-1:
        gtk: do not call gtk_widget_get_window if drawing area is not initialized

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f75d4f82950c9e74c7202081f1cb97ae94b7c7d8
  Merge: 896848f 4020db0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 17:33:35 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Bugfixes and making SCSI adapters IOMMU-friendly.

      # gpg: Signature made Thu Mar 26 13:24:05 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring
        misc: fix typos in copyright declaration
        exec: avoid possible overwriting of mmaped area in qemu_ram_remap
        sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
        nbd: Fix up comment after commit e140177
        vmw_pvscsi: use PCI DMA APIs
        megasas: use PCI DMA APIs
        cpus: Don't kick un-realized cpus.
        i6300esb: Fix signed integer overflow
        i6300esb: Correct endiannness
        fw_cfg: factor out initialization of FW_CFG_ID (rev. number)
        rcu tests: fix compilation on 32-bit ppc

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 896848f0d3e2393905845ef2b244bb2601f9df0c
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Thu Mar 26 16:56:25 2015 +0100

      seccomp: libseccomp version varying according to arch

      Libseccomp dependency was mandating version 2.2.0 on all architectures
      and this was causing configure and virt-test to break on non-updates
      distros. This patch works-around it and give a more flexible way to
      check the version, giving more time for other distros to update
      libseccomp version.

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Reported-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Tested-by: Juan Quintela <quintela@redhat.com>
      Message-id: 1427385385-30571-1-git-send-email-eduardo.otubo@profitbricks.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4cdfc93526364bc9b20a21c9edd802d737cec85f
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Tue Mar 24 20:08:48 2015 +0100

      gtk: do not call gtk_widget_get_window if drawing area is not initialized

      This prevents gtk_widget_get_window to return a NULL pointer.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 99b7f47c54ae7932715a1f58ed9a128451fb2b85
  Merge: 1ee76e5 43edc0e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 14:47:53 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150326' into staging

      migration/next for 20150326

      # gpg: Signature made Thu Mar 26 14:31:55 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150326:
        migration:  remove last_sent_block from save_page_header
        rdma: Fix cleanup in error paths
        Avoid crashing on multiple -incoming

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43edc0ed11a4d25f2fe67bb9d89a8a6a0a43b1e0
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Tue Mar 17 12:56:13 2015 +0100

      migration:  remove last_sent_block from save_page_header

      Compression code (still not on tree) want to call this funtion from
      outside the migration thread, so we can't write to last_sent_block.

      Instead of reverting full patch:

      [PULL 07/11] save_block_hdr: we can recalculate

      Just revert the parts that touch last_sent_block.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

  commit 80b262e1439a22708e1c535b75363d4b90c3b41d
  Author: Padmanabh Ratnakar <padmanabh.ratnakar@Emulex.Com>
  Date:   Thu Mar 26 07:38:04 2015 +0530

      rdma: Fix cleanup in error paths

      As part of commit e325b49a320b493cc5d69e263751ff716dc458fe,
      order in which resources are destroyed was changed for fixing
      a seg fault. Due to this change, CQ will never get destroyed as
      CQ should be destroyed after QP destruction. Seg fault is caused
      improper cleanup when connection fails. Fixing cleanup after
      connection failure and order in which resources are destroyed
      in qemu_rdma_cleanup() routine.

      Signed-off-by: Meghana Cheripady <meghana.cheripady@emulex.com>
      Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7c76235a3e6e24f596ab4b157157bd62f44b80f5
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:16:06 2015 +0000

      Avoid crashing on multiple -incoming

      Passing multiple -incoming options used to crash qemu (due to
      an invalid state transition incoming->incoming).  Instead we now
      take the last -incoming option, e.g.:

      qemu-system-x86_64 -nographic -incoming tcp::4444 -incoming defer

      ends up doing the defer.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1ee76e5191e4275bf2f7ad251385c96d6ce47b86
  Merge: 087c4c9 c6e7650
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 13:30:41 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for 2.3 ppc - 2015-03-25

      Just a few bug fixes before 2.3 gets released:

        - pseries: Firmware update, bugfixes
        - remove POWER5+ v0.0 that we incorrectly introduced in 2.3
        - Fix -machine usb=no
        - Fix -boot once=foo in pseries
        - Add NULL pointer check in pseries machine init

      # gpg: Signature made Wed Mar 25 21:53:20 2015 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream:
        powerpc: fix -machine usb=no for newworld and pseries machines
        PPC: pseries: Implement boot once=foo
        target-ppc: Remove POWER5+ v0.0 that never existed
        spapr: Add missing checks for NULL pointers and report failures
        pseries: Update SLOF firmware image to qemu-slof-20150313

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4020db0475b3e527b3bdc97dff873c2be9da2698
  Author: Ting Wang <kathy.wangting@huawei.com>
  Date:   Thu Mar 26 15:42:32 2015 +0800

      virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring

      VirtIOSCSIVring which allocated in virtio_scsi_vring_init
      should be free when dataplane has been stopped or failed to start.

      Signed-off-by: Ting Wang <kathy.wangting@huawei.com>
      Message-Id: <1427355752-25844-1-git-send-email-kathy.wangting@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fe75270cb619549b2aa1ba59bd202faf306204a1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 26 20:57:43 2015 +0800

      misc: fix typos in copyright declaration

      Add a space after comma.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1427374663-10168-1-git-send-email-arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 087c4c9419d3086ac0a920899e4fed8ceaf9bb2b
  Merge: 37a518a 7e0e736
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 12:18:44 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc, virtio bugfixes for 2.3

      Several bugfixes, nothing stands out especially.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 25 12:42:10 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        virtio-net: validate backend queue numbers against bus limitation
        virtio-serial: fix virtio config size
        acpi: Add missing GCC_FMT_ATTR to local function

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 37a518ae5dc22415a642ce05423d71f8d7b25cac
  Merge: 054903a 8e27fc2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 26 11:10:54 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150325' into staging

      seccomp branch queue

      # gpg: Signature made Wed Mar 25 10:09:29 2015 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150325:
        seccomp: update libseccomp version and remove arch restriction

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f18c69cfc554cf9776eb3c35b7510e17541afacb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Mar 25 14:14:56 2015 +0100

      exec: avoid possible overwriting of mmaped area in qemu_ram_remap

      It is not necessary to munmap an area before remapping it with MAP_FIXED;
      if the memory region specified by addr and len overlaps pages of any
      existing mapping, then the overlapped part of the existing mapping will
      be discarded.

      On the other hand, if QEMU does munmap the pages, there is a small
      probability that another mmap sneaks in and catches the just-freed
      portion of the address space.  In effect, munmap followed by
      mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it
      as such.  Fix it.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c6e765035bc5e0d73231c2c0fbd54620201d6655
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 18:05:28 2015 +0100

      powerpc: fix -machine usb=no for newworld and pseries machines

      Capture the explicit setting of "usb=no" into a separate bool, and
      use it to skip the update of machine->usb in the board init function.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5b2128d27051fe036ac36e8e860e72490b27a369
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Mar 18 13:30:44 2015 +0100

      PPC: pseries: Implement boot once=foo

      On sPAPR we haven't supported boot once ever since it emerged, but
      recently grew need for it. This patch implements boot once logic
      to it.

      While at it, we also move to the new bootdevice handling that got
      introduced to the tree recently.

      Reported-by: Dinar Valeev <dvaleev@suse.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fda276c7aafe2bfc9df808e61abd25cb834a0254
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Wed Mar 18 14:11:21 2015 +1100

      target-ppc: Remove POWER5+ v0.0 that never existed

      IBM uses low 16bits to specify the chip version of a POWER CPU.
      So there has never been an actual silicon with PVR = 0x003B0000.
      The first silicon would have PVR 0x003B0100 but it is very unlikely
      to find it in any machine shipped to any customer as it was too raw.

      This removes CPU_POWERPC_POWER5P_v00 definition and changes
      POWER5+ and POWERgs aliases (which are synonyms) to point to
      POWER5+_v2.1 which can still be found in real machines.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      [agraf: fix commit message]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4c56440d6754b45c2d82969e029a3c2a72864b30
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 16:29:09 2015 +0100

      spapr: Add missing checks for NULL pointers and report failures

      This fixes potential runtime crashes and two warnings from Coverity.

      The new error message does not add  a prefix "qemu:" because that is
      already done in function hw_error. It also starts with an uppercase
      letter because that seems to be the mostly used form.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      [agraf: fix typo]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0d2f830255c758240dccbeb732a2c21f4eea995c
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Mar 13 22:45:13 2015 +1100

      pseries: Update SLOF firmware image to qemu-slof-20150313

      The changelog is:
        > virtio: Fix vring allocation
        > helpers: Fix SLOF_alloc_mem_aligned to meet callers expectation
        > Set default palette according to "16-color Text Extension" document
        > Fix rectangle drawing functions to work also with higher bit depths
        > Fix the x86emu patch file
        > Silence compiler warning when building the biosemu
        > Use device-type Forth word to set up the corresponding property
        > Improve /openprom node
        > pci-properties: Remove redundant call to device-type
        > cas: reconfigure memory nodes
        > pci: use 64bit bar ranges

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8e7ba4ed3a0b68ab35736c7859fd950f6705e0cf
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 22:30:13 2015 +0100

      sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH7o8uA59Ep0n41i0M19VFWa73n9m172j2W3fjz6=PSVBA@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6a926fbc6fff58598cce9404019204090a8e8361
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 22:28:15 2015 +0100

      mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH4-=HJUvwBu+2o6jGanJesJOyNf3sL8-5+d_-6C3cWBfA@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1d5bfde1b978b57156d851d140b99eac8b2adbe4
  Author: Dirk Müller <dirk@dmllr.de>
  Date:   Tue Mar 24 23:11:03 2015 +0100

      m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory

      Commit 0b183fc871:"memory: move mem_path handling to
      memory_region_allocate_system_memory" split memory_region_init_ram and
      memory_region_init_ram_from_file. Also it moved mem-path handling a step
      up from memory_region_init_ram to memory_region_allocate_system_memory.

      Therefore for any board that uses memory_region_init_ram directly,
      -mem-path is not supported.

      Fix this by replacing memory_region_init_ram with
      memory_region_allocate_system_memory.

      Signed-off-by: Dirk Mueller <dmueller@suse.com>
      Message-Id: <CAL5wTH6X-GsT1AA8kEtP_e7oZWGZgi=fCcDfSs3wLgJN30DbUw@mail.gmail.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7e0e736ecdfeac6d3517513d3a702304e4f6cf59
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Fri Mar 20 14:07:50 2015 +0800

      virtio-net: validate backend queue numbers against bus limitation

      We don't validate the backend queue numbers against bus limitation,
      this will easily crash qemu if it exceeds the limitation which will
      hit the abort() in virtio_del_queue(). An example is trying to
      starting a virtio-net device with 256 queues. E.g:

      ./qemu-system-x86_64 -netdev tap,id=hn0,queues=256 -device
      virtio-net-pci,netdev=hn0

      Fixing this by doing the validation and fail early.

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7976a6d23151c780474bdac106f3cf1343a2d6ca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 25 12:33:55 2015 +0100

      virtio-serial: fix virtio config size

      commit 9b70c1790acacae54d559d38ca69186a85040bb8
          virtio-serial: switch to standard-headers

      changes virtio_console_config size from 8 to 12 bytes:
      it adds an optional 4 byte emerg_wr field.

      As this crosses a power of two boundary, this changes the PCI BAR size,
      which breaks migration compatibility with old qemu machine types.
      It's probably a problem for other transports as well.

      As a temporary fix, as we don't yet support this new field anyway,
      simply make the config size smaller at init time.

      Long terms we probably want something along the lines
      of virtio_net_set_config_size.

      Reported-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Tested-by: Cole Robinson <crobinso@redhat.com>

  commit c167e2e7eda609bbbb58650c1b82e8168106e40e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Mar 20 18:11:58 2015 +0100

      acpi: Add missing GCC_FMT_ATTR to local function

      This fixes these gcc warnings (not enabled in default build):

      hw/acpi/aml-build.c:83:5: warning:
       function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]
      hw/acpi/aml-build.c:88:5: warning:
       function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 78fa62ff1bc0d66f0115b7147c4eb260ad22022a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Mar 25 09:18:48 2015 +0100

      nbd: Fix up comment after commit e140177

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1427271528-11624-1-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0dc40f28518dee8aa95abd330a53f06179e71995
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 17:28:13 2015 +0100

      vmw_pvscsi: use PCI DMA APIs

      It is wrong to use address_space_memory directly, because there could be an
      IOMMU in the middle.  Passing the entire PVSCSIRingInfo to RS_GET_FIELD
      and RS_SET_FIELD makes it easy to go back to the PVSCSIState.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 16578c6ffe8c4ee5207ccb9b0c994c1b18bb322d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 23 17:15:17 2015 +0100

      megasas: use PCI DMA APIs

      It is wrong to use address_space_memory directly, because there could be an
      IOMMU in the middle.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdd459a00a206772185970efbc38c455dc43167e
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 23 03:48:09 2015 -0700

      cpus: Don't kick un-realized cpus.

      following a464982499b2f637f6699e3d03e0a9d2e0b5288b, it's now possible for
      there to be attempts to take the BQL before CPUs have been realized in
      cases where a machine model inits peripherals before the first CPU.

      BQL lock aquisition kicks the first_cpu, leading to a segfault if this
      happens pre-realize. Guard the CPU kick routine to perform no action for
      a CPU that doesn't exist or doesn't have a thread yet.

      There was a fix to this with commit
      6b49809c597331803ea941eadda813e5bb4e8fe2, but the check there misses
      the case where the CPU has been inited and not realized. Strengthen the
      check to make sure that the first_cpu has a thread (i.e. it is
      realized) before allowing the kick.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1427107689-6946-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4bc7b4d56657ebf75b986ad46e959cf7232ff26a
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Mar 23 12:51:48 2015 +1100

      i6300esb: Fix signed integer overflow

      If the guest programs a sufficiently large timeout value an integer
      overflow can occur in i6300esb_restart_timer().  e.g. if the maximum
      possible timer preload value of 0xfffff is programmed then we end up with
      the calculation:

      timeout = get_ticks_per_sec() * (0xfffff << 15) / 33000000;

      get_ticks_per_sec() returns 1000000000 (10^9) giving:

           10^9 * (0xfffff * 2^15) == 0x1dcd632329b000000 (65 bits)

      Obviously the division by 33MHz brings it back under 64-bits, but the
      overflow has already occurred.

      Since signed integer overflow has undefined behaviour in C, in theory this
      could be arbitrarily bad.  In practice, the overflowed value wraps around
      to something negative, causing the watchdog to immediately expire, killing
      the guest, which is still fairly bad.

      The bug can be triggered by running a Linux guest, loading the i6300esb
      driver with parameter "heartbeat=2046" and opening /dev/watchdog.  The
      watchdog will trigger as soon as the device is opened.

      This patch corrects the problem by using muldiv64(), which effectively
      allows a 128-bit intermediate value between the multiplication and
      division.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1427075508-12099-3-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 06b82e2d8ead4d1f9441dbf2b03c31369a8f27bd
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Mar 23 12:51:47 2015 +1100

      i6300esb: Correct endiannness

      The IO operations for the i6300esb watchdog timer are marked as
      DEVICE_NATIVE_ENDIAN.  This is not correct, and - as a PCI device - should
      be DEVICE_LITTLE_ENDIAN.

      This allows i6300esb to work on ppc targets (yes, using an Intel ICH
      derived device on ppc is a bit odd, but the driver exists on the guest
      and there's no more obviously suitable watchdog device).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1427075508-12099-2-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a5c76baf312d83cb77c8faa72c5f7a477effed0
  Author: Gabriel L. Somlo <somlo@cmu.edu>
  Date:   Thu Mar 19 14:20:44 2015 -0400

      fw_cfg: factor out initialization of FW_CFG_ID (rev. number)

      The fw_cfg documentation says this of the revision key (0x0001, FW_CFG_ID):

      > A 32-bit little-endian unsigned int, this item is used as an interface
      > revision number, and is currently set to 1 by all QEMU architectures
      > which expose a fw_cfg device.

      arm/virt doesn't.  It could be argued that that's an error in
      "hw/arm/virt.c"; on the other hand, all of the other fw_cfg providing
      boards set the interface version to 1 manually, despite the device
      coming from the same, shared implementation. Therefore, instead of
      adding

          fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1);

      to arm/virt, consolidate all such existing calls in the fw_cfg
      initialization code.

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Message-Id: <1426789244-26318-1-git-send-email-somlo@cmu.edu>
      Reviewed-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8a5956ad6392f115521dad774055c737c49fb0dd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sat Mar 21 16:32:05 2015 +0100

      rcu tests: fix compilation on 32-bit ppc

      32-bit PPC cannot do atomic operations on long long.  Inside the loops,
      we are already using local counters that are summed at the end of
      the run---with some exceptions (rcu_stress_count for rcutorture,
      n_nodes for test-rcu-list): fix them to use the same technique.
      For test-rcu-list, remove the mostly unused member "val" from the
      list.  Then, use a mutex to protect the global counts.

      Performance does not matter there because every thread will only enter
      the critical section once.

      Remaining uses of atomic instructions are for ints or pointers.

      Reported-by: Andreas Faerber <afaerber@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8e27fc200457e3f2473d0069263774d4ba17bd85
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Tue Mar 17 12:03:30 2015 +0100

      seccomp: update libseccomp version and remove arch restriction

      Libseccomp version updated to 2.2.0 and arch restriction to x86/x86_64
      is now removed. It's supposed to work on armv7l as well.

      Related bug: https://bugs.launchpad.net/qemu/+bug/1363641

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit 054903a832b865eb5432d79b5c9d1e1ff31b58d7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 24 16:34:16 2015 +0000

      Update version for v2.3.0-rc1 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 549c4e49788bbb16bdac3fb5480a2177019899e2
  Merge: 362ca92 f69c24e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 24 09:52:19 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150324' into staging

      TriCore bugfixes for 2.3-rc1

      # gpg: Signature made Tue Mar 24 08:48:33 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150324:
        target-tricore: properly fix dvinit_b/h_13
        target-tricore: fix RRPW_DEXTR using wrong reg
        target-tricore: fix DVINIT_HU/BU calculating overflow before result
        target-tricore: Fix two helper functions (clang warnings)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f69c24e4584f2161f90ee7caba38728aa77f937f
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Mar 23 18:24:42 2015 +0100

      target-tricore: properly fix dvinit_b/h_13

      The TriCore documentation was wrong on how to calculate ovf bits for those two
      instructions, which I confirmed with real hardware (TC1796 chip). An ovf
      actually happens, if the result (without remainder) does not fit into 8/16 bits.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 00e1754ff1f6294a29e08398a120663eac723216
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Feb 10 18:12:31 2015 +0000

      target-tricore: fix RRPW_DEXTR using wrong reg

      RRPW_DEXTR used r1 for the low part and r2 for the high part. It should be the
      other way round. This also fixes that the result of the first shift was not
      saved in a temp and could overwrite registers that were needed for the second
      shift.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 2b9d09bb3c44de934de03864d56ddd8a38ed863a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Mar 19 15:36:14 2015 +0000

      target-tricore: fix DVINIT_HU/BU calculating overflow before result

      dvinit_hu/bu for ISA v1.3 calculate the higher part of the result, that is needed
      for the overflow bits, after calculating the overflow bits.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 30a0d72f949fc46e54a180cf703e89b6d3df157d
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 15:43:32 2015 +0100

      target-tricore: Fix two helper functions (clang warnings)

      clang report:

      target-tricore/op_helper.c:1247:24: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1248:25: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1249:19: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1297:24: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1298:25: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]
      target-tricore/op_helper.c:1299:19: warning:
        taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int')
        has no effect [-Wabsolute-value]

      Fix also the divisor which was taken from the wrong register
      (thanks to Peter Maydell for this hint).

      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1425739412-8144-1-git-send-email-sw@weilnetz.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 362ca922eea03240916287a8a6267801ab095d12
  Merge: e7aab6d 54fced0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 23 17:02:12 2015 +0000

      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

      # gpg: Signature made Mon Mar 23 16:51:45 2015 GMT using RSA key ID AAFC390E
      # gpg: Can't check signature: public key not found

      * remotes/jnsnow/tags/ide-pull-request:
        ahci-test: improve rw buffer patterns
        ahci: Fix sglist offset manipulation for BE machines
        ide: fix cmd_read_pio when nsectors > 1
        ide: fix cmd_write_pio when nsectors > 1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54fced034e4d32d8ba6d1e27ecb7e2e2fb2f45d4
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:16 2015 -0400

      ahci-test: improve rw buffer patterns

      My pattern was cyclical every 256 bytes, so it missed a fairly obvious
      failure case. Add some rand() pepper into the test pattern, and for large
      patterns that exceed 256 sectors, start writing an ID per-sector so that
      we never generate identical sector patterns.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-5-git-send-email-jsnow@redhat.com

  commit ac38123609742ce3fbdf53774a797ac230cbf118
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:15 2015 -0400

      ahci: Fix sglist offset manipulation for BE machines

      This does not bother DMA, because DMA generally transfers
      the entire SGList in one shot if it can.

      PIO, on the other hand, tries to transfer just one sector
      at a time, and will make multiple visits to the sglist
      to fetch memory addresses.

      Fix the memory address calculaton when we have an offset
      by moving the offset addition OUTSIDE of the le64_to_cpu
      calculation.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-4-git-send-email-jsnow@redhat.com

  commit dd0bf7baab2201bd8f834be9eb87766662f50b19
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:14 2015 -0400

      ide: fix cmd_read_pio when nsectors > 1

      Similar to the cmd_write_pio fix, update the nsector count and
      ide sector before we invoke ide_transfer_start.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-3-git-send-email-jsnow@redhat.com

  commit 6aff22c013ab6f5f711665e7031fd555086d4464
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Mar 19 20:24:13 2015 -0400

      ide: fix cmd_write_pio when nsectors > 1

      We need to adjust the sector being written to
      prior to calling ide_transfer_start, otherwise
      we'll write to the same sector again.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1426811056-2202-2-git-send-email-jsnow@redhat.com

  commit e7aab6d6e3f6c29406e77210b9d8654e4d11340b
  Merge: 3c6c9fe 61c7480
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 23 15:11:29 2015 +0000

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150323' into staging

      linux-user patches for 2.3-rc1

      # gpg: Signature made Mon Mar 23 13:51:56 2015 GMT using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150323:
        linux-user: fix broken cpu_copy()
        linux-user: fix emulation of splice syscall
        linux-user/main.c: Remove redundant end_exclusive() in arm_kernel_cmpxchg64_helper()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 61c7480fa36775cc2baa2f8141f0c64a15f827b5
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 23 12:55:52 2015 +0000

      linux-user: fix broken cpu_copy()

      New threads always point at the same env which is incorrect and usually
      leads to a crash.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 17644b362746c400f45b0d2b0a3ce8a52fed13fb
  Author: Andreas Schwab <schwab@suse.de>
  Date:   Tue Mar 10 17:11:35 2015 +0100

      linux-user: fix emulation of splice syscall

      The second and fourth argument are in/out parameters, store them back
      after the syscall.  Also, the fourth argument was mishandled, and EFAULT
      handling was missing.

      Signed-off-by: Andreas Schwab <schwab@suse.de>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 92bed463d12ab9e1e34cdd44673ab9c4315ad1d2
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 19:03:29 2015 +0800

      linux-user/main.c: Remove redundant end_exclusive() in arm_kernel_cmpxchg64_helper()

      start/end_exclusive() need be pairs, except the start_exclusive() in
      stop_all_tasks() which is only used by force_sig(), which will be abort.
      So at present, start_exclusive() in stop_all_task() need not be paired.

      queue_signal() may call force_sig(), or return after kill pid (or queue
      signal). If could return from queue_signal(), stop_all_task() would not
      be called in time, the next end_exclusive() would be issue.

      So in arm_kernel_cmpxchg64_helper() for ARM, need remove end_exclusive()
      after queue_signal(). The related commit: "97cc756 linux-user: Implement
      new ARM 64 bit cmpxchg kernel helper".

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 3c6c9fe034c0c07b77f272e4a53d7735220a16a4
  Merge: 4eef864 a356850
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 12:26:09 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 queue 2015-03-19

      # gpg: Signature made Thu Mar 19 19:40:17 2015 GMT using RSA key ID 984DC5A6
      # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Haswell-noTSX and Broadwell-noTSX
        Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell"

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4eef86486d4090d7587e94d3f1a2203b94899989
  Merge: e7e9b49 549fc54
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 10:37:03 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/work/numa-verify-cpus-pull-request' into staging

      NUMA queue 2015-03-19

      # gpg: Signature made Thu Mar 19 19:25:53 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/work/numa-verify-cpus-pull-request:
        numa: Print warning if no node is assigned to a CPU
        pc: fix default VCPU to NUMA node mapping
        numa: introduce machine callback for VCPU to node mapping
        numa: Reject configuration if CPU appears on multiple nodes
        numa: Reject CPU indexes > max_cpus
        numa: Fix off-by-one error at MAX_CPUMASK_BITS check

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e7e9b49f8e9ea4c5c9d07f6d8c9071c64dae816a
  Merge: 3e5f623 4e289b1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 20 09:50:08 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150320-1' into staging

      usb: bugfix collection.

      # gpg: Signature made Fri Mar 20 07:51:19 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150320-1:
        ehci: fix segfault when hot-unplugging ehci controller
        ohci: fix resource cleanup leak
        uhci: fix segfault when hot-unplugging uhci controller
        hw/usb: Include USB files only if necessary
        usb/dev-storage: Avoid qerror_report_err() outside QMP handlers
        usb/dev-storage: Fix QMP device_add missing encryption key failure
        monitor usb: Inline monitor_read_bdrv_key_start()'s first part
        monitor: Plug memory leak in monitor_read_bdrv_key_start()
        monitor: Drop dead QMP check from monitor_read_password()
        uhci: Convert to realize
        ohci: Complete conversion to realize
        usb: Improve companion configuration error messages
        usb: Propagate errors through usb_register_companion()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4e289b1b62c8e271e3400317b4c3d98909093bc4
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:47 2015 +0800

      ehci: fix segfault when hot-unplugging ehci controller

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Reported-by: Lidonglin <lidonglin@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88dd1b8d0063ff16c54dc19c8b52508a00108f50
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:48 2015 +0800

      ohci: fix resource cleanup leak

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Ohci does't support hotplugging/hotunplugging yet, but
      existing resource cleanup leak logic likes ehci/uhci.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 537e572a7f807d7371a73ea5ffd9ce8d2487ff0c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 18 17:33:46 2015 +0800

      uhci: fix segfault when hot-unplugging uhci controller

      When hot-unplugging the usb controllers (ehci/uhci),
      we have to clean all resouce of these devices,
      involved registered reset handler. Otherwise, it
      may cause NULL pointer access and/or segmentation fault
      if we reboot the guest os after hot-unplugging.

      Let's hook up reset via DeviceClass->reset() and drop
      the qemu_register_reset() call. Then Qemu will register
      and unregister the reset handler automatically.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Reported-by: Lidonglin <lidonglin@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a356850b80b3d13b2ef737dad2acb05e6da03753
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Mar 13 15:58:09 2015 -0300

      target-i386: Haswell-noTSX and Broadwell-noTSX

      With the Intel microcode update that removed HLE and RTM, there will be
      different kinds of Haswell and Broadwell CPUs out there: some that still
      have the HLE and RTM features, and some that don't have the HLE and RTM
      features. On both cases people may be willing to use the pc-*-2.3
      machine-types.

      So, to cover both cases, introduce Haswell-noTSX and Broadwell-noTSX CPU
      models, for hosts that have Haswell and Broadwell CPUs without TSX support.

      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 1ee9159882f6687d6bc1f2207e97ada1eeccaa7c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Mar 13 15:39:43 2015 -0300

      Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell"

      This reverts commit 13704e4c455770d500d6b87b117e32f0d01252c9.

      With the Intel microcode update that removed HLE and RTM, there will be
      different kinds of Haswell and Broadwell CPUs out there: some that still
      have the HLE and RTM features, and some that don't have the HLE and RTM
      features. On both cases people may be willing to use the pc-*-2.3
      machine-types.

      So instead of making the CPU model results confusing by making it depend
      on the machine-type, keep HLE and RTM on the existing Haswell and
      Broadwell CPU models. The plan is to introduce "Haswell-noTSX" and
      "Broadwell-noTSX" CPU models later, for people who have CPUs that don't
      have TSX feature available.

      Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 549fc54b8cfe16a475d8f6b8f838e53b45452b4a
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:35:04 2015 -0200

      numa: Print warning if no node is assigned to a CPU

      We need all possible CPUs (including hotplug ones) to be present in the
      SRAT when QEMU starts. QEMU already does that correctly today, the only
      problem is that when a CPU is omitted from the NUMA configuration, it is
      silently assigned to node 0.

      Check if all CPUs up to max_cpus are present in the NUMA configuration
      and warn about missing CPUs.

      Make it just a warning, to allow management software to be updated if
      necessary. In the future we may make it a fatal error instead.

      Command-line examples:

      * Correct, no warning:

        $ qemu-system-x86_64 -smp 2,maxcpus=4
        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0-3

      * Incomplete, with warnings:

        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0
        qemu-system-x86_64: warning: CPU(s) not present in any NUMA nodes: 1 2 3
        qemu-system-x86_64: warning: All CPU(s) up to maxcpus should be described in NUMA config

        $ qemu-system-x86_64 -smp 2,maxcpus=4 -numa node,cpus=0-2
        qemu-system-x86_64: warning: CPU(s) not present in any NUMA nodes: 3
        qemu-system-x86_64: warning: All CPU(s) up to maxcpus should be described in NUMA config

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      ---
      v1 -> v2: (no changes)

      v2 -> v3:
       * Use enumerate_cpus() and error_report() for error message
       * Simplify logic using bitmap_full()

      v3 -> v4:
       * Clarify error message, mention that all CPUs up to
         maxcpus need to be described in NUMA config

      v4 -> v5:
       * Commit log update, to make problem description clearer

  commit fb43b73b9225ff2d19cf5350c68112aade7eec13
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Thu Mar 19 17:09:22 2015 +0000

      pc: fix default VCPU to NUMA node mapping

      Since commit
         dd0247e0 pc: acpi: mark all possible CPUs as enabled in SRAT
      Linux kernel actually tries to use CPU to Node mapping from
      QEMU provided SRAT table instead of discarding it, and that
      in some cases breaks build_sched_domains() which expects
      sane mapping where cores/threads belonging to the same socket
      are on the same NUMA node.

      With current default round-robin mapping of VCPUs to nodes
      guest ends-up with cores/threads belonging to the same socket
      being on different NUMA nodes.

      For example with following CLI:

         qemu-system-x86_64 -m 4G \
               -cpu Opteron_G3,vendor=AuthenticAMD \
               -smp 5,sockets=1,cores=4,threads=1,maxcpus=8 \
               -numa node,nodeid=0 -numa node,nodeid=1

      2.6.32 based kernels will hang on boot due to incorrectly built
      sched_group-s list in update_sd_lb_stats()

      Replacing default mapping with a manual, where VCPUs belonging to
      the same socket are on the same NUMA node, fixes the issue for
      guests which can't handle nonsense topology i.e. changing CLI to:
        -numa node,nodeid=0,cpus=0-3 -numa node,nodeid=1,cpus=4-7

      So instead of simply scattering VCPUs around nodes, provide
      callback to map the same socket VCPUs to the same NUMA node,
      which is what guests would expect from a sane hardware/BIOS.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 57924bcd87cb03cc21ebd7efed880d16ca048dce
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Thu Mar 19 17:09:21 2015 +0000

      numa: introduce machine callback for VCPU to node mapping

      Current default round-robin way of distributing VCPUs among
      NUMA nodes might be wrong in case on multi-core/threads
      CPUs. Making guests confused wrt topology where cores from
      the same socket are on different nodes.

      Allow a machine to override default mapping by providing
       MachineClass::cpu_index_to_socket_id()
      callback which would allow it group VCPUs from a socket
      on the same NUMA node.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3ef7197505e483e2f28c5fbd6ed54b4061221200
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:32:04 2015 -0200

      numa: Reject configuration if CPU appears on multiple nodes

      Each CPU can appear in only one NUMA node on the NUMA config. Reject
      configuration if a CPU appears in multiple nodes.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8979c945c1a7ffd20edbd5da2513c04baccfd7de
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Mon Feb 9 17:28:52 2015 -0200

      numa: Reject CPU indexes > max_cpus

      CPU index is always less than max_cpus, as documented at sysemu.h:

      > The following shall be true for all CPUs:
      >   cpu->cpu_index < max_cpus <= MAX_CPUMASK_BITS

      Reject configuration which uses invalid CPU indexes.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit ed26b92290768818371fbfd4317988eab6009ad5
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 12 15:23:48 2015 -0200

      numa: Fix off-by-one error at MAX_CPUMASK_BITS check

      Fix the CPU index check to ensure we don't go beyond the size of the
      node_cpu bitmap.

      CPU index is always less than MAX_CPUMASK_BITS, as documented at
      sysemu.h:

      > The following shall be true for all CPUs:
      >   cpu->cpu_index < max_cpus <= MAX_CPUMASK_BITS

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 3e5f6234b4f45a11b7c357dde2d6da36641bc6f6
  Merge: 33a8d5b 5b347c5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 17:47:08 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3.0-rc1

      # gpg: Signature made Thu Mar 19 15:03:26 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block: Fix blockdev-backup not to use funky error class
        raw-posix: Deprecate aio=threads fallback without O_DIRECT
        raw-posix: Deprecate host floppy passthrough

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 33a8d5b72d63fe44f08614408284fa934dee1edd
  Merge: 7a9a5e7 4add73a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 16:46:32 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/vser-for-2.3-3' into staging

      virtio-serial api: guest_writable callback for users

      # gpg: Signature made Thu Mar 19 12:06:55 2015 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/vser-for-2.3-3:
        virtio: serial: expose a 'guest_writable' callback for users

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5b347c541017b9ced10e8e9bce02d25bcf04c7af
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 08:36:14 2015 +0100

      block: Fix blockdev-backup not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit
      b7b9d39..7c6a4ab added uses of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace
      them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7a9a5e72e8a62395649a46c53c3c224cc73ca52f
  Merge: d88aec8 8ce1ee4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 14:10:20 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-03-19' into staging

      trivial patches for 2015-03-19

      # gpg: Signature made Thu Mar 19 08:57:54 2015 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-03-19: (24 commits)
        qga/commands-posix: Fix resource leak
        elf-loader: Add missing error handling for call of lseek
        elf-loader: Fix truncation warning from coverity
        hmp: Fix texinfo documentation
        Fix typos in comments
        qtest/ahci: Fix a bit mask expression
        vl: fix resource leak with monitor_fdset_add_fd
        smbios: add max speed comdline option for type-17 (meory device) structure
        pc-dimm: Add description for device list.
        configure: enable kvm on x32
        error: Replace error_report() & error_free() with error_report_err()
        arm: fix memory leak
        qmp: Drop unused .user_print from command definitions
        hmp: Fix definition of command quit
        target-moxie: Fix warnings from Sparse (one-bit signed bitfield)
        block/qapi: Fix Sparse warning
        Fix remaining warnings from Sparse (void return)
        qom: Fix warning from Sparse
        target-mips: Fix warning from Sparse
        arm/nseries: Fix warnings from Sparse
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d88aec88cdd2cdb1939b88a8cdab0a5da3c4559b
  Merge: 1cfa7e0 0af7a37
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 13:04:07 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150318' into staging

      MIPS patches 2015-03-18

      Changes:
      * bug fixes

      # gpg: Signature made Wed Mar 18 10:06:00 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150318:
        target-mips: save cpu state before calling MSA load and store helpers
        target-mips: fix hflags modified in delay / forbidden slot
        target-mips: fix CP0.BadVAddr by stopping translation on Address Error

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1cfa7e0ab223198b8b5449508d37613003d954a4
  Merge: 2259c16 4a48aaa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 12:12:21 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150318-1' into staging

      vnc: fix websockets & QMP.

      # gpg: Signature made Wed Mar 18 13:12:35 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150318-1:
        ui: ensure VNC websockets server checks the ACL if requested
        ui: remove separate gnutls_session for websockets server
        ui: enforce TLS when using websockets server
        ui: fix setup of VNC websockets auth scheme with TLS
        ui: split setup of VNC auth scheme into separate method
        ui: report error if user requests VNC option that is unsupported
        ui: replace printf() calls with VNC_DEBUG
        ui: remove unused 'wiremode' variable in VncState struct
        vnc: Fix QMP change not to use funky error class

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4add73aa601ab42b7a9863d483fa313b06105b34
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Thu Jul 17 20:02:45 2014 +0530

      virtio: serial: expose a 'guest_writable' callback for users

      Users of virtio-serial may want to know when a port becomes writable.  A
      port can stop accepting writes if the guest port is open but not being
      read from.  In this case, data gets queued up in the virtqueue, and
      after the vq is full, writes to the port do not succeed.

      When the guest reads off a vq element, and adds a new one for the host
      to put data in, we can tell users the port is available for more writes,
      via the new ->guest_writable() callback.

      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 965182549cee6fa337f0e72cde4d5787f35f33ac
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Mar 17 13:45:21 2015 +0100

      raw-posix: Deprecate aio=threads fallback without O_DIRECT

      Currently, if the user requests aio=native, but forgets to choose a
      cache mode that sets O_DIRECT, that request is silently ignored and raw
      falls back to aio=threads.

      Deprecate that behaviour so we can make it an error in future qemu
      versions.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 2259c16dc21aa55cd3fbc26f9be602949105d249
  Merge: 1f35009 ce39494
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 11:12:21 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, virtio bugfixes for 2.3

      Just a bunch of bugfixes. Should be nothing remarkable here.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 18 12:31:03 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
      #      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

      * remotes/mst/tags/for_upstream:
        pcie_aer: fix comment to match pcie spec
        pci: fix several trivial typos in comment
        aer: fix a wrong init PCI_ERR_COR_STATUS w1cmask type register
        pcie_aer: fix typos in pcie_aer_inject_error comment
        aer: fix wrong check on expose aer tlp prefix log
        pcie: correct mistaken register bit for End-End TLP Prefix Blocking
        virtio: Fix memory leaks reported by Coverity
        virtio: validate the existence of handle_output before calling it

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 92a539d22e0da14d5395eb2c2c8bee162ebdb0b8
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 17 17:02:20 2015 +0100

      raw-posix: Deprecate host floppy passthrough

      Raise your hand if you have a physical floppy drive in a computer
      you've powered on in 2015.  Okay, I see we got a few weirdos in the
      audience.  That's okay, weirdos are welcome here.

      Kidding aside, media change detection doesn't fully work, isn't going
      to be fixed, and floppy passthrough just isn't earning its keep
      anymore.

      Deprecate block driver host_floppy now, so we can drop it after a
      grace period.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1f3500976d3d9d77718ba9b0e69cd4e32239ebfc
  Merge: cd232ac c3c1bb9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 19 10:07:23 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - kvm: ioeventfd fix for PPC64LE
      - virtio-scsi: misc fixes
      - fix for --enable-profiler
      - nbd: fixes from Max
      - build: fix for scripts/make_device_config.sh
      - exec: fix for address_space_translate

      # gpg: Signature made Wed Mar 18 11:11:08 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        exec: Respect as_tranlsate_internal length clamp
        virtio-scsi-dataplane: fix memory leak in virtio_scsi_vring_init
        profiler: Reenable built-in profiler
        kvm: fix ioeventfd endianness on bi-endian architectures
        virtio-scsi: Fix assert in virtio_scsi_push_event
        build: pass .d file name to scripts/make_device_config.sh, fix makefile target
        coroutine-io: Return -errno in case of error
        nbd: Drop unexpected data for NBD_OPT_LIST
        nbd: Fix interpretation of the export flags
        nbd: Fix nbd_receive_options()
        nbd: Set block size to BDRV_SECTOR_SIZE
        nbd: Fix potential signed overflow issues
        qemu-nbd: fork() can fail
        nbd: Handle blk_getlength() failure
        nbd: Pass return value from nbd_handle_list()
        nbd: Fix nbd_establish_connection()'s return value
        qemu-nbd: Detect unused partitions by system == 0
        util/uri: Add overflow check to rfc3986_parse_port
        nbd: Fix overflow return value

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ce1ee4618f4a557959f5a5731f6726b30416df5
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Sat Mar 14 17:52:15 2015 +0800

      qga/commands-posix: Fix resource leak

      It's detected by coverity. Close the dirfd.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 23bf2e76806390bf12798c2234a23c5c8a15c35d
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 16:42:01 2015 +0100

      elf-loader: Add missing error handling for call of lseek

      This fixes a warning from Coverity.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6cbfb86f4c0ea7cbe852c7bc62a4ef523887c143
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 09:37:08 2015 +0100

      elf-loader: Fix truncation warning from coverity

      Coverity reports a truncation due to cast operation on operand
      reltab->sh_size from 64 bits to 32 bits for calls of load_at.

      Fix the types of the function arguments to match their use in
      function load_at: the offset is used for lseek which takes an
      off_t parameter, the size is used for g_malloc and read.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b76d799ea5ba233a768939c3192105099f84798d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Mar 10 13:23:04 2015 +0100

      hmp: Fix texinfo documentation

      Several issues:

      * Commands i and o lack @item.  Their one-liner documentation gets
        squashed into the preceding command print.  Add the obvious @item.

      * Commands i, o and cpu-add lack @findex.  The function index doesn't
        have them.  Add the obvious @findex.

      * Commit 727f005 put block_set_io_throttle was added in the middle of
        block_passwd.  Move it.

      * Correct spelling of commands chardev-add and chardev-remove in @item
        and @findex.

      * Some commands have a blank line between @item/@findex and the text,
        most don't.  Normalize to no blank line.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit de7ad4ce1f13ea59dfb35fc9985a1c90966646a8
  Author: Viswesh <visweshn92@gmail.com>
  Date:   Tue Mar 17 22:53:08 2015 +0800

      Fix typos in comments

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Viswesh <visweshn92@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e7d49d68bb165ddfdf29929e0a487264085ca51
  Author: John Snow <jsnow@redhat.com>
  Date:   Tue Mar 17 16:58:19 2015 -0400

      qtest/ahci: Fix a bit mask expression

      A thinko that clang 3.5.0 caught.
      Thankfully does not introduce any new failures.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 636a30a890c50f734c90ee929e16492fbc6c73e3
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Sun Mar 15 10:16:28 2015 +0100

      vl: fix resource leak with monitor_fdset_add_fd

      monitor_fdset_add_fd returns an AddfdInfo struct (used by the QMP
      command add_fd).  Free it.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3ebd6cc8d30374da8b72909960f4426e82e5f6ef
  Author: Gabriel L. Somlo <gsomlo@gmail.com>
  Date:   Wed Mar 11 13:58:01 2015 -0400

      smbios: add max speed comdline option for type-17 (meory device) structure

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit bdd09778a0649639130aff21a361732a715a0a4f
  Author: Paulo Vital <paulo.vital@profitbricks.com>
  Date:   Tue Mar 10 12:25:51 2015 +0100

      pc-dimm: Add description for device list.

      The pc-dimm option presented on device list (by argument "-device \?")
      is the unique option that don't have any information about it. This
      patch adds a description for the pc-dimm device to help users to
      identify it.

      Signed-off-by: Paulo Vital <paulo.vital@profitbricks.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 18b8263e4ee72697876b081a7520d4ec86b2aab1
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:13:45 2015 +0300

      configure: enable kvm on x32

      Here's a trivial change to enable kvm on x32 architecture.
      I'm not 100% sure the result works correctly in all cases,
      but this is a good start and in theory everything should
      work.

      Signed-off-by: Adam Borowski <kilobyte@angband.pl>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 198675491fcec79f6ebb5d85ccaa52beecd56e43
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Wed Mar 4 18:25:54 2015 +0800

      error: Replace error_report() & error_free() with error_report_err()

      This is a continuation of the work started in commit 565f65d27:
      "error: Use error_report_err() where appropriate"

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6e05a12f8f7f32a3fecbeb0c572d549a5f6e9177
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 5 10:58:32 2015 +0800

      arm: fix memory leak

      Cc: Michael Tokarev <mjt@tls.msk.ru>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 293811f6c1630e3b37aa9d214c6596ce854ab2c7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:09:58 2015 +0100

      qmp: Drop unused .user_print from command definitions

      .user_print isn't used with QMP commands, only with HMP commands.
      Copied over when QMP got its own command table in commit 82a56f0.
      Most of them have been dropped since, but a few stragglers remain.
      Drop them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 46db7b862ab66d14679bb96563092e7ef76f1cfb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 6 10:09:57 2015 +0100

      hmp: Fix definition of command quit

      The command handler is a union of two function types.  If
      cmd->user_print is set, handle_user_command() calls
      cmd->mhandler.cmd_new(), else cmd->mhandler.cmd().

      Command definitions must therefore either set both user_print() and
      mhandler.cmd_new(), or only mhandler.cmd().

      quit's sets user_print and mhandler.cmd().  handle_user_command()
      calls hmp_quit() through mhandler.cmd_new() rather than
      mhandler.cmd(), i.e. through a function pointer with a different type.
      Broken in commit 7a7f325, v1.0.

      Works in practice because hmp_quit() doesn't use its arguments, and
      handle_user_command() ignores its function value.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6093d01194edd74e24d46028b84d9d4a0a5cba17
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:44:02 2015 +0100

      target-moxie: Fix warnings from Sparse (one-bit signed bitfield)

      Report from Sparse:

      target-moxie/mmu.h:9:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:10:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:11:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:12:12: error: dubious one-bit signed bitfield
      target-moxie/mmu.h:13:12: error: dubious one-bit signed bitfield

      Cc: Anthony Green <green@moxielogic.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c20fa2cc26fd203a1260bb5251a523320faa905
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 23:16:21 2015 +0100

      block/qapi: Fix Sparse warning

      Sparse reports this warning:

      block/qapi.c:417:47: warning:
       too long initializer-string for array of char(no space for nul char)

      Replacing the string by an array of characters fixes this warning.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e7ae771f6de2c7b3fa87823f87d6e10caeb91ec6
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:30:01 2015 +0100

      Fix remaining warnings from Sparse (void return)

      Sparse report:

      hw/display/vga.c:2000:5: warning: returning void-valued expression
      hw/intc/arm_gic.c:707:9: warning: returning void-valued expression
      hw/intc/etraxfs_pic.c:138:9: warning: returning void-valued expression
      hw/nvram/fw_cfg.c:475:5: warning: returning void-valued expression
      hw/timer/a9gtimer.c:124:5: warning: returning void-valued expression
      hw/tpm/tpm_tis.c:794:5: warning: returning void-valued expression
      hw/usb/hcd-musb.c:558:9: warning: returning void-valued expression
      hw/usb/hcd-musb.c:776:13: warning: returning void-valued expression
      hw/usb/hcd-musb.c:867:5: warning: returning void-valued expression
      hw/usb/hcd-musb.c:932:5: warning: returning void-valued expression
      include/qom/cpu.h:584:5: warning: returning void-valued expression
      monitor.c:4686:13: warning: returning void-valued expression
      monitor.c:4690:13: warning: returning void-valued expression

      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Andreas Färber <afaerber@suse.de>
      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fbe95bfb654f5f79778c9f292e55a67f91f5cc37
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:23:32 2015 +0100

      qom: Fix warning from Sparse

      Sparse report:

      qom/cpu.c:99:5: warning: returning void-valued expression

      Cc: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 327e9759f11a001545f2fbbf796a85d3d55f1b15
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:23:13 2015 +0100

      target-mips: Fix warning from Sparse

      Sparse report:

      target-mips/dsp_helper.c:3681:5: warning: returning void-valued expression

      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 30d76f13be4eac5499b5ce017f47d5f26ef743af
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:22:48 2015 +0100

      arm/nseries: Fix warnings from Sparse

      Sparse report:

      arm/nseries.c:1406:5: warning: returning void-valued expression
      arm/nseries.c:1411:5: warning: returning void-valued expression

      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 77a8257ed711dd7c2ae73c741c93a68aaf0f3391
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:21:13 2015 +0100

      omap: Fix warnings from Sparse

      Sparse report:

      arm/omap1.c:1015:9: warning: returning void-valued expression
      arm/omap1.c:1084:9: warning: returning void-valued expression
      arm/omap1.c:1178:9: warning: returning void-valued expression
      arm/omap1.c:1287:9: warning: returning void-valued expression
      arm/omap1.c:1382:9: warning: returning void-valued expression
      arm/omap1.c:1650:9: warning: returning void-valued expression
      arm/omap1.c:1778:9: warning: returning void-valued expression
      arm/omap1.c:1985:9: warning: returning void-valued expression
      arm/omap1.c:210:9: warning: returning void-valued expression
      arm/omap1.c:2213:9: warning: returning void-valued expression
      arm/omap1.c:2352:9: warning: returning void-valued expression
      arm/omap1.c:2447:9: warning: returning void-valued expression
      arm/omap1.c:2640:9: warning: returning void-valued expression
      arm/omap1.c:317:9: warning: returning void-valued expression
      arm/omap1.c:3413:13: warning: returning void-valued expression
      arm/omap1.c:3414:13: warning: returning void-valued expression
      arm/omap1.c:3415:14: warning: returning void-valued expression
      arm/omap1.c:3589:9: warning: returning void-valued expression
      arm/omap1.c:443:9: warning: returning void-valued expression
      arm/omap1.c:588:9: warning: returning void-valued expression
      arm/omap1.c:860:9: warning: returning void-valued expression
      arm/omap2.c:1362:9: warning: returning void-valued expression
      arm/omap2.c:450:9: warning: returning void-valued expression
      arm/omap2.c:695:9: warning: returning void-valued expression
      arm/omap2.c:760:9: warning: returning void-valued expression
      hw/char/omap_uart.c:115:9: warning: returning void-valued expression
      hw/display/omap_dss.c:1019:9: warning: returning void-valued expression
      hw/display/omap_dss.c:215:9: warning: returning void-valued expression
      hw/display/omap_dss.c:380:9: warning: returning void-valued expression
      hw/display/omap_dss.c:739:9: warning: returning void-valued expression
      hw/display/omap_dss.c:931:9: warning: returning void-valued expression
      hw/dma/omap_dma.c:139:5: warning: returning void-valued expression
      hw/dma/omap_dma.c:1505:9: warning: returning void-valued expression
      hw/dma/omap_dma.c:1860:9: warning: returning void-valued expression
      hw/gpio/omap_gpio.c:116:9: warning: returning void-valued expression
      hw/misc/omap_gpmc.c:627:9: warning: returning void-valued expression
      hw/misc/omap_l4.c:85:9: warning: returning void-valued expression
      hw/misc/omap_sdrc.c:95:9: warning: returning void-valued expression
      hw/misc/omap_tap.c:98:9: warning: returning void-valued expression
      hw/sd/omap_mmc.c:409:9: warning: returning void-valued expression
      hw/ssi/omap_spi.c:229:9: warning: returning void-valued expression
      hw/timer/omap_gptimer.c:447:9: warning: returning void-valued expression

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0289a412e8e41bfddf9e61336ee94e348dcaedfe
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:17:54 2015 +0100

      9pfs: Fix warnings from Sparse

      Sparse report:

      9pfs/virtio-9p.c:1953:9: warning: returning void-valued expression
      9pfs/virtio-9p-handle.c:143:5: warning: returning void-valued expression
      9pfs/virtio-9p-handle.c:160:5: warning: returning void-valued expression
      9pfs/virtio-9p-local.c:384:5: warning: returning void-valued expression
      9pfs/virtio-9p-local.c:415:5: warning: returning void-valued expression
      9pfs/virtio-9p-proxy.c:672:5: warning: returning void-valued expression
      9pfs/virtio-9p-proxy.c:689:5: warning: returning void-valued expression

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c80d953b2fd839d36795c7a55a4c525ec6e0cc8
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 8 19:14:47 2015 +0100

      backends: Fix warning from Sparse

      Sparse report:

      backends/tpm.c:39:5: warning: returning void-valued expression

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 302cb24addd18213c615dfa57de22dcae4776d2a
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Tue Mar 10 08:31:30 2015 +0300

      cris: remove unused cris_cond15 declarations

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>

  commit ce394947a75296fc10f1676932473e92aa8be11a
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 18 12:45:53 2015 +0100

      pcie_aer: fix comment to match pcie spec

      Code comment says "table 6-2" but in fact it's is not a table, it is
      "Figure 6-2" on page 479.

      Cc: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reported-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 98a2f30a1b5b8b7b35229a705149f020b4918ab8
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:52:23 2015 +0800

      pci: fix several trivial typos in comment

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 310e91f7d0aaec27f55969597ccbb4e83612695e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:49:49 2015 +0800

      aer: fix a wrong init PCI_ERR_COR_STATUS w1cmask type register

      Error Status Register, so this patch fix a wrong definition
      for PCI_ERR_COR_STATUS register with w1cmask type.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b01738c23da718678469cbe85c0a4a82b19652d4
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Tue Mar 10 09:49:48 2015 +0800

      pcie_aer: fix typos in pcie_aer_inject_error comment

      Refer to "PCI Express Base Spec3.0", this comments can't
      fit the description in spec, so we should fix them.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 77a3c1d730a14c86f3f5692be9906b206afc3d3e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Fri Mar 13 11:18:04 2015 +0800

      aer: fix wrong check on expose aer tlp prefix log

      when specify TLP Prefix log as using pcie_aer_inject_error,
      the TLP prefix log is always discarded. because the check
      is incorrect, the End-End TLP Prefix Supported bit
      (PCI_EXP_DEVCAP2_EETLPP) should be in Device Capabilities 2 Register.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 30b04f8711c5191929af4ed03a779646ced3456e
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Fri Mar 13 11:18:03 2015 +0800

      pcie: correct mistaken register bit for End-End TLP Prefix Blocking

      from pcie spec 7.8.17, the End-End TLP Prefix Blocking bit local
      is 15(e.g. 0x8000) in device control 2 register.

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c3c1bb99d1c11978d9ce94d1bdcf0705378c1459
  Author: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  Date:   Mon Mar 16 22:35:54 2015 -0700

      exec: Respect as_tranlsate_internal length clamp

      address_space_translate_internal will clamp the *plen length argument
      based on the size of the memory region being queried. The iommu walker
      logic in addresss_space_translate was ignoring this by discarding the
      post fn call value of *plen. Fix by just always using *plen as the
      length argument throughout the fn, removing the len local variable.

      This fixes a bootloader bug when a single elf section spans multiple
      QEMU memory regions.

      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1426570554-15940-1-git-send-email-peter.crosthwaite@xilinx.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 196d4fc56d824ccbbb58714e9ad0793053ef8260
  Author: Bo Su <subo7@huawei.com>
  Date:   Wed Mar 18 09:42:12 2015 +0000

      virtio-scsi-dataplane: fix memory leak in virtio_scsi_vring_init

      if k->set_host_notifier failed, VirtIOSCSIVring *r will leak

      Signed-off-by: Bo Su <subo7@huawei.com>
      Message-Id: <1426671732-80213-1-git-send-email-subo7@huawei.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 89d5cbddeeaf6bb4aa6a5ca4fbb443115abce4a2
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 16 14:57:38 2015 +1100

      profiler: Reenable built-in profiler

      2ed1ebcf6 "timer: replace time() with QEMU_CLOCK_HOST" broke compile
      when configured with --enable-profiler. Turned out the profiler has been
      broken for a while.

      This does s/qemu_time/tcg_time/ as the profiler only works in a TCG mode.
      This also fixes the compile error.

      This changes profile_getclock() to return nanoseconds rather than
      CPU ticks as the "profile" HMP command prints seconds and there is no
      platform-independent way to get ticks-per-second rate.
      Since TCG is quite slow and get_clock() returns nanoseconds (fine
      enough), this should not affect precision much.

      This removes unused qemu_time_start and tlb_flush_time.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Message-Id: <1426478258-29961-1-git-send-email-aik@ozlabs.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b680c5ba54946ab205cdb5083bc0a17e3f2fb468
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Fri Mar 13 22:23:37 2015 +0100

      kvm: fix ioeventfd endianness on bi-endian architectures

      KVM expects host endian values. Hosts that don't use the default endianness
      need to negate the swap performed in adjust_endianness().

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Message-Id: <20150313212337.31142.3991.stgit@bahia.local>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2034e324dabc55064553aaa07de1536ebf8ea497
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Mar 13 15:55:54 2015 +0800

      virtio-scsi: Fix assert in virtio_scsi_push_event

      Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.

          qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
          Assertion `skip == 0' failed.

      This is introduced by commit 55783a55 (virtio-scsi: work around bug in
      old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
      (the same to in sg). For virtio_scsi_push_event, looking into out_sg
      doesn't make sense because 0 req_size is intended.

      Cc: qemu-stable@nongnu.org
      [Cc'ing qemu-stable because 55783a55 did it too]
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1426233354-525-1-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 15564d85afaf1d7b314c858a5a34bda599f4cd14
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 12 16:00:05 2015 +0100

      build: pass .d file name to scripts/make_device_config.sh, fix makefile target

      The .d file name must match exactly what is used in the SUBDIR_DEVICES_MAK_DEP
      variable.  Instead of making assumptions in the make_device_config.sh script,
      just pass it in.

      Similarly, the makefile target may not match the output file name, because
      Makefile uses a temporary file.  Instead of making assumptions on what the
      Makefile does, emit the config-devices.mak file to stdout, and use the
      passed-in destination as the makefile target

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4adf4180f284caf4ea9cd83ce37085d50a52603b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:28 2015 -0500

      coroutine-io: Return -errno in case of error

      In case qemu_co_sendv_recvv() fails without any data read, there is no
      reason not to return the perfectly fine error number retrieved from
      socket_error().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-16-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0379f474ddebfc69f42fa8231d86687cf29d997b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:34 2015 -0500

      nbd: Drop unexpected data for NBD_OPT_LIST

      When requesting the list of exports, no data should be sent. If data is
      sent, the NBD server should not just inform the client of the invalid
      request, but also drop the data.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-22-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 48c7d80de8863e3436b3b5d5676018b2afaec161
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:32 2015 -0500

      nbd: Fix interpretation of the export flags

      The export flags are a 16 bit value, so be16_to_cpu() has to be used to
      interpret them correctly. This makes discard and flush actually work
      for named NBD exports (they did not work before, because the client
      always assumed them to be unsupported because of the bug fixed by this
      patch).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-20-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9c122adadbf4377eb77195b3944be10a59d9484f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:31 2015 -0500

      nbd: Fix nbd_receive_options()

      The client flags are sent exactly once overall, not once per option.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-19-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3f4726596dafd2e27485e51f4cc4a2363f48d4a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:25 2015 -0500

      nbd: Set block size to BDRV_SECTOR_SIZE

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-13-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ac97393dc7c4761af6104fb8fca5f600899f687b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:23 2015 -0500

      nbd: Fix potential signed overflow issues

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-11-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 70d4739ef200760d8cac3355d05b4252f2f37fec
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:22 2015 -0500

      qemu-nbd: fork() can fail

      It is very unlikely, but it is possible.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-10-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 98f44bbe70bb803e7be2421b7cc92a1c179afb87
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:21 2015 -0500

      nbd: Handle blk_getlength() failure

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-9-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 892f5a5270f9f3cae4f384dffbf70679fa2a57b6
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:19 2015 -0500

      nbd: Pass return value from nbd_handle_list()

      While it does not make a difference in practice, nbd_receive_options()
      generally returns -errno, so it should do that here as well; and the
      easiest way to achieve this is by passing on the value returned by
      nbd_handle_list().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-7-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b1f13b996c3a278ed3d4bf4ce0893f3506fb7cc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:16 2015 -0500

      nbd: Fix nbd_establish_connection()'s return value

      unix_connect_opts() and inet_connect_opts() do not necessarily set errno
      (if at all); therefore, nbd_establish_connection() should not literally
      return -errno on error.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-4-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 453b07b13443713f6a632005977c7ccab17e135d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:15 2015 -0500

      qemu-nbd: Detect unused partitions by system == 0

      Unused partitions do not necessarily have a total sector count of 0
      (although they should have), but they always do have the system field
      set to 0, so use that for testing whether a partition is in use rather
      than the sector count field alone.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-3-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b21233061696feed434317a70e0a8b74f956ec8
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 25 13:08:14 2015 -0500

      util/uri: Add overflow check to rfc3986_parse_port

      And while at it, replace tabs by eight spaces in this function.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1424887718-10800-2-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8b2f0abfd61237b301a29e814535b1e36d733aaa
  Author: Yik Fang <eric.fangyi@huawei.com>
  Date:   Thu Feb 12 06:21:51 2015 +0000

      nbd: Fix overflow return value

      The value of reply.error should be the type unsigned int.

      Signed-off-by: Yik Fang <eric.fangyi@huawei.com>
      Message-Id: <1423722111-12902-1-git-send-email-eric.fangyi@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8ffd9f4dd41f0423f0df8bef8f2e25ab4bb1a3f3
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Mar 17 14:52:54 2015 +0100

      hw/usb: Include USB files only if necessary

      Boards that do not include an USB controller should not provide
      USB devices. However, when running "qemu-system-s390x -device help"
      for example, there's still a usb-hub, usb-kbd, usb-mouse and
      usb-tablet in the list of "supported" devices. Let's fix that
      by compiling and linking the USB files only if it is really
      necessary.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0af7a37054310384e00209e0a43efe95b7c19ef0
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 16 16:29:34 2015 +0000

      target-mips: save cpu state before calling MSA load and store helpers

      PC needs to be saved if an exception can be generated by an helper.
      This fixes a problem related to resuming the execution at unexpected address
      after an exception (caused by MSA load/store instruction) has been serviced.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit a5f533909e746ca6e534b232fb42c9c6fd81b468
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Thu Jan 29 16:15:00 2015 +0000

      target-mips: fix hflags modified in delay / forbidden slot

      All instructions which may change hflags terminate tb. However, this doesn't
      work if such an instruction is placed in delay or forbidden slot.
      gen_branch() clears MIPS_HFLAG_BMASK in ctx->hflags and then generates code
      to overwrite hflags with ctx->hflags, consequently we loose any execution-time
      hflags modifications. For example, in the following scenario hflag related to
      Status.CU1 will not be updated:
          /* Set Status.CU1 in delay slot */
          mfc0  $24, $12, 0
          lui   $25, 0x2000
          or    $25, $25, $24
          b     check_Status_CU1
          mtc0  $25, $12, 0

      With this change we clear MIPS_HFLAG_BMASK in execution-time hflags if
      instruction in delay or forbidden slot wants to terminate tb for some reason
      (i.e. ctx->bstate != BS_NONE).

      Also, die early and loudly if "unknown branch" is encountered as this should
      never happen.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 62c688693bf2f0355fc5bad5dcc59c1cd2a51f1a
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Mar 16 16:54:42 2015 +0000

      target-mips: fix CP0.BadVAddr by stopping translation on Address Error

      CP0.BadVAddr is supposed to capture the most recent virtual address that caused
      the exception. Currently this does not work correctly for unaligned instruction
      fetch as translation is not stopped and CP0.BadVAddr is updated with subsequent
      addresses.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4a48aaa9f52dbac148be24f591de2f28c58ccb5d
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:43:00 2015 +0000

      ui: ensure VNC websockets server checks the ACL if requested

      If the x509verify option is requested, the VNC websockets server
      was failing to validate that the websockets client provided an
      x509 certificate matching the ACL rules.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7b45a00d05cc936d28e36b95932864e8cc095968
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:59 2015 +0000

      ui: remove separate gnutls_session for websockets server

      The previous change to the auth scheme handling guarantees we
      can never have nested TLS sessions in the VNC websockets server.
      Thus we can remove the separate gnutls_session instance.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 51941e4695c6f6c1f786bacef7e8c3a477570e04
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:58 2015 +0000

      ui: enforce TLS when using websockets server

      When TLS is required, the primary VNC server considers it to be
      mandatory. ie the server admin decides whether or not TLS is used,
      and the client has to comply with this decision. The websockets
      server, however, treated it as optional, allowing non-TLS clients
      to connect to a server which had setup TLS. Thus enabling websockets
      lowers the security of the VNC server leaving the admin no way to
      enforce use of TLS.

      This removes the code that allows non-TLS fallback in the websockets
      server, so that if TLS is requested for VNC it is now mandatory for
      both the primary VNC server and the websockets VNC server.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f9148c8ae7b1515776699387b4d59864f302c77d
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:57 2015 +0000

      ui: fix setup of VNC websockets auth scheme with TLS

      The way the websockets TLS code was integrated into the VNC server
      made it essentially useless. The only time that the websockets TLS
      support could be used is if the primary VNC server had its existing
      TLS support disabled. ie QEMU had to be launched with:

        # qemu -vnc localhost:1,websockets=5902,x509=/path/to/certs

      Note the absence of the 'tls' flag. This is already a bug, because
      the docs indicate that 'x509' is ignored unless 'tls' is given.

      If the primary VNC server had TLS turned on via the 'tls' flag,
      then this prevented the websockets TLS support from being used,
      because it activates the VeNCrypt auth which would have resulted
      in TLS being run over a TLS session. Of course no websockets VNC
      client supported VeNCrypt so in practice, since the browser clients
      cannot setup a nested TLS session over the main HTTPS connection,
      so it would not even get past auth.

      This patch causes us to decide our auth scheme separately for the
      main VNC server vs the websockets VNC server. We take account of
      the fact that if TLS is enabled, then the websockets client will
      use https, so setting up VeNCrypt is thus redundant as it would
      lead to nested TLS sessions.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0dd72e1531f0ea1a62fd016702ea3b868d116bd8
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:56 2015 +0000

      ui: split setup of VNC auth scheme into separate method

      The vnc_display_open method is quite long and complex, so
      move the VNC auth scheme decision logic into a separate
      method for clarity.

      Also update the comment to better describe what we are
      trying to achieve.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d169f04b8b8424ad9c5377bb5391de2f760e3db1
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:55 2015 +0000

      ui: report error if user requests VNC option that is unsupported

      If the VNC server is built without tls, sasl or websocket support
      and the user requests one of these features, they are just silently
      ignored. This is bad because it means the VNC server ends up running
      in a configuration that is less secure than the user asked for.
      It also leads to an tangled mass of preprocessor conditionals when
      configuring the VNC server.

      This ensures that the tls, sasl & websocket options are always
      processed and an error is reported back to the user if any of
      them were disabled at build time.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 153130cd4fa236e29bb6243eebf9439b983ca266
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:54 2015 +0000

      ui: replace printf() calls with VNC_DEBUG

      Handling of VNC audio messages results in printfs to the console.
      This is of no use to anyone in production, so should be using the
      normal VNC_DEBUG macro instead.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2f45bc02ae9be18119d2fb88042ef19e7e9247f
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 17 13:42:53 2015 +0000

      ui: remove unused 'wiremode' variable in VncState struct

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cd232acfa0d70002fed89e9293f04afda577a513
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 18:58:33 2015 +0000

      Update version for v2.3.0-rc0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d8e33fc98081b548b25be9458490c40858480344
  Merge: ac738ea cde63fb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 17:11:33 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150317' into staging

      migration/next for 20150317

      # gpg: Signature made Tue Mar 17 14:21:14 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150317:
        migration: Expose 'cancelling' status to user
        migration: Convert 'status' of MigrationInfo to use an enum type
        hmp: Rename 'MigrationStatus' to 'HMPMigrationStatus'
        migration: Rename abbreviated macro MIG_STATE_* to MIGRATION_STATUS_*
        migration: Remove unused functions
        arch_init: Count the total number of pages by using helper function
        migrate_incoming: Cleanup/clarify error messages
        Warn against the use of the string as uri parameter to migrate-incoming
        migrate_incoming: use hmp_handle_error
        migration: Fix remaining 32 bit compiler errors
        migration: Fix some 32 bit compiler errors
        migration/rdma: clean up qemu_rdma_dest_init a bit
        migration: Avoid qerror_report_err() outside QMP command handlers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ac738eadc409813c5fbb37dae8d254cb5664733a
  Merge: 1a87e52 e1570d0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 16:19:12 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * QTest for PC X86CPU
      * Confinement of ICC bridge X86CPU parenting to PC code

      # gpg: Signature made Tue Mar 17 15:23:31 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter:
        target-i386: Remove icc_bridge parameter from cpu_x86_create()
        tests: Add PC CPU test
        pc: Suppress APIC ID compatibility warning for QTest

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1a87e52770ca64f5a09e9c46d29ea3b5a5db5ffd
  Merge: 5a49928 88950ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 15:23:23 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Conversion of cadence_uart to QOM realize
      * qom-tree QMP script
      * qom-list and qom-set HMP commands to match their QMP counterparts
      * Basic qom-tree HMP command
      * Cleanups for /machine QOM composition tree

      # gpg: Signature made Tue Mar 17 15:02:57 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        qdev: Move owner-less IRQs to /machine/unattached
        memory: Move owner-less MemoryRegions to /machine/unattached
        qom: Implement info qom-tree HMP command
        qom: Implement qom-set HMP command
        qom: Implement qom-list HMP command
        scripts: Add qom-tree script
        cadence_uart: Convert to QOM realize()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cde63fbed86e20dda98bf35025faedd994918f00
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:41 2015 +0800

      migration: Expose 'cancelling' status to user

      'cancelling' status was introduced by commit 51cf4c1a, mainly to avoid a
      possible start of a new migration process while the previous one still exists.
      But we didn't expose this status to user, instead we returned the 'active' state.

      Here, we expose it to the user (such as libvirt), 'cancelling' status only
      occurs for a short window before the migration aborts, so for users,
      if they cancel a migration process, it will observe 'cancelling' status
      occasionally.

      Testing revealed that with older libvirt (anything 1.2.13 or less) will
      print an odd error message if the state is seen, but that the migration
      is still properly cancelled. Newer libvirt will be patched to recognize
      the new state without the odd error message.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Cc: libvir-list@redhat.com
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 24b8c39b5c34b05f1ac870c421e2e61574abbdf9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:40 2015 +0800

      migration: Convert 'status' of MigrationInfo to use an enum type

      The original 'status' is an open-coded 'str' type, convert it to use an
      enum type.
      This conversion is backwards compatible, better documented and
      more convenient for future extensibility.

      In addition, Fix a typo for qapi-schema.json (just remove the typo) :
      s/'completed'. 'comppleted' (since 1.2)/'completed' (since 1.2)

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e49f35bdb4974d6cfd7e5eb5cb9f8c50eef3f3a9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:39 2015 +0800

      hmp: Rename 'MigrationStatus' to 'HMPMigrationStatus'

      We will use the typename 'MigrationStatus' for publicly exported typename,
      So here we rename the internal-only 'MigrationStatus' to
      'HMPMigrationStatus'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3119473166eeac017b249b408b07473aff5a7ca2
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Fri Mar 13 16:08:38 2015 +0800

      migration: Rename abbreviated macro MIG_STATE_* to MIGRATION_STATUS_*

      Rename all macro MIG_STATE_* to  MIGRATION_STATUS_* except "MIG_STATE_ERROR",
      we rename it to "MIGRATION_STATUS_FAILED" which will match the migration status
      string 'failed'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 21cb4924f79579222459c2395f28d1a26d4ef0bd
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Sat Mar 14 07:19:28 2015 +0100

      migration: Remove unused functions

      migrate_rdma_pin_all() and qsb_clone() are completely unused and thus
      can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f54a235f9b15ae59d70b40630417d8aaa88bc4ec
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Mar 9 17:27:38 2015 +0800

      arch_init: Count the total number of pages by using helper function

      There is already a helper function ram_bytes_total(), we can use it to
      help counting the total number of pages used by ram blocks.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 4debb5f553d816bf1f2d86bb61e833e79010cb3d
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:41 2015 +0000

      migrate_incoming: Cleanup/clarify error messages

      Create a separate error for the case where migrate_incoming is
      used after a succesful migrate_incoming.

      Reword the error in the case where '-incoming defer' is missing
      to omit the command name so it's right for both hmp and qmp.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit d87605347879b67f156af085d772ab88cde40820
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:40 2015 +0000

      Warn against the use of the string as uri parameter to migrate-incoming

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1fa57f5543aaff62a6fff63782e6c7dd54773628
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 26 14:54:39 2015 +0000

      migrate_incoming: use hmp_handle_error

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit fbce8c25d886b207ebb290d911a7d99abd652676
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:43 2015 +0100

      migration: Fix remaining 32 bit compiler errors

      Fix type casts between pointers and 64 bit integers.
      Now 32 bit builds are possible again.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 3ac040c0ef525c4cc5ebf881c15421cfa6b095c7
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:42 2015 +0100

      migration: Fix some 32 bit compiler errors

      The current code won't compile on 32 bit hosts because there are lots
      of type casts between pointers and 64 bit integers.

      Fix some of them.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1dbd2fd9cbf29c74131e439ce80fb2efde56ee32
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Mon Feb 16 10:50:25 2015 +0300

      migration/rdma: clean up qemu_rdma_dest_init a bit

      Do not check for rdma->host being empty twice.  This removes a large
      "if" block, so code indentation is changed.  While at it, remove an
      ugly goto from the loop, replacing it with a cleaner if logic.  And
      finally, there's no need to initialize `ret' variable since is always
      has a value.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

      --

      fixed space detected by Dave
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 97baf9d9f768caac57bb98d79a1d878181e8a052
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 18 19:21:52 2015 +0100

      migration: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in
      process_incoming_migration_co().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit e1570d0005f29f97d4b1d603b4548591340c57e1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Mar 5 14:26:51 2015 -0300

      target-i386: Remove icc_bridge parameter from cpu_x86_create()

      Instead of passing icc_bridge from the PC initialization code to
      cpu_x86_create(), make the PC initialization code attach the CPU to
      icc_bridge.

      The only difference here is that icc_bridge attachment will now be done
      after x86_cpu_parse_featurestr() is called. But this shouldn't make any
      difference, as property setters shouldn't depend on icc_bridge.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 7fe55c3cbac3ffcb1f772dfa8246405bd2328810
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Fri Mar 13 17:21:11 2015 +0100

      tests: Add PC CPU test

      Test non-default -smp core and thread counts and a non-default CPU model
      on all PC machines except for isapc. Note that not all historic versions
      actually supported this particular configuration, ignored for simplicity.

      For machines pc-*-1.5+ test QMP cpu-add with monotonically increasing ID,
      and test for graceful failure otherwise.

      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b1c12027f834d50c0cf22fe8745b5d85bb87ddd0
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Sat Mar 14 14:24:37 2015 +0100

      pc: Suppress APIC ID compatibility warning for QTest

      This avoids cluttering GTester output with irrelevant warnings.

      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 88950eeff59834b3b4bea98b954a3fe854468ae3
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 12 16:09:34 2015 +0100

      qdev: Move owner-less IRQs to /machine/unattached

      Move non-qdev-gpio[*] from /machine into /machine/unattached.
      For the PC this moves 25 nodes from the stable namespace into the unstable.

      Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 210eb9364be384e7c7f6ef106e6ac8c996dadffe
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Thu Mar 12 15:37:07 2015 +0100

      memory: Move owner-less MemoryRegions to /machine/unattached

      This cleans up the official /machine namespace. In particular
      /machine/system[0] and /machine/io[0], as well as entries with
      non-sanitized node names such as "/machine/qemu extended regs[0]".

      The actual MemoryRegion names remain unchanged.

      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit a01ff75fcdb4d91809ccdd2b95efda6ee1239cbb
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 17:03:18 2014 +0200

      qom: Implement info qom-tree HMP command

      To complement qdev's bus-oriented info qtree, info qom-tree
      prints a hierarchical view of the QOM composition tree.

      By default, the machine composition tree is shown. This can be overriden
      by supplying a path argument, such as "info qom-tree /".

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c0e6ee9e6f49d4a3183b05f457cc2704a966fce5
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 19:48:15 2014 +0200

      qom: Implement qom-set HMP command

      Re-implemented based on qmp_qom_set() to facilitate argument parsing.

      Warn about ambiguous path arguments.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 89d7fa9eb4a0a75bb1bc1bf24e9e79ebe91fd7b0
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed May 7 18:08:29 2014 +0200

      qom: Implement qom-list HMP command

      Implement it as a wrapper for QMP qom-list, but mimic the behavior of
      scripts/qmp/qom-list in making the path argument optional and listing
      the root if absent, to hint users what kind of path to pass.

      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit eb60aa5737463d9143c0edde0fcd3a1eff44a633
  Author: Andreas Färber <afaerber@suse.de>
  Date:   Wed Feb 5 18:31:06 2014 +0100

      scripts: Add qom-tree script

      Functionally it is a recursive qom-list with qom-get per non-child<>
      property. Some failures needed to be handled, such as trying to read a
      pointer property, which is not representable in QMP. Those print a
      literal "<EXCEPTION>".

      Tested-by: Alistair Francis <alistair.francis@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit f3cf80e805bc22980733606df15917223f311f4b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 18:43:09 2015 +0100

      vnc: Fix QMP change not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit 1d0d59f
      added a use of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace it.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c326529b74aa37adb216604bb6ca93cd49007012
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:50 2015 +0100

      usb/dev-storage: Avoid qerror_report_err() outside QMP handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.

      usb_msd_password_cb() is only called from within an HMP command
      handler.  Replace by error_report_err().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7afcc1f9bae3e857834a3bb8247be101e2354998
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:49 2015 +0100

      usb/dev-storage: Fix QMP device_add missing encryption key failure

      When the image is encrypted, QMP device_add creates the device, defers
      actually attaching it to when the key becomes available, then returns
      an error.  This is wrong.  device_add must either create the device
      and succeed, or do nothing and fail.

      The bug is in usb_msd_realize_storage().  It posts an error with
      qerror_report_err(), and returns success.  Device realization relies
      on the return value, and completes.  The QMP monitor, however, relies
      on the posted error, and sends it in an error reply.

      Reproducer:

          $ qemu-system-x86_64 -nodefaults -display none -usb -qmp stdio -drive if=none,id=foo,file=geheim.qcow2
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device_add", "arguments": { "driver": "usb-storage", "id": "bar", "drive": "foo" } }
          {"error": {"class": "DeviceEncrypted", "desc": "'foo' (geheim.qcow2) is encrypted"}}

      Even though we got an error back, the device got created just fine.
      To demonstrate, let's unplug it again:

          {"execute":"device_del","arguments": { "id": "bar" } }
          {"timestamp": {"seconds": 1426003440, "microseconds": 237181}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/bar/bar.0/legacy[0]"}}
          {"timestamp": {"seconds": 1426003440, "microseconds": 238231}, "event": "DEVICE_DELETED", "data": {"device": "bar", "path": "/machine/peripheral/bar"}}
          {"return": {}}

      Fix by making usb_msd_realize_storage() fail properly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9b14e0efcc9a6ea41b7265538f6ec4c53e2ba270
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:48 2015 +0100

      monitor usb: Inline monitor_read_bdrv_key_start()'s first part

      monitor_read_bdrv_key_start() does several things:

      1. If no key is needed, call completion_cb() and succeed

      2. If we're in QMP context, call qerror_report_err() and fail

      3. Start reading the key in the monitor.

      This is two things too many.  Inline 1. and 2. into its callers
      monitor_read_block_device_key() and usb_msd_realize_storage().

      Since monitor_read_block_device_key() only ever runs in HMP context,
      drop 2. there.

      The next commit will clean up the result in usb_msd_realize_storage().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 988e0f06621fde11ec0d319a6fd0ab3ccef0602f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:47 2015 +0100

      monitor: Plug memory leak in monitor_read_bdrv_key_start()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bcf5d19c59a527c91bc29704f3e4956119c050cf
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 17:26:46 2015 +0100

      monitor: Drop dead QMP check from monitor_read_password()

      Function is only called in HMP context since commit 333a96e "qapi:
      Convert change".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 63216dc78d2d52448afdfbe0e0bacb2c669083b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:05 2015 +0100

      uhci: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 87581feaa112733e8d999ade8a4d08816e908268
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:04 2015 +0100

      ohci: Complete conversion to realize

      Commit 457215ec "ohci: Use QOM realize for OHCI" converted only
      "sysbus-ohci".  Finish the job: convert "pci-ohci".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e269f3d9d806987977b3c76deb26647f2bf33e1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:03 2015 +0100

      usb: Improve companion configuration error messages

      The previous commit broke the additional messages explaining the error
      messages.  Improve the error messages, so they don't need explaining
      so much.  Helps QMP users as well, unlike additional explanations.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f4bbaaf584ed8d0a430b467bace15f338cba4c57
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 17 14:28:02 2015 +0100

      usb: Propagate errors through usb_register_companion()

      This loses the messages explaining the error printed with
      error_printf_unless_qmp().  The next commit will make up for the loss.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 96f209264f642365052983dcb50a0f3d7b688f6b
  Author: Alistair Francis <alistair.francis@xilinx.com>
  Date:   Fri Feb 27 11:48:58 2015 +1000

      cadence_uart: Convert to QOM realize()

      Use DeviceClass::realize() and TypeInfo::instance_init() instead of
      the deprecated SysBusDevice::init().

      Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 5a4992834daec85c3913654903fb9f4f954e585a
  Merge: 494a864 906b8ba
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 11:43:00 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-03-17' into staging

      coverity: Fix g_malloc_n-like models

      # gpg: Signature made Tue Mar 17 10:17:56 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-03-17:
        coverity: Fix g_malloc_n-like models

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 494a864e055b565182dcdd3807c1f09a211d0fc5
  Merge: 3521f76 b1546f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 17 10:26:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-gl-20150317-1' into staging

      opengl: fix configure test

      # gpg: Signature made Tue Mar 17 10:11:24 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-gl-20150317-1:
        opengl: fix configure test

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1546f3210d89662dca3e88e1021a0089f003551
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 16 10:03:53 2015 +0100

      opengl: fix configure test

      Re-add the glx compile test to configure.  We can't use pkg-config to
      probe for glx, and as long as milkymist-tmu2 privately uses glx (due to
      opengl infrastructure in qemu not being ready yet) we must continue to
      test for glx to avoid build failures.

      Reported-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 906b8bab8bbc588f19752ed19e0222330dce31f9
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Thu Mar 12 12:24:26 2015 +0100

      coverity: Fix g_malloc_n-like models

      Allocate the calculated overall size, not only the size of a single
      element.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

  commit 3521f767067feedd06ef6d2efd24c1190c68638c
  Merge: 17b11a1 47aced5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 19:19:03 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3-rc0

      # gpg: Signature made Mon Mar 16 16:11:55 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        block/vpc: remove disabled code from get_sector_offset
        block/vpc: rename footer->size -> footer->current_size
        block/vpc: make calculate_geometry spec conform
        vpc: Ignore geometry for large images
        block/vpc: optimize vpc_co_get_block_status
        block: Drop bdrv_find
        blockdev: Convert bdrv_find to blk_by_name
        migration: Convert bdrv_find to blk_by_name
        monitor: Convert bdrv_find to blk_by_name
        iotests: Test non-self-referential qcow2 refblocks
        iotests: Add tests for refcount table growth
        qcow2: Respect new_block in alloc_refcount_block()
        qemu-img: Avoid qerror_report_err() outside QMP handlers, again
        block: Fix block-set-write-threshold not to use funky error class
        block: Deprecate QCOW/QCOW2 encryption
        qemu-img: Fix convert, amend error messages for unknown options
        iotests: Update 051's reference output

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 17b11a1406fdc43b5022f32a6fbfcb005a353b38
  Merge: 9575234 b724b01
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 18:27:13 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150316' into staging

      TriCore RRR1, RRRR, RRRW, and SYS instructions

      # gpg: Signature made Mon Mar 16 15:55:24 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150316:
        target-tricore: Add instructions of SYS opcode format
        target-tricore: Add instructions of RRRW opcode format
        target-tricore: Add instructions of RRRR opcode format
        target-tricore: Add instructions of RRR1 opcode format, which have 0xe3 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x63 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0xa3 as first opcode

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9575234db19df260a3c00f5f947a9c1c823b0f5b
  Merge: bc68d2e 2374c4b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 17:22:32 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/tcg-pull-20150316' into staging

      tcg opt fix for or x,a,a

      # gpg: Signature made Mon Mar 16 15:47:19 2015 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-pull-20150316:
        tcg/optimize: Handle or r,a,a with constant a

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 47aced5078e13d6c1f4fbb59616654e577af8aaa
  Merge: 2867ce4 304ee91
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Mar 16 17:11:12 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        block/vpc: remove disabled code from get_sector_offset
        block/vpc: rename footer->size -> footer->current_size
        block/vpc: make calculate_geometry spec conform
        vpc: Ignore geometry for large images
        block/vpc: optimize vpc_co_get_block_status
        block: Drop bdrv_find
        blockdev: Convert bdrv_find to blk_by_name
        migration: Convert bdrv_find to blk_by_name
        monitor: Convert bdrv_find to blk_by_name
        iotests: Test non-self-referential qcow2 refblocks
        iotests: Add tests for refcount table growth
        qcow2: Respect new_block in alloc_refcount_block()

  commit 304ee9174f4761d3f4da611352a815ab27baba06
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:56 2015 +0100

      block/vpc: remove disabled code from get_sector_offset

      The code to check the bitmap for the allocation status of each sector
      has been "disabled by reason" ever since the vpc driver existed.

      The reason might be that we might end up reading sector by sector
      in vpc_read if we really used it. This would be a performance desaster.

      The current code would furthermore not work if the disabled parts get
      reactivated since vpc_read and vpc_write only use get_sector_offset to
      check the allocation status of the first sector of a read/write operation.
      This might lead to sectors incorrectly treated as zero in vpc_read and
      to sectors getting allocated twice in vpc_write.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-6-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 03671ded3078ebad1f0a701042622fd5e8918bc9
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:55 2015 +0100

      block/vpc: rename footer->size -> footer->current_size

      the field is named current size in the spec. Name it accordingly.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1425379316-19639-5-git-send-email-pl@kamp.de
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 690cbb095a17c429513890d991bc57c98dd83912
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:54 2015 +0100

      block/vpc: make calculate_geometry spec conform

      The VHD spec [1] allows for total_sectors of 65535 x 16 x 255 (~127GB)
      represented by a CHS geometry. If total_sectors is greater
      than 65535 x 16 x 255 this geometry is set as a maximum.

      Qemu, Hyper-V and disk2vhd use this special geometry as an indicator
      to use the image current size from the footer as disk size.

      This patch changes vpc_create to effectively calculate a CxHxS geometry
      for the given image size if possible while rounding up if necessary.
      If the image size is too big to be represented in CHS we set the maximum
      and write the exact requested image size into the footer.

      This partly reverts commit 258d2edb, but leaves support for >127G disks
      intact.

      [1] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-4-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 0444dceee48fed54e8334428fa57f9ff997736e8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Mar 3 11:41:53 2015 +0100

      vpc: Ignore geometry for large images

      The CHS calculation as done per the VHD spec imposes a maximum image
      size of ~127 GB. Real VHD images exist that are larger than that.

      Apparently there are two separate non-standard ways to achieve this:
      You could use more heads than the spec does - this is the option that
      qemu-img create chooses.

      However, other images exist where the geometry is set to the maximum
      (65535/16/255), but the actual image size is larger. Until now, such
      images are truncated at 127 GB when opening them with qemu.

      This patch changes the vpc driver to ignore geometry in this case and
      only trust the size field in the header.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      [PL: Fixed maximum geometry in the commit msg]
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Message-id: 1425379316-19639-3-git-send-email-pl@kamp.de
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2ec711dcd45effc8d583dee6ff92d94573aad75b
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Mar 3 11:41:52 2015 +0100

      block/vpc: optimize vpc_co_get_block_status

      *pnum can't be greater than s->block_size / BDRV_SECTOR_SIZE for allocated
      sectors since there is always a bitmap in between.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1425379316-19639-2-git-send-email-pl@kamp.de
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit d51a2427f68a312b676edd0e9efce881649d1767
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:49 2015 +0800

      block: Drop bdrv_find

      All callers are converted, so drop it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-5-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit a0e8544cf84cf193e455a9a3b7d9997dbc268b4b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:48 2015 +0800

      blockdev: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-4-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c9ebaf744ea7785776c358400eb13c256a3c9db6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:47 2015 +0800

      migration: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-3-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 5560625badb9e710577986de65ff4e4b413729a0
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Mar 2 19:36:46 2015 +0800

      monitor: Convert bdrv_find to blk_by_name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1425296209-1476-2-git-send-email-famz@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 4b4d7b072f0faf9008ca835af101338857b28394
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 5 17:53:32 2014 +0100

      iotests: Test non-self-referential qcow2 refblocks

      It is easy to create only self-referential refblocks, but there are
      cases where that is impossible. This adds a test for two of those cases
      (combined in a single test case).

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417798412-15330-1-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 0e8a371468ce24513b15a9ae362f12822e1973a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:02:32 2015 -0500

      iotests: Add tests for refcount table growth

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1423598552-24301-3-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 14a58a4e0c2e98a7d9232e1c229a531ca231133b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:02:31 2015 -0500

      qcow2: Respect new_block in alloc_refcount_block()

      When choosing a new place for the refcount table, alloc_refcount_block()
      tries to infer the number of clusters used so far from its argument
      cluster_index (which comes from the idea that if any cluster with an
      index greater than cluster_index was in use, the refcount table would
      have to be big enough already to describe cluster_index).

      However, there is a cluster that may be at or after cluster_index, and
      which is not covered by the refcount structures, and that is the new
      refcount block new_block. Therefore, it should be taken into account for
      the blocks_used calculation.

      Also, because new_block already describes (or is intended to describe)
      cluster_index, we may not put the new refcount structures there.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1423598552-24301-2-git-send-email-mreitz@redhat.com
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2867ce4ab86c77579e94c6bb2b6e44ddfcf67f5d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Mar 12 16:08:02 2015 +0100

      qemu-img: Avoid qerror_report_err() outside QMP handlers, again

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err().

      Commit 6936f29 cleaned that up in qemu-img.c, but two calls have crept
      in since.  Take care of them the same way.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6ec46ad541b20a1530cedc741d19eea9ffc39ac3
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 18:51:38 2015 +0100

      block: Fix block-set-write-threshold not to use funky error class

      Error classes are a leftover from the days of "rich" error objects.
      New code should always use ERROR_CLASS_GENERIC_ERROR.  Commit e246211
      added a use of ERROR_CLASS_DEVICE_NOT_FOUND.  Replace it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a1f688f4152e65260b94f37543521ceff8bfebe4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Mar 13 21:09:40 2015 +0100

      block: Deprecate QCOW/QCOW2 encryption

      We've steered users away from QCOW/QCOW2 encryption for a while,
      because it's a flawed design (commit 136cd19 Describe flaws in
      qcow/qcow2 encryption in the docs).

      In addition to flawed crypto, we have comically bad usability, and
      plain old bugs.  Let me show you.

      = Example images =

      I'm going to use a raw image as backing file, and two QCOW2 images,
      one encrypted, and one not:

          $ qemu-img create -f raw backing.img 4m
          Formatting 'backing.img', fmt=raw size=4194304
          $ qemu-img create -f qcow2 -o encryption,backing_file=backing.img,backing_fmt=raw geheim.qcow2 4m
          Formatting 'geheim.qcow2', fmt=qcow2 size=4194304 backing_file='backing.img' backing_fmt='raw' encryption=on cluster_size=65536 lazy_refcounts=off
          $ qemu-img create -f qcow2 -o backing_file=backing.img,backing_fmt=raw normal.qcow2 4m
          Formatting 'normal.qcow2', fmt=qcow2 size=4194304 backing_file='backing.img' backing_fmt='raw' encryption=off cluster_size=65536 lazy_refcounts=off

      = Usability issues =

      == Confusing startup ==

      When no image is encrypted, and you don't give -S, QEMU starts the
      guest immediately:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio normal.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: running

      But as soon as there's an encrypted image in play, the guest is *not*
      started, with no notification whatsoever:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: paused (prelaunch)

      If the user figured out that he needs to type "cont" to enter his
      keys, the confusion enters the next level: "cont" asks for at most
      *one* key.  If more are needed, it then silently does nothing.  The
      user has to type "cont" once per encrypted image:

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio -drive if=none,file=geheim.qcow2 -drive if=none,file=geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: paused (prelaunch)
          (qemu) c
          none0 (geheim.qcow2) is encrypted.
          Password: ******
          (qemu) info status
          VM status: paused (prelaunch)
          (qemu) c
          none1 (geheim.qcow2) is encrypted.
          Password: ******
          (qemu) info status
          VM status: running

      == Incorrect passwords not caught ==

      All existing encryption schemes give you the GIGO treatment: garbage
      password in, garbage data out.  Guests usually refuse to mount
      garbage, but other usage is prone to data loss.

      == Need to stop the guest to add an encrypted image ==

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) info status
          VM status: running
          (qemu) drive_add "" if=none,file=geheim.qcow2
          Guest must be stopped for opening of encrypted image
          (qemu) stop
          (qemu) drive_add "" if=none,file=geheim.qcow2
          OK

      Commit c3adb58 added this restriction.  Before, we could expose images
      lacking an encryption key to guests, with potentially catastrophic
      results.  See also "Use without key is not always caught".

      = Bugs =

      == Use without key is not always caught ==

      Encrypted images can be in an intermediate state "opened, but no key".
      The weird startup behavior and the need to stop the guest are there to
      ensure the guest isn't exposed to that state.  But other things still
      are!

      * drive_backup

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) drive_backup -f ide0-hd0 out.img raw
          Formatting 'out.img', fmt=raw size=4194304

        I guess this writes encrypted data to raw image out.img.  Good luck
        with figuring out how to decrypt that again.

      * commit

          $ qemu-system-x86_64 -nodefaults -display none -monitor stdio geheim.qcow2
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) commit ide0-hd0

        I guess this writes encrypted data into the unencrypted raw backing
        image, effectively destroying it.

      == QMP device_add of usb-storage fails when it shouldn't ==

      When the image is encrypted, device_add creates the device, defers
      actually attaching it to when the key becomes available, then fails.
      This is wrong.  device_add must either create the device and succeed,
      or do nothing and fail.

          $ qemu-system-x86_64 -nodefaults -display none -usb -qmp stdio -drive if=none,id=foo,file=geheim.qcow2
          {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
          { "execute": "qmp_capabilities" }
          {"return": {}}
          { "execute": "device_add", "arguments": { "driver": "usb-storage", "id": "bar", "drive": "foo" } }
          {"error": {"class": "DeviceEncrypted", "desc": "'foo' (geheim.qcow2) is encrypted"}}
          {"execute":"device_del","arguments": { "id": "bar" } }
          {"timestamp": {"seconds": 1426003440, "microseconds": 237181}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/bar/bar.0/legacy[0]"}}
          {"timestamp": {"seconds": 1426003440, "microseconds": 238231}, "event": "DEVICE_DELETED", "data": {"device": "bar", "path": "/machine/peripheral/bar"}}
          {"return": {}}

      This stuff is worse than useless, it's a trap for users.

      If people become sufficiently interested in encrypted images to
      contribute a cryptographically sane implementation for QCOW2 (or
      whatever other format), then rewriting the necessary support around it
      from scratch will likely be easier and yield better results than
      fixing up the existing mess.

      Let's deprecate the mess now, drop it after a grace period, and move
      on.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 97a2ca7ae6bccb78b2acf10d6d3eebd1e9f3bbdc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Sat Mar 14 10:23:15 2015 +0100

      qemu-img: Fix convert, amend error messages for unknown options

      Message quality regressed in commit dc523cd.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0c304110bd7092cbabff55b45193e13549b53e40
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Sat Mar 14 10:23:14 2015 +0100

      iotests: Update 051's reference output

      Commit c4bacaf improved error reporting, but neglected to update
      051.out.  Commit 2726958 tried to redress, but didn't get it quite
      right (punctuation difference), and shortly after commit
      ae071cc..master improved error reporting some more, neglecting 051.out
      some more.  Sorry!

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b724b012a4ea9877c5ddad254df63735a945618c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:29:24 2015 +0000

      target-tricore: Add instructions of SYS opcode format

      This adds only the non trap instructions.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 2374c4b8375072da1f401c6daccc68ae76c73e63
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Mar 13 12:26:21 2015 -0700

      tcg/optimize: Handle or r,a,a with constant a

      As seen with ubuntu-5.10-live-powerpc.iso.

      Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit eb989d2545832deff386b23c904fc26f78303637
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:04:45 2015 +0000

      target-tricore: Add instructions of RRRW opcode format

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4d108fe33a3f04c9b9e5af1410b1e835d59de003
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 12:03:18 2015 +0000

      target-tricore: Add instructions of RRRR opcode format

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 068fac77c81b5d227903d0b7ecd108edff4eb0eb
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:55:52 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xe3 as first opcode

      Add helpers helper_subadr_h/_ssov which subs one halfword and adds one
      halfword, rounds / and saturates each half word independently.

      Add microcode helper functions:
          * gen_msubad_h/ads_h: multiply two halfwords left justified and sub from the
                                first one word and add the second one word
                                / and saturate each resulting word independetly.
          * gen_msubadm_h/adms_h: multiply two halfwords in q-format left justified
                                  and sub from the first one word and add to
                                  the second one word / and saturate each resulting
                                  word independetly.
          * gen_msubadr32_h/32s_h: multiply two halfwords in q-format left justified
                                   and sub from the first one word and add to
                                   the second one word, round both results / and
                                   saturate each resulting word independetly.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 62e47b2e6d17020b78a676e086bf98cfeba595b7
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:46:55 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x63 as first opcode

      Add helpers:
          * msub64_q_ssov: multiply two 32 bit q-format number, sub the result from a
                           64 bit q-format number and saturate.
          * msub32_q_sub_ssov: sub two 64 bit q-format numbers and return a 32 bit
                               result.
          * msubr_q_ssov: multiply two 32 bit q-format numbers, sub the result from a 32 bit
                          q-format number and saturate.
          * msubr_q: multiply two 32 bit q-format numbers and sub the result from a 32 bit
                     q-format number.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit f4aef476afc4cab9bb594975401f6902a57aa9b9
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Feb 25 11:34:55 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xa3 as first opcode

      Add helpers:
          * sub64_ssov: subs two 64 bit values and saturates the result.
          * subr_h/_ssov: subs two halfwords from two words in q-format with rounding
                          / and saturates each result independetly.

      Add microcode generator:
          * gen_sub64_d: adds two 64 bit values.
          * gen_msub_h/s_h: multiply four halfwords, sub each result left justfied
                            from two word values / and saturate each result.
          * gen_msubm_h/s_h: multiply four halfwords, sub each result left justfied
                             from two words values in q-format / and saturate each
                             result.
          * gen_msubr32/64_h/s_h: multiply four halfwords, sub each result left
                                  justfied from two halftwords/words values in q-format
                                  / and saturate each result.

      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit bc68d2e5128284c8beb98b1c5b0331a0ed9f3197
  Merge: dcf848c 54ed388
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 14:45:09 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150316' into staging

      migration/next for 20150316

      # gpg: Signature made Mon Mar 16 13:36:37 2015 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150316:
        pc: Disable vmdesc submission for old machines
        migration: Allow to suppress vmdesc submission
        migration: Read JSON VM description on incoming migration
        rename save_block_hdr to save_page_header
        save_block_hdr: we can recalculate the cont parameter here
        save_xbzrle_page: change calling convention
        ram_save_page: change calling covention
        ram_find_and_save_block:  change calling convention
        ram: make all save_page functions take a uint64_t parameter
        Add migrate_incoming
        Add -incoming defer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6c936b74235c2d920790a0ff9feb00b07db239c9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 11:45:18 2015 +0100

      virtio: Fix memory leaks reported by Coverity

      All four leaks are similar, so fix them in one patch.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9e0f5b8108e248b78444c9a2ec41a8309825736c
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Thu Mar 12 17:50:18 2015 +0800

      virtio: validate the existence of handle_output before calling it

      We don't validate the existence of handle_output which may let a buggy
      guest to trigger a SIGSEV easily. E.g:

      1) write 10 to queue_sel to a virtio net device with only 1 queue
      2) setup an arbitrary pfn
      3) then notify queue 10

      Fixing this by validating the existence of handle_output before.

      Cc: qemu-stable@nongnu.org
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>

  commit dcf848c478dd8765bd4f746fc4e80eaad44cf87d
  Merge: 307146c b8d4328
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 13:56:10 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150316' into staging

      target-arm queue:
       * fix handling of execute-never bits in page table walks
       * tell kernel to initialize KVM GIC in realize function
       * fix handling of STM (user) with r15 in register list
       * ignore low bit of PC in M-profile exception return
       * fix linux-user get/set_tls syscalls on CPUs with TZ

      # gpg: Signature made Mon Mar 16 12:39:04 2015 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150316:
        linux-user: Access correct register for get/set_tls syscalls on ARM TZ CPUs
        target-arm: Ignore low bit of PC in M-profile exception return
        target-arm: Fix handling of STM (user) with r15 in register list
        hw/intc/arm_gic: Initialize the vgic in the realize function
        target-arm: get_phys_addr_lpae: more xn control
        target-arm: fix get_phys_addr_v6/SCTLR_AFE access check
        target-arm: convert check_ap to ap_to_rw_prot

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54ed388b29794ab08089f1b5c7b0a03d075c3b5d
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:43 2015 +0100

      pc: Disable vmdesc submission for old machines

      Older PC machine types might by accident be backwards live migration compatible,
      but with the new vmdesc self-describing blob in our live migration stream we
      would break that compatibility.

      Also users wouldn't expect massive behaviorial differences when updating to a
      new version of QEMU while retaining their old machine type, especially not
      potential breakage in tooling around live migration.

      So disable vmdesc submission for old PC machine types.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 9850c6047b8b4343e91da4780a41bb88faeb018a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:42 2015 +0100

      migration: Allow to suppress vmdesc submission

      We now always send a JSON blob describing the migration file format as part
      of the migration stream. However, some tools built around QEMU have proven
      to stumble over this.

      This patch gives the user the chance to disable said self-describing part of
      the migration stream. To disable vmdesc submission, just add

        -machine suppress-vmdesc=on

      to your QEMU command line.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 1925cebc4b12903e3a66106893fd97e35c5d0baf
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Feb 23 13:56:41 2015 +0100

      migration: Read JSON VM description on incoming migration

      One of the really nice things about the VM description format is that it goes
      over the wire when live migration is happening. Unfortunately QEMU today closes
      any socket once it sees VM_EOF coming, so we never give the VMDESC the chance to
      actually land on the wire.

      This patch makes QEMU read the description as well. This way we ensure that
      anything wire tapping us in between will get the chance to also interpret the
      stream.

      Along the way we also fix virt tests that assume that number_bytes_sent on the
      sender side is equal to number_bytes_read which was true before the VMDESC
      patches and is true again with this patch.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f6f14c58d542b306b6a0ff207db793d0aba62aa1
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 21:46:40 2015 +0100

      rename save_block_hdr to save_page_header

      It has always been a page header, not a block header.  Once there, the
      flag argument was only passed to make a bit or with it, just do the or
      on the caller.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 73bab2fc2adeb18b26752937f3cf60afa9658a9c
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 21:41:39 2015 +0100

      save_block_hdr: we can recalculate the cont parameter here

      No need to pass it through all the callers.  Once there, update
      last_sent_block here.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit f4be0f75f68ec463d07c65cb2f636e6adf1388e6
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 20:16:33 2015 +0100

      save_xbzrle_page: change calling convention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 87cf878b2ea8d24c78ea3210880538aa31459dfd
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 20:03:45 2015 +0100

      ram_save_page: change calling covention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0fcd8d31402bdc7ef7187f005bee8f0799a4cce0
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 19:33:05 2015 +0100

      ram_find_and_save_block:  change calling convention

      Add a parameter to pass the number of bytes written, and make it return
      the number of pages written instead.

      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 6e1dea46b89e137ee1593ded5566d5371a61d304
  Author: Juan Quintela <quintela@redhat.com>
  Date:   Thu Feb 12 19:02:42 2015 +0100

      ram: make all save_page functions take a uint64_t parameter

      It used to be an int, but then we can't pass directly the
      bytes_transferred parameter, that would happen later in the series.

      Signed-off-by: Juan Quintela <quintela@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>

  commit bf1ae1f4dc348650fb7f32a3fcc278f60a7b1bf6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 19 11:40:28 2015 +0000

      Add migrate_incoming

      Add migrate_incoming/migrate-incoming to start an incoming
      migration.

      Once a qemu has been started with
          -incoming defer

      the migration can be started by issuing:
          migrate_incoming uri

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit adde220a93a0192782243d25580a647004f6dd44
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Feb 19 11:40:27 2015 +0000

      Add -incoming defer

      -incoming defer causes qemu to wait for an incoming migration
      to be specified later.  The monitor can be used to set migration
      capabilities that may affect the incoming connection process.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 307146cb9359ad6d4544e00af073088772d165eb
  Merge: 2dfe7d0 4ed7b2c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 13:04:08 2015 +0000

      Merge remote-tracking branch 'remotes/kvaneesh/for-upstream' into staging

      * remotes/kvaneesh/for-upstream:
        virtio: Fix memory leaks reported by Coverity
        virtfs-proxy: Fix possible overflow
        fsdev/virtfs-proxy-helper: Fix improper use of negative value
        hw/9pfs/virtio-9p-posix-acl: Fix out-of-bounds access
        9pfs-proxy: tiny cleanups in proxy_pwritev and proxy_preadv
        9pfs-local: simplify/optimize local_mapped_attr_path()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b8d43285a4db12156c40ba6fdbd8002c383fcbca
  Author: Mikhail Ilyin <m.ilin@samsung.com>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      linux-user: Access correct register for get/set_tls syscalls on ARM TZ CPUs

      When support was added for TrustZone to ARM CPU emulation, we failed
      to correctly update the support for the linux-user implementation of
      the get/set_tls syscalls. This meant that accesses to the TPIDRURO
      register via the syscalls were always using the non-secure copy of
      the register even if native MRC/MCR accesses were using the secure
      register. This inconsistency caused most binaries to segfault on startup
      if the CPU type was explicitly set to one of the TZ-enabled ones like
      cortex-a15. (The default "any" CPU doesn't have TZ enabled and so is
      not affected.)

      Use access_secure_reg() to determine whether we should be using
      the secure or the nonsecure copy of TPIDRURO when emulating these
      syscalls.

      Signed-off-by: Mikhail Ilyin <m.ilin@samsung.com>
      Message-id: 1426505198-2411-1-git-send-email-m.ilin@samsung.com
      [PMM: rewrote commit message to more clearly explain the issue
       and its consequences.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fcf83ab103dce6d2951f24f48e30820e7dbb3622
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      target-arm: Ignore low bit of PC in M-profile exception return

      For the ARM M-profile cores, exception return pops various registers
      including the PC from the stack. The architecture defines that if the
      lowest bit in the new PC value is set (ie the PC is not halfword
      aligned) then behaviour is UNPREDICTABLE. In practice hardware
      implementations seem to simply ignore the low bit, and some buggy
      RTOSes incorrectly rely on this. QEMU's behaviour was architecturally
      permitted, but bringing QEMU into line with the hardware behaviour
      allows more guest code to run. We log the situation as a guest error.

      This was reported as LP:1428657.

      Reported-by: Anders Esbensen <anders@lyes.dk>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da3e53ddcb0ca924da97ca5a35605fc554aa3e05
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      target-arm: Fix handling of STM (user) with r15 in register list

      The A32 encoding of LDM distinguishes LDM (user) from LDM (exception
      return) based on whether r15 is in the register list. However for
      STM (user) there is no equivalent distinction. We were incorrectly
      treating "r15 in list" as indicating exception return for both LDM
      and STM, with the result that an STM (user) involving r15 went into
      an infinite loop. Fix this; note that the value stored for r15
      in this case is the current PC regardless of our current mode.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426015125-5521-1-git-send-email-peter.maydell@linaro.org

  commit f0bb55890a173cb1e9e87d608647cac70f8f9dd4
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Mar 16 12:30:47 2015 +0000

      hw/intc/arm_gic: Initialize the vgic in the realize function

      This patch forces vgic initialization in the vgic realize function.
      It uses a new group/attribute that allows such operation:
      KVM_DEV_ARM_VGIC_GRP_CTRL/KVM_DEV_ARM_VGIC_CTRL_INIT

      This earlier initialization allows, for example, to setup VFIO
      signaling and irqfd after vgic initialization, on a reset notifier.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Message-id: 1426094226-8515-1-git-send-email-eric.auger@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d8e052b387635639a6ba4a09a7874fd2f113b218
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: get_phys_addr_lpae: more xn control

      This patch makes the following changes to the determination of
      whether an address is executable, when translating addresses
      using LPAE.

      1. No longer assumes that PL0 can't execute when it can't read.
         It can in AArch64, a difference from AArch32.
      2. Use va_size == 64 to determine we're in AArch64, rather than
         arm_feature(env, ARM_FEATURE_V8), which is insufficient.
      3. Add additional XN determinants
         - NS && is_secure && (SCR & SCR_SIF)
         - WXN && (prot & PAGE_WRITE)
         - AArch64: (prot_PL0 & PAGE_WRITE)
         - AArch32: UWXN && (prot_PL0 & PAGE_WRITE)
         - XN determination should also work in secure mode (untested)
         - XN may even work in EL2 (currently impossible to test)
      4. Cleans up the bloated PAGE_EXEC condition - by removing it.

      The helper get_S1prot is introduced. It may even work in EL2,
      when support for that comes, but, as the function name implies,
      it only works for stage 1 translations.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Message-id: 1426099139-14463-4-git-send-email-drjones@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d76951b65dfb1be4e41cfae6abebf8db7a1243a3
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: fix get_phys_addr_v6/SCTLR_AFE access check

      Introduce simple_ap_to_rw_prot(), which has the same behavior as
      ap_to_rw_prot(), but takes the 2-bit simple AP[2:1] instead of
      the 3-bit AP[2:0]. Use this in get_phys_addr_v6 when SCTLR_AFE
      is set, as that bit indicates we should be using the simple AP
      format.

      It's unlikely this path is getting used. I don't see CR_AFE
      getting used by Linux, so possibly not. If it had been, then
      the check would have been wrong for all but AP[2:1] = 0b11.
      Anyway, this should fix it up, in case it ever does get used.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426099139-14463-3-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0fbf5238203041f734c51b49778223686f14366b
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Mon Mar 16 12:30:46 2015 +0000

      target-arm: convert check_ap to ap_to_rw_prot

      Instead of mixing access permission checking with access permissions
      to page protection flags translation, just do the translation, and
      leave it to the caller to check the protection flags against the access
      type. Also rename to ap_to_rw_prot to better describe the new behavior.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1426099139-14463-2-git-send-email-drjones@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2dfe7d07e2f40adb18a0b0cd286f3d327692d0fc
  Merge: f421f05 be0b608
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 11:44:55 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150316' into staging

      Final batch of s390x enhancements/fixes for 2.3:
      - handle TOD clock during migration
      - CPACF key wrap options
      - limit amount of pci device code we build
      - ensure big endian accesses for ccws
      - various fixes and cleanups

      # gpg: Signature made Mon Mar 16 10:01:44 2015 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150316:
        s390x/config: Do not include full pci.mak
        s390x/pci: fix length in sei_nt2 event
        s390x/ipl: remove dead code
        s390x/virtio-bus: Remove unused function s390_virtio_bus_console()
        s390x: CPACF: Handle key wrap machine options
        s390x/kvm: make use of generic vm attribute check
        kvm: encapsulate HAS_DEVICE for vm attrs
        virtio-ccw: assure BE accesses
        s390x/kvm: Guest Migration TOD clock synchronization
        s390x: Replace unchecked qdev_init() by qdev_init_nofail()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f421f05754ac5aabe15f12051390204116408b00
  Merge: a8f1b43 93f7c4f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 10:58:11 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-seabios-1.8.1-20150316-1' into staging

      seabios: update to 1.8.1 stable release

      # gpg: Signature made Mon Mar 16 08:09:25 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-seabios-1.8.1-20150316-1:
        seabios: update to 1.8.1 stable release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8f1b43cb023333098a3ebc2630ce2c3db7f7af6
  Merge: 7ccfb49 37ed3bf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 16 09:42:40 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/tcg-pull-20150313' into staging

      Pool TCG data, and ALWAYS/NEVER fix

      # gpg: Signature made Fri Mar 13 20:09:09 2015 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/tcg-pull-20150313:
        tcg: Complete handling of ALWAYS and NEVER
        tcg: Use tcg_malloc to allocate TCGLabel
        tcg: Change generator-side labels to a pointer
        tcg: Change translator-side labels to a pointer
        tcg-ia64: Use tcg_malloc to allocate TCGLabelQemuLdst
        tcg: Use tcg_malloc to allocate TCGLabelQemuLdst

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be0b608a5463a834df0e19911356ae93660d3677
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 12 15:19:14 2015 +0100

      s390x/config: Do not include full pci.mak

      pci.mak includes a lot of devices - and most of them do not make
      sense on s390x, like USB controllers or audio cards. These devices
      also show up when running "qemu-system-s390x -device help" and thus
      could raise the hope for the users that they could use these kind
      of devices with qemu-system-s390x. To avoid this confusion, we
      should not include pci.mak and rather include the bare minimum
      manually instead.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Message-Id: <1426169954-6062-1-git-send-email-thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d3321fc7557cbd51fd0c9c0416c81dbe3f4dc32e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:54 2015 +0100

      s390x/pci: fix length in sei_nt2 event

      The sei_nt2 event must contain the length of the event.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-7-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7b527b86eb3560d68f41218cec0cdf3d60a38323
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:53 2015 +0100

      s390x/ipl: remove dead code

      load_image_targphys already checks the max size and will return
      an error code. So the follow-on check will never trigger.

      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-6-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit eaec461ccc4b308b5718381739afbf9605e47b00
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:52 2015 +0100

      s390x/virtio-bus: Remove unused function s390_virtio_bus_console()

      The function s390_virtio_bus_console() is completely unused and thus
      can be removed safely.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-5-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2eb1cd0768af18fb2398ee7b590e4b81e0e504f9
  Author: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:51 2015 +0100

      s390x: CPACF: Handle key wrap machine options

      Check for the aes_key_wrap and dea_key_wrap machine options and set the
      appropriate KVM device attribute(s) to tell the kernel to enable or disable
      the AES/DEA protected key functions for the guest domain.

      This patch introduces two new machine options for indicating the state of
      AES/DEA key wrapping functions.  This controls whether the guest will
      have access to the AES/DEA crypto functions.

      aes_key_wrap="on | off" is changed to aes-key-wrap="on | off"
      dea_key_wrap="on | off" is changed to dea-key-wrap="on | off"

      Check for the aes-key-wrap and dea-key-wrap machine options and set the
      appropriate KVM device attribute(s) to tell the kernel to enable or disable
      the AES/DEA protected key functions for the guest domain.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-4-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 2b147555f78c3c20080b201fd1506467fa0ddf43
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:50 2015 +0100

      s390x/kvm: make use of generic vm attribute check

      By using the new introduced generic interface we
      can remove redundancies and clean up.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Suggested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d0a073a186e4a81ae81435bd5b7286b657a69bfd
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 12 13:53:49 2015 +0100

      kvm: encapsulate HAS_DEVICE for vm attrs

      More and more virtual machine specifics between kvm and qemu will be
      transferred with vm attributes.
      So we encapsulate the common logic in a generic function.

      Additionally we need only to check during initialization if kvm supports
      virtual machine attributes.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Suggested-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1426164834-38648-2-git-send-email-jfrei@linux.vnet.ibm.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7d45285fc9f75e0a85533ada8fd3aeda48d5d71a
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Mar 11 10:57:50 2015 +0100

      virtio-ccw: assure BE accesses

      All fields in structures transmitted by ccws are big endian; assure
      we handle them as such.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1426067871-17693-2-git-send-email-cornelia.huck@de.ibm.com>

  commit 3f9e59bb5358cd020c5be919129281d202a24058
  Author: Jason J. Herne <jjherne@us.ibm.com>
  Date:   Mon Mar 9 15:56:08 2015 +0100

      s390x/kvm: Guest Migration TOD clock synchronization

      Synchronizes the guest TOD clock across a migration by sending the guest TOD
      clock value to the destination system. If the guest TOD clock is not preserved
      across a migration then the guest's view of time will snap backwards if the
      destination host clock is behind the source host clock. This will cause the
      guest to hang immediately upon resuming on the destination system.

      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>

      Message-Id: <1425912968-54387-1-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit ae4a2bd759d647dd6146d45e4a59a01cf34d6a4d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:49 2015 +0100

      s390x: Replace unchecked qdev_init() by qdev_init_nofail()

      s390_flic_init() is a helper to create and realize either
      "s390-flic-kvm" or "s390-flic-qemu".  When qdev_init() fails, it
      complains to stderr and succeeds.

      Except it can't actually fail, because the "s390-flic-qemu" is a dummy
      without a realize method, and "s390-flic-kvm"'s realize can't fail,
      even when the kernel device is really unavailable.  Odd.

      Replace qdev_init() by qdev_init_nofail() to make "can't fail" locally
      obvious, and get rid of the unreachable error reporting.

      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
      Cc: Alexander Graf <agraf@suse.de>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1423128889-18260-4-git-send-email-armbru@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 93f7c4f09f6957244d5af0a35309b8ad4ffb64ed
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 16 09:00:49 2015 +0100

      seabios: update to 1.8.1 stable release

      Carries two bugfixes and support for multiple pci root buses.

      git shortlog rel-1.8.0..rel-1.8.1
      =================================

      Ameya Palande (1):
            x86: add barrier to read{b,w,l} and write{b,w,l} functions

      Kevin O'Connor (1):
            smp: Fix smp race introduced in 0673b787

      Marcel Apfelbaum (2):
            fw/pci: scan all buses if extraroots romfile is present
            fw/pci: map memory and IO regions for multiple pci root buses

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4ed7b2c3a78f785a1bcbe575e08c379b166723e3
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 14 11:45:18 2015 +0100

      virtio: Fix memory leaks reported by Coverity

      All four leaks are similar, so fix them in one patch.
      Success path was not doing memory free.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 25ee9a7fa3f4e09fde48bb184447ff5651ed5fd8
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Sat Mar 14 10:00:16 2015 +0800

      virtfs-proxy: Fix possible overflow

      It's detected by coverity. The socket name specified
      should fit in the sockadd_un.sun_path. If not abort.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 821c447675728ca06c8d2e4ac8a0e7a1adf775b8
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Mon Mar 16 09:20:29 2015 +0800

      fsdev/virtfs-proxy-helper: Fix improper use of negative value

      It's detected by coverity. Check the return value of proxy_marshal.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 37ed3bf1ee07bb1a26adca0df8718f601f231c0b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 20 11:13:50 2015 -0800

      tcg: Complete handling of ALWAYS and NEVER

      Missing from movcond, and brcondi_i32 (but not brcondi_i64).

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 51e3972c41598adc91fe3f4767057f5198dcc15c
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 18:51:05 2015 -0800

      tcg: Use tcg_malloc to allocate TCGLabel

      Pre-allocating 512 of them per TB is a waste.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit bec1631100323fac0900aea71043d5c4e22fc2fa
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 13:39:54 2015 -0800

      tcg: Change generator-side labels to a pointer

      This is less about improved type checking than enabling a
      subsequent change to the representation of labels.

      Acked-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Cc: Andrzej Zaborowski <balrogg@gmail.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 42a268c241183877192c376d03bd9b6d527407c7
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Feb 13 12:51:55 2015 -0800

      tcg: Change translator-side labels to a pointer

      This is improved type checking for the translators -- it's no longer
      possible to accidentally swap arguments to the branch functions.

      Note that the code generating backends still manipulate labels as int.

      With notable exceptions, the scope of the change is just a few lines
      for each target, so it's not worth building extra machinery to do this
      change in per-target increments.

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3f626793a2182061e3aa50a9e2ed7a322582a60f
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Sep 30 07:25:30 2014 -0700

      tcg-ia64: Use tcg_malloc to allocate TCGLabelQemuLdst

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 686461c96254f34bcce67a949c72867ab6ec3fcf
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Tue Sep 30 07:18:06 2014 -0700

      tcg: Use tcg_malloc to allocate TCGLabelQemuLdst

      Pre-allocating 640 of them per TB is a waste.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7ccfb495c64e1eef5886dcc4d48523ed6d1d22a4
  Author: Tobias Nygren <tnn@NetBSD.org>
  Date:   Thu Mar 5 22:37:41 2015 +0100

      user-exec.c: fix build on NetBSD/sparc64 and NetBSD/arm

      A couple of #ifdef changes necessary to use NetBSD's ucontext
      structs on sparc64 and arm.

      Signed-off-by: Tobias Nygren <tnn@NetBSD.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1425591461-17550-1-git-send-email-tnn@NetBSD.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dea46359989121b43924cd89acd03795383f54f6
  Merge: f3dd251 43db7c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 14:03:31 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150312-2' into staging

      misc ui patches, mostly sdl related.

      # gpg: Signature made Thu Mar 12 14:51:07 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20150312-2:
        pixman: add a bunch of PIXMAN_BE_* defines for 32bpp
        Allow the use of X11 from a non standard location.
        configure: opengl overhaul
        sdl: Fix crash when calling sdl_switch() with NULL surface
        sdl: Refresh debug statements

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f3dd251de1f87c1d7492fca742924f004b7091cd
  Merge: 82389dc 09c0772
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 11:51:00 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

      Update OpenBIOS images

      # gpg: Signature made Fri Mar 13 11:04:07 2015 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-openbios-signed:
        Update OpenBIOS images

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 09c0772be9b44e9c6388caac0beb744bc59f6d71
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Thu Mar 12 08:13:07 2015 +0000

      Update OpenBIOS images

      Update OpenBIOS images to SVN r1334 built from submodule.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 82389dcc133d9d6aa3418fbbb59d784dd8d0e88c
  Merge: f9f141b 069bb58
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 11:00:57 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Thu Mar 12 20:06:50 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        tests: rtl8139: test timers and interrupt
        net: synchronize net_host_device_remove with host_net_remove_completion

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9f141b7475acfed1b6a28809687109702295be3
  Merge: 2a5b58e 87b86e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Mar 13 09:54:23 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Thu Mar 12 19:09:26 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        qcow2: fix the macro QCOW_MAX_L1_SIZE's use
        queue: fix QSLIST_INSERT_HEAD_ATOMIC race

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9005c3b3efb7eb1b140d2ad0385efff6a3af59c4
  Author: Shannon Zhao <zhaoshenglong@huawei.com>
  Date:   Fri Mar 13 13:48:07 2015 +0800

      hw/9pfs/virtio-9p-posix-acl: Fix out-of-bounds access

      It's detected by coverity. Fix out-of-bounds access of the function mp_dacl_listxattr.

      Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
      Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 069bb5831faf19d02041569580ad77565776bb1c
  Author: Frediano Ziglio <freddy77@gmail.com>
  Date:   Thu Jan 8 18:38:23 2015 +0000

      tests: rtl8139: test timers and interrupt

      Test behaviour of timers and interrupts related to timeouts.

      Signed-off-by: Frediano Ziglio <freddy77@gmail.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1420742303-3030-1-git-send-email-freddy77@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7fb439115de7354b3ac2becf24457acaf828296b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 17:53:20 2014 +0100

      net: synchronize net_host_device_remove with host_net_remove_completion

      Using net_host_check_device is unnecessary.  qemu_del_net_client asserts
      for the non-peer case that it can only process NIC type NetClientStates,
      and that assertion is valid for the peered case as well, so move it and
      use the same check in net_host_device_remove.  host_net_remove_completion
      is already checking the type.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1419353600-30519-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 87b86e7ef29771a7fa06e3e8e88fa95bbc13a39c
  Author: Wen Congyang <wency@cn.fujitsu.com>
  Date:   Wed Mar 11 11:05:21 2015 +0800

      qcow2: fix the macro QCOW_MAX_L1_SIZE's use

      QCOW_MAX_L1_SIZE's unit is byte, and l1_size's unit
      is l1 table entry size(8 bytes).

      Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
      Message-id: 54FFB0F1.5010307@cn.fujitsu.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2120465fbb87a69bd60283ec4034a0963766a7ef
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 10 16:45:57 2015 +0100

      queue: fix QSLIST_INSERT_HEAD_ATOMIC race

      There is a not-so-subtle race in QSLIST_INSERT_HEAD_ATOMIC.

      Because atomic_cmpxchg returns the old value instead of a success flag,
      QSLIST_INSERT_HEAD_ATOMIC was checking for success by comparing against
      the second argument to atomic_cmpxchg.  Unfortunately, this only works
      if the second argument is a local or thread-local variable.

      If it is in memory, it can be subject to common subexpression elimination
      (and then everything's fine) or reloaded after the atomic_cmpxchg,
      depending on the compiler's whims.  If the latter happens, the race can
      happen.  A thread can sneak in, doing something on elm->field.sle_next
      after the atomic_cmpxchg and before the comparison.  This causes a wrong
      failure, and then two threads are using "elm" at the same time.  In the
      case discovered by Christian, the sequence was likely something like this:

          thread 1                   | thread 2
          QSLIST_INSERT_HEAD_ATOMIC  |
            atomic_cmpxchg succeeds  |
            elm added to list        |
                                     | steal release_pool
                                     | QSLIST_REMOVE_HEAD
                                     | elm removed from list
                                     | ...
                                     | QSLIST_INSERT_HEAD_ATOMIC
                                     |   (overwrites sle_next)
            spurious failure         |
            atomic_cmpxchg succeeds  |
            elm added to list again  |
                                     |
          steal release_pool         |
          QSLIST_REMOVE_HEAD         |
          elm removed again          |

      The last three steps could be done by a third thread as well.
      A reproducer that failed in a matter of seconds is as follows:

      - the guest has 32 VCPUs on a 28 core host (hyperthreading was enabled),
        memory was 16G just to err on the safe side (the host has 64G, but hey
        at least you need no s390)

      - the guest has 24 null-aio virtio-blk devices using dataplane
        (-object iothread,id=ioN -drive if=none,id=blkN,driver=null-aio,size=500G
        -device virtio-blk-pci,iothread=ioN,drive=blkN)

      - the guest also has a single network interface.  It's only doing loopback
        tests so slirp vs. tap and the model doesn't matter.

      - the guest is running fio with the following script:

           [global]
           rw=randread
           blocksize=16k
           ioengine=libaio
           runtime=10m
           buffered=0
           fallocate=none
           time_based
           iodepth=32

           [virtio1a]
           filename=/dev/block/252\:16

           [virtio1b]
           filename=/dev/block/252\:16

           ...

           [virtio24a]
           filename=/dev/block/252\:384

           [virtio24b]
           filename=/dev/block/252\:384

           [listen1]
           protocol=tcp
           ioengine=net
           port=12345
           listen
           rw=read
           bs=4k
           size=1000g

           [connect1]
           protocol=tcp
           hostname=localhost
           ioengine=net
           port=12345
           protocol=tcp
           rw=write
           startdelay=1
           size=1000g

           ...

           [listen8]
           protocol=tcp
           ioengine=net
           port=12352
           listen
           rw=read
           bs=4k
           size=1000g

           [connect8]
           protocol=tcp
           hostname=localhost
           ioengine=net
           port=12352
           rw=write
           startdelay=1
           size=1000g

      Moral of the story: I should refrain from writing more clever stuff.
      At least it looks like it is not too clever to be undebuggable.

      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1426002357-6889-1-git-send-email-pbonzini@redhat.com
      Fixes: c740ad92d0d958fa785e5d7aa1b67ecaf30a6a54
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 43db7c3d484943f62019434d919367c9e3e4402a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 16 14:44:59 2015 +0100

      pixman: add a bunch of PIXMAN_BE_* defines for 32bpp

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f676c67e4be3d4687ca67f35432b8ea4c1d4cc38
  Author: Jeremy White <jwhite@codeweavers.com>
  Date:   Fri Jan 9 13:08:49 2015 -0600

      Allow the use of X11 from a non standard location.

      Signed-off-by: Jeremy White <jwhite@codeweavers.com>

      [ kraxel: solve opengl patch conflicts ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit da076ffed6b9a9cb6b1afce78a4de743212db36e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Nov 20 09:49:44 2014 +0100

      configure: opengl overhaul

      Rename config option from "glx" to "opengl", glx will not be the only
      option for opengl in near future.  Also switch over to pkg-config for
      opengl support detection.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit d28d6505bd72f0d6e3e7a968c60c27f893da976e
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 15:11:22 2014 +1000

      sdl: Fix crash when calling sdl_switch() with NULL surface

      This happens for example when doing ctrl-alt-u and segfaults

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5f5d82ddf1789d32d8921c022261be59e4dcd283
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 15:10:12 2014 +1000

      sdl: Refresh debug statements

      Put them under a #define similar to the VGA model and make them
      actually compile. Add a couple too.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2a5b58e2405e9fe42ba356b5a1b78146a4e9a659
  Merge: a195fdd 81607cb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 12 10:35:53 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150312-1' into staging

      vnc: bugfixes and cleanups.

      # gpg: Signature made Thu Mar 12 08:58:39 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150312-1:
        vnc: fix segmentation fault when invalid vnc parameters are specified
        vnc: avoid possible file handler leak
        ui/console: fix OVERFLOW_BEFORE_WIDEN
        ui: fix regression in x509verify parameter for VNC server
        vnc: switch to inet_listen_opts
        vnc: remove dead code
        vnc: drop display+ws_display from VncDisplay

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7752efcacf41daf34f9fefc5e78131f2afa3d4d7
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:36:12 2015 +0300

      9pfs-proxy: tiny cleanups in proxy_pwritev and proxy_preadv

      Don't compare syscall return with -1, use "<0" condition.
      Don't introduce useless local variables when we already
      have similar variable
      Rename local variable to be consistent with other usages
      Finally make the two methods, read and write, to be similar to each other

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit 1b6f85e2cb9302a8587772d04983a3ecc0ecfe68
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu Mar 12 09:52:30 2015 +0300

      9pfs-local: simplify/optimize local_mapped_attr_path()

      Omit one unnecessary memory allocation for components
      of the path and create the resulting path directly given
      lengths of the components.

      Do not use basename(3) because there are 2 versions of
      this function which differs when argument ends with
      slash character, use strrchr() instead so we have
      consistent result.  This also makes sure the function
      will do the right thing in corner cases (eg, empty
      pathname is given), when basename(3) return entirely
      another string.

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

  commit a195fdd028370faa54ba3d627f1add8401ac5193
  Merge: ee74801 18bf9e2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Mar 12 09:13:06 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      misc fixes and cleanups

      A bunch of fixes all over the place, some of the
      bugs fixed are actually regressions.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Wed Mar 11 17:48:30 2015 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
      #      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

      * remotes/mst/tags/for_upstream: (25 commits)
        virtio-scsi: remove empty wrapper for cmd
        virtio-scsi: clean out duplicate cdb field
        virtio-scsi: fix cdb/sense size
        uapi/virtio_scsi: allow overriding CDB/SENSE size
        virtio-scsi: drop duplicate CDB/SENSE SIZE
        exec: don't include hw/boards for linux-user
        acpi: specify format for build_append_namestring
        MAINTAINERS: drop aliguori@amazon.com
        tpm: Move memory subregion function into realize function
        virtio-pci: Convert to realize()
        pci: Convert pci_nic_init() to Error to avoid qdev_init()
        machine: query mem-merge machine property
        machine: query dump-guest-core machine property
        hw/boards: make it safe to include for linux-user
        machine: query phandle-start machine property
        machine: query kvm-shadow-mem machine property
        kvm: add machine state to kvm_arch_init
        machine: query kernel-irqchip property
        machine: allowed/required kernel-irqchip support
        machine: replace qemu opts with iommu property
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 81607cbfa433272d1f09bd0f0ae6c3b14f818972
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Mar 12 15:33:45 2015 +0800

      vnc: fix segmentation fault when invalid vnc parameters are specified

      Reproducer:
       #./qemu-system-x86_64 -vnc :0,ip
      qemu-system-x86_64: -vnc :1,ip: Invalid parameter 'ip'
      Segmentation fault (core dumped)

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b3c33f91732ea32e7a8391c5e61c3fc02308d822
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 11 16:21:01 2015 +0800

      vnc: avoid possible file handler leak

      vs->lsock may equal to 0, modify the check condition,
      avoid possible vs->lsock leak.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f76b84a04b75e98eee56e8dc277564d0fbb99018
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Mar 11 16:21:00 2015 +0800

      ui/console: fix OVERFLOW_BEFORE_WIDEN

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 8c7d06457311b13bc65c9b24df5d895b2826b8c5
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Mar 10 16:27:34 2015 +0000

      ui: fix regression in x509verify parameter for VNC server

      The 'x509verify' parameter is documented as taking a path to the
      x509 certificates, ie the same syntax as the 'x509' parameter.

        commit 4db14629c38611061fc19ec6927405923de84f08
        Author: Gerd Hoffmann <kraxel@redhat.com>
        Date:   Tue Sep 16 12:33:03 2014 +0200

          vnc: switch to QemuOpts, allow multiple servers

      caused a regression by turning 'x509verify' into a boolean
      parameter instead. This breaks setup from libvirt and is not
      consistent with the docs.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e556032960eaa403da6069aa9abf4dcaddefd710
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 11:31:44 2015 +0100

      vnc: switch to inet_listen_opts

      Use inet_listen_opts instead of inet_listen.  Allows us to drop some
      pointless indirection:  Format strings just to parse them again later on.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit fc5c3ff75135fcc02ca3453568d212241d2bc40f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 11:03:17 2015 +0100

      vnc: remove dead code

      If vs->ws_enabled is set ws_display is non-NULL.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit bf7aa45e7b378691ea0e8616a2aeae2aaabb7bc3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 10:46:49 2015 +0100

      vnc: drop display+ws_display from VncDisplay

      Nobody cares about those strings, they are only used to check whenever
      the vnc server / websocket support is enabled or not.  Add bools for
      this and drop the strings.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit ee74801035b0b5f1fdfd4e31d3a53f511f91c804
  Merge: d598911 6445111
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 18:22:15 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150311' into staging

      MIPS patches 2015-03-11

      Changes:
      * use VMStateDescription for MIPS CPU

      # gpg: Signature made Wed Mar 11 15:01:52 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150311:
        target-mips: add missing MSACSR and restore fp_status and hflags
        target-mips: replace cpu_save/cpu_load with VMStateDescription

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 18bf9e2f379334306530cbfd44218748eceaf67d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 15:10:09 2015 +0100

      virtio-scsi: remove empty wrapper for cmd

      The anonymous struct only has a single field now, drop the wrapper
      structure.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bb72463bc80d90d104a996a111dd8bb39bff58d0
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:35:47 2015 +0100

      virtio-scsi: clean out duplicate cdb field

      cdb is now part of cmd, drop it from req.
      There's also nothing to check using build assert now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 03325525c3a607825ab67bf36bffaa5cf8447df2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:31:29 2015 +0100

      virtio-scsi: fix cdb/sense size

      Commit "virtio-scsi: use standard-headers" added
      cdb and sense into req/rep structures, which
      breaks uses of sizeof for these structures,
      since qemu adds its own arrays on top.

      To fix, redefine CDB/sense field size to 0.

      Reported-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2106ba30105969262a7810417a57524d9a225b91
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:19:03 2015 +0100

      uapi/virtio_scsi: allow overriding CDB/SENSE size

      QEMU wants to use virtio scsi structures with
      a different VIRTIO_SCSI_CDB_SIZE/VIRTIO_SCSI_SENSE_SIZE,
      let's add ifdefs to allow overriding them.

      Keep the old defines under new names:
      VIRTIO_SCSI_CDB_DEFAULT_SIZE/VIRTIO_SCSI_SENSE_DEFAULT_SIZE,
      since that's what these values really are:
      defaults for cdb/sense size fields.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e7cc8ba22ece189a44fa08671426cbc4377e2056
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 14:25:25 2015 +0100

      virtio-scsi: drop duplicate CDB/SENSE SIZE

      This is duplicated from the kernel header,
      drop our copy.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4485bd269c0e1c051d21d0196be89cdba23d9520
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 07:56:34 2015 +0100

      exec: don't include hw/boards for linux-user

      As noted by Andreas, hw/boards.h shouldn't be used outside softmmu code.
      Include it conditionally, and drop the (now unnecessary) ifdef guards in
      hw/boards.h

      Reported-by: Andreas Färber <afaerber@suse.de>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>

  commit 7927266183583f1fa90323890b21d2c03ed244f6
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 18:13:15 2015 +0100

      acpi: specify format for build_append_namestring

      Will catch users if we misused it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 238d7497b9268b1f91c07829de1f75b88011d76f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 16:04:42 2015 +0100

      MAINTAINERS: drop aliguori@amazon.com

      It's sad when a friend leaves, but we have to move on.

      Drop Anthony's email from MAINTAINERS so he stops getting
      irrelevant email.

      Got Anthony's ack off-list.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Anthony Liguori <aliguori@amazon.com>

  commit 9dfd24ed848228643293e37c36848b5ac520ab98
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Tue Mar 10 06:34:01 2015 -0400

      tpm: Move memory subregion function into realize function

      Move the memory subregion function into the DeviceClass realize function
      due to isa_address_space (now) crashing if called in the instance init
      function.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fc079951b7a5eb799bd24d18e4098aa03a3c79dd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:52:14 2015 +0100

      virtio-pci: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 558ecef29240c5a901648f4d44789ac3b07a68ea
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 15:40:25 2015 +0100

      pci: Convert pci_nic_init() to Error to avoid qdev_init()

      qdev_init() is deprecated, and will be removed when its callers have
      been weaned off it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 75cc7f018328e708d94cca23c3a77e85363f25dc
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:55 2015 +0200

      machine: query mem-merge machine property

      Running
          qemu-bin ... -machine pc,mem-merge=on
      leads to crash:
          x86_64-softmmu/qemu-system-x86_64 -machine pc,dump-guest-core=on
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 47c8ca533e502955a4e1b24056639c79500ab8f8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:54 2015 +0200

      machine: query dump-guest-core machine property

      Running
          qemu-bin ... -machine pc,dump-guest-core=on
      leads to crash:
          x86_64-softmmu/qemu-system-x86_64 -machine pc,dump-guest-core=on
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 66bd56694beef7fb8687767e6bec0264227c6b14
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 10 18:20:07 2015 +0100

      hw/boards: make it safe to include for linux-user

      Make it safe to include hw/boards.h in exec.c
      for linux-user configurations.
      We don't need any of its contents though.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6cabe7fa6deeffeed9a3e6d996d6107c94965948
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:53 2015 +0200

      machine: query phandle-start machine property

      Commit e79d5a6 ("machine: remove qemu_machine_opts global list") removed
      the global option descriptions and moved them to MachineState's QOM
      properties.

      Query phandle-start by accessing machine properties through designated
      wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4689b77bda5187d4e2aac78bf21cc1a86502652d
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:52 2015 +0200

      machine: query kvm-shadow-mem machine property

      Commit e79d5a6 ("machine: remove qemu_machine_opts global list") removed
      the global option descriptions and moved them to MachineState's QOM
      properties.

      Query kvm-shadow-mem by accessing machine properties through designated
      wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b16565b396dbbb4c99899dbea599b22f4e0658d6
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:51 2015 +0200

      kvm: add machine state to kvm_arch_init

      Needed to query machine's properties.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 446f16a6906e9d05aa9ce0dde727d4f731a89298
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Mar 10 18:59:54 2015 +0200

      machine: query kernel-irqchip property

      Running
          x86_64-softmmu/qemu-system-x86_64 -machine pc,kernel_irqchip=on -enable-kvm
      leads to crash:
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.  Aborted
          (core dumped)

      This happens because the commit e79d5a6 ("machine: remove qemu_machine_opts
      global list") removed the global option descriptions and moved them to
      MachineState's QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d8870d0217216478888c2d3dd6bf62e155d978c8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:49 2015 +0200

      machine: allowed/required kernel-irqchip support

      The code using kernel-irqchip property requires 'allowed/required'
      functionality. Replace machine's kernel_irqchip field with two fields
      representing the new functionality and expose them through wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8caff63699a9bd6b82556bd527ff023c443ada2d
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Feb 4 17:43:48 2015 +0200

      machine: replace qemu opts with iommu property

      Fixes a QEMU crash when passing iommu parameter in command line.
      Running
          x86_64-softmmu/qemu-system-x86_64 -machine pc,iommu=on -enable-kvm
      leads to crash:
          qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper:
          Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed.
          Aborted (core dumped)

      This happens because commit e79d5a6 ("machine: remove qemu_machine_opts global
      list") removed the global option descriptions and moved them to MachineState's
      QOM properties.

      Fix this by querying machine properties through designated wrappers.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d598911b6f5e7bf7bafb63b8e1d074729e94aca7
  Merge: 165fa40 4f99505
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 16:30:33 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150311' into staging

      target-arm queue:
       * fix a bug in bitops.h
       * implement SD card support on integratorcp
       * add a missing 'compatible' property for Cortex-A57
       * add Netduino 2 machine model
       * fix command line parsing bug for CPU options with multiple CPUs

      # gpg: Signature made Wed Mar 11 14:14:22 2015 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150311:
        bitops.h: sextract64() return type should be int64_t, not uint64_t
        integrator/cp: Implement CARDIN and WPROT signals
        integrator/cp: Model CP control registers as sysbus device
        target-arm: Add missing compatible property to A57
        netduino2: Add the Netduino 2 Machine
        stm32f205: Add the stm32f205 SoC
        stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG
        stm32f2xx_USART: Add the stm32f2xx USART Controller
        stm32f2xx_timer: Add the stm32f2xx Timer
        hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 165fa4091e97bfafbf394acb446623b92998175f
  Merge: 9159eb9 2d5eeef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 15:11:58 2015 +0000

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150310' into staging

      s390x/kvm: Features and fixes for 2.3

      - an extension to the elf loader to allow relocations
      - make the ccw bios relocatable. This allows for bigger ramdisks
        or smaller guests
      - Handle all slow SIGPs in QEMU (instead of kernel) for better
        compliance and correctness
      - tell the KVM module the maximum guest size. This allows KVM
        to reduce the number or page table levels
      - Several fixes/cleanups

      # gpg: Signature made Wed Mar 11 10:17:13 2015 GMT using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150310:
        s390-ccw: rebuild BIOS
        s390/bios: Make the s390-ccw.img relocatable
        elf-loader: Provide the possibility to relocate s390 ELF files
        s390-ccw.img: Reinitialize guessing on reboot
        s390-ccw.img: Allow bigger ramdisk sizes or offsets
        s390x/kvm: passing max memory size to accelerator
        virtio-ccw: Convert to realize()
        virtio-s390: Convert to realize()
        virtio-s390: s390_virtio_device_init() can't fail, simplify
        s390x/kvm: enable the new SIGP handling in user space
        s390x/kvm: deliver SIGP RESTART directly if stopped
        s390x: add function to deliver restart irqs
        s390x/kvm: SIGP START is only applicable when STOPPED
        s390x/kvm: implement handling of new SIGP orders
        s390x/kvm: trace all SIGP orders
        s390x/kvm: helper to set the SIGP status in SigpInfo
        s390x/kvm: pass the SIGP instruction parameter to the SIGP handler
        s390x/kvm: more details for SIGP handler with one destination vcpu
        s390x: introduce defines for SIGP condition codes
        synchronize Linux headers to 4.0-rc3

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5820945946b1e221905aa898f2cd97ed825acd47
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Mar 9 15:59:46 2015 +0100

      pci/shpc: fix signed integer overflow

      clang undefined behaviour sanitizer reports:
      > hw/pci/shpc.c:162:27: runtime error: left shift of 1 by 31 places
      > cannot be represented in type 'int'

      Caused by the usual lack of a 'U' qualifier on a constant 1 being
      shifted left. Fix it up.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 92bf484a87882aa23f10412c774a7357b9bd2be0
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 11 15:07:13 2015 +0100

      acpi-test: update expected files

      commit ecdc7bab095a2cf29d9e9d4a7e1494f586a8b270
          "acpi: fix aml_equal term implementation"
      dropped a useless Zero in generated code,
      update expected files appropriately.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9159eb9abc31e02797dc55998e71f12c06846d55
  Merge: 8d86e34 b18a755
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 14:27:13 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/vser-for-2.3-1' into staging

      virtio-serial: fix crash on port hotplug when a previously-added port
      did not have the 'name' property set.

      # gpg: Signature made Wed Mar 11 11:13:53 2015 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/vser-for-2.3-1:
        virtio-serial: fix segfault on NULL port names

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 644511117e7ca9f26d633a59c202a297113a796c
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Feb 20 13:07:45 2015 +0000

      target-mips: add missing MSACSR and restore fp_status and hflags

      Save MSACSR state. Also remove fp_status, msa_fp_status, hflags and restore
      them in post_load() from the architectural registers.
      Float exception flags are not present in vmstate. Information they carry
      is used only by softfloat caller who translates them into MIPS FCSR.Cause,
      FCSR.Flags and then they are cleared. Therefore there is no need for saving
      them in vmstate.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 04cd79625fa4103c5839ba36ad476dd22f7f7557
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Feb 20 13:07:44 2015 +0000

      target-mips: replace cpu_save/cpu_load with VMStateDescription

      Create VMStateDescription for MIPS CPU. The new structure contains exactly the
      same fields as before, therefore leaving existing version_id.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4f9950520a115acf9c0a209f0befa45758ad0215
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      bitops.h: sextract64() return type should be int64_t, not uint64_t

      The documentation for sextract64() claims that the return type is
      an int64_t, but the code itself disagrees. Fix the return type to
      conform to the documentation and to bring it into line with
      sextract32(), which returns int32_t.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1423231328-15662-1-git-send-email-peter.maydell@linaro.org

  commit 83d0cf895f9b1c35fb56d3c93fd3504bc1ac8344
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      integrator/cp: Implement CARDIN and WPROT signals

      This allows to use the SD card emulation of the board: Forward the
      signals from the pl181 top the CP control register emulation, report the
      current state via CP_INTREG, deliver CARDIN IRQ to the secondary
      interrupt controller and also support clearing that line via CP_INTREG.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Message-id: c55d9fb28d19ec83625cb0074b3b6f2e5958caf6.1426004843.git.jan.kiszka@siemens.com
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ffc8542a660c447db6ba972b71b4903458309e7e
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      integrator/cp: Model CP control registers as sysbus device

      No new features yet, just encapsulation.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Message-id: 3829c7c7e01cd3ccf15a1198f114e4d675974ae0.1426004843.git.jan.kiszka@siemens.com
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0458b7b5b87be2422a67912c222aa1ec97fe94fa
  Author: Ryota Ozaki <ozaki.ryota@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      target-arm: Add missing compatible property to A57

      Signed-off-by: Ryota Ozaki <ozaki.ryota@gmail.com>
      Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 1424097799-11002-1-git-send-email-ozaki.ryota@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit da6bd924c049068723b91b97610940d63ce57850
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      netduino2: Add the Netduino 2 Machine

      This patch adds the Netduino 2 Machine.

      This is a Cortex-M3 based machine. Information can be found at:
      http://www.netduino.com/netduino2/specs.htm

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5bd999824f14252c122c4501cc973cee986eadd7.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit db635521a02c951d03ad7b373acfa92a8ff4359e
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:06 2015 +0000

      stm32f205: Add the stm32f205 SoC

      This patch adds the stm32f205 SoC. This will be used by the
      Netduino 2 to create a machine.

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 48d509747a1ea0d8a7d5480560495e679990f9d2.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bbbbd9002ffe9d03851bc87ab326b01378f93faf
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG

      This patch adds the stm32f2xx System Configuration
      Controller. This is used to configure what memory is mapped
      at address 0 (although that is not supported) as well
      as configure how the EXTI interrupts work (also not
      supported at the moment).

      This device is not required for basic examples, but more
      complex systems will require it (as well as the EXTI device)

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5d499d7b60b61d5d6dcb310b2e55411b1f53794e.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 73af5d1115255ac921e3169d2d7376e5bc9d2838
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_USART: Add the stm32f2xx USART Controller

      This patch adds the stm32f2xx USART controller
      (UART also uses the same controller).

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 762c6c0d2a41d574932bc4445ec9bfffe6da8798.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be2847051421119f64a0134b5654a5134658d379
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      stm32f2xx_timer: Add the stm32f2xx Timer

      This patch adds the stm32f2xx timers: TIM2, TIM3, TIM4 and TIM5
      to QEMU.

      Signed-off-by: Alistair Francis <alistair@alistair23.me>
      Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 155091a323390f8da3cca496e4c611c493e62a77.1424175342.git.alistair@alistair23.me
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 886bc7a0492ff5d3b6c42157afff827b68595c34
  Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
  Date:   Wed Mar 11 13:21:05 2015 +0000

      hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

      The recently introduced feature that allows 32 bit guests to be
      executed under KVM on a 64-bit host incorrectly handles the case
      where more than 1 cpu is specified using '-smp N'

      For instance, this invocation of qemu

        qemu-system-aarch64 -M virt -cpu cortex-a57,aarch64=off -smp 2

      produces the following error

        qemu-system-aarch64: Expected key=value format, found aarch64

      which is caused by the destructive parsing performed by
      cpu_common_parse_features(), resulting in subsequent attempts
      to parse the CPU option string (for each additional CPU) to fail.

      So duplicate the string before parsing it, and free it directly
      afterwards.

      Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1425402380-10488-1-git-send-email-ard.biesheuvel@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8d86e34e65d6d4c8201de6356635f34d38391a93
  Merge: 4841237 2994fd9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 12:50:51 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into staging

      QOM CPUState and X86CPU

      * Add CPUClass documentation
      * Clean up X86CPU APIC realization
      * Cleanups around cpu_init()

      # gpg: Signature made Tue Mar 10 17:27:28 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-cpu-for-peter:
        cpu: Make cpu_init() return QOM CPUState object
        unicore32: Use uc32_cpu_init()
        m68k: Use cpu_m68k_init()
        target-unicore32: Make uc32_cpu_init() return UniCore32CPU
        target-i386: Clean up misuse of qdev_init() in realize method
        cpu: Add missing documentation for some CPUClass methods

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 48412371415a260d00fc7fdcdb400da55f268828
  Merge: 4ba4df4 9886e83
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 11:12:35 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      X86 patches queued in the last few weeks. Mostly code cleanup and changes on
      code assigning APIC ID.

      # gpg: Signature made Mon Mar  9 20:40:38 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Require APIC ID to be explicitly set before CPU realize
        target-i386: Move APIC ID compatibility code to pc.c
        target-i386: Move CPUX86State::cpuid_apic_id to X86CPU::apic_id
        target-i386: Remove unused APIC ID default code
        target-i386: Eliminate unnecessary get_cpuid_vendor() function
        target-i386: Simplify listflags() function
        target-i386: Move topology.h to include/hw/i386

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b18a755c4266a340a25ab4118525bd57c3dfc3fa
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Wed Mar 4 14:29:52 2015 +0530

      virtio-serial: fix segfault on NULL port names

      Commit d0a0bfe6729ef6044d76ea49fafa07e29fa598bd added checks for port
      names, but didn't add a check to ensure port->name is non-NULL.  This
      results in a SIGSEGV when adding a port when one of the previously-added
      ports didn't have the 'name' property set.

      https://bugzilla.redhat.com/show_bug.cgi?id=1192775

      Reported-by: vivian zhang <vivianzhang@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 2d5eeef1c0be68c30ccd60fd7267690d523f702a
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 9 09:45:44 2015 +0100

      s390-ccw: rebuild BIOS

      rebuild bios to get latest changes:

      s390/bios: Make the s390-ccw.img relocatable
      s390-ccw.img: Reinitialize guessing on reboot
      s390-ccw.img: Allow bigger ramdisk sizes or offsets

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d884c86dcd3b64406cf5ce2373374cee6b475ecb
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Mar 9 11:12:53 2015 +0100

      s390/bios: Make the s390-ccw.img relocatable

      The current bios sits at location 0x7e00000 in the guest RAM
      and thus prevents loading of bigger ramdisks. By making the
      image relocatable we can move it to the end of the RAM so that
      it is getting out of the way.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Message-Id: <1425895973-15239-3-git-send-email-thuth@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      [Fixup build failure on 32 bit hosts]

  commit 4ba4df405c766b7f9e46ef145e140961155348e6
  Merge: 21025c2 f3b18f3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 11 08:44:59 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

      qemu-sparc update

      # gpg: Signature made Tue Mar 10 13:39:51 2015 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-sparc-signed:
        sun4u: switch m48t59 NVRAM to MMIO access
        MAINTAINERS: add myself as SPARC maintainer
        doc: minor updates to SPARC32 and SPARC64 documentation
        m48t59: add m48t59 sysbus device
        m48t59: introduce new base-year qdev property
        m48t59: let init functions return a Nvram object
        m48t59: add a Nvram interface
        m48t59: register a QOM type for each nvram type we support
        m48t59: move ISA ports/memory regions registration to QOM constructor

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21025c29f5cc716cea8a8865d96fa259acbd4d47
  Merge: 23a7a28 b57489c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 19:28:09 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150310-1' into staging

      vnc bugfixes.

      # gpg: Signature made Tue Mar 10 10:37:51 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150310-1:
        Fix crash when connecting to VNC through websocket
        vnc: -readconfig fix
        vnc: set id at parse time not init time

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 23a7a287967089d70a7e30ca4c7421674691c503
  Merge: 1976058 ac57622
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 18:03:02 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - scsi: improvements to error reporting and conversion to realize,
        Coverity/sparse fix for iscsi driver
      - RCU fallout: fix -daemonize and s390x system emulation
      - KVM: kvm_stat improvements and new man page
      - x86: SYSRET fix for VxWorks

      # gpg: Signature made Tue Mar 10 10:18:45 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        x86: fix SS selector in SYSRET
        scsi: Convert remaining PCI HBAs to realize()
        scsi: Improve error reporting for invalid drive property
        hw: Propagate errors through qdev_prop_set_drive()
        scsi: Clean up duplicated error in legacy if=scsi code
        cpus: initialize cpu->memory_dispatch
        rcu: handle forks safely
        qemu-thread: do not use PTHREAD_MUTEX_ERRORCHECK
        kvm_stat: add kvm_stat.1 man page
        kvm_stat: add column headers to text UI
        iscsi: Fix check for username

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2994fd96d986578a342f2342501b4ad30f6d0a85
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:49 2015 -0300

      cpu: Make cpu_init() return QOM CPUState object

      Instead of making cpu_init() return CPUArchState, return CPUState.

      Changes were made using the Coccinelle semantic patch below.

        @@
        typedef CPUState;
        identifier e;
        expression args;
        type CPUArchState;
        @@
        -   e =
        +   cpu =
                cpu_init(args);
        -   if (!e) {
        +   if (!cpu) {
                ...
            }
        -   cpu = ENV_GET_CPU(env);
        +   e = cpu->env_ptr;

        @@
        identifier new_env, new_cpu, env, cpu;
        type CPUArchState;
        expression args;
        @@
        -{
        -   CPUState *cpu = ENV_GET_CPU(env);
        -   CPUArchState *new_env = cpu_init(args);
        -   CPUState *new_cpu = ENV_GET_CPU(new_env);
        +{
        +   CPUState *cpu = ENV_GET_CPU(env);
        +   CPUState *new_cpu = cpu_init(args);
        +   CPUArchState *new_env = new_cpu->env_ptr;
            ...
        }

        @@
        identifier c, cpu_init_func, cpu_model;
        type StateType, CPUType;
        @@
        -static inline StateType* cpu_init(const char *cpu_model)
        -{
        -   CPUType *c = cpu_init_func(cpu_model);
        (
        -   if (c == NULL) {
        -       return NULL;
        -   }
        -   return &c->env;
        |
        -   if (c) {
        -       return &c->env;
        -   }
        -   return NULL;
        )
        -}
        +#define cpu_init(cpu_model) CPU(cpu_init_func(cpu_model))

        @@
        identifier cpu_init_func;
        identifier model;
        @@
        -#define cpu_init(model) (&cpu_init_func(model)->env)
        +#define cpu_init(model) CPU(cpu_init_func(model))

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Riku Voipio <riku.voipio@iki.fi>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Michael Walle <michael@walle.cc>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Anthony Green <green@moxielogic.com>
      Cc: Jia Liu <proljc@gmail.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      [AF: Fixed up cpu_copy() manually]
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c3898f770bffd6be5c1558abeaca9cd1fb18b6ca
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:48 2015 -0300

      unicore32: Use uc32_cpu_init()

      Instead of using the legacy cpu_init() function, use uc32_cpu_init() to
      create a UniCore32CPU object.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit eeff620f820f9f0a4f400dec1437bc251402051a
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:47 2015 -0300

      m68k: Use cpu_m68k_init()

      Instead of using the legacy cpu_init() function, use cpu_m68k_init()
      directly to create a M68kCPU object.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 41979669ab756791cebc1a20c6a6ee1cb7c71caa
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Feb 26 17:37:46 2015 -0300

      target-unicore32: Make uc32_cpu_init() return UniCore32CPU

      This way, the cpu_init() function in target-unicore32 will follow the
      same pattern used on all other architectures.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 6e8e26519901bc254a0db2e8aad805c4349cd3b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:29:15 2015 +0100

      target-i386: Clean up misuse of qdev_init() in realize method

      x86_cpu_apic_realize() calls qdev_init() to realize the APIC.
      qdev_init()'s error handling has unwanted side effects: it unparents
      the device, and it calls qerror_report_err().

      qerror_report_err() is always inappropriate in realize methods,
      because it doesn't return the Error object.  It either reports the
      error to stderr or the human monitor, or it stores it in the QMP
      monitor, where it makes the QMP command fail even though the realize
      method succeeded.

      Fortunately, qdev_init() can't actually fail here, because realize
      can't fail for any of the three possible APIC device models.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c08295d4bf161332f3f0b34b378138592a26245a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 5 14:23:32 2015 +0000

      cpu: Add missing documentation for some CPUClass methods

      The CPUClass QOM methods virtio_is_big_endian, write_elf{32,64}_note
      and write_elf{32,64}_qemunote were added without any description
      being added to the doc comment. Correct this omission.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit ecdc7bab095a2cf29d9e9d4a7e1494f586a8b270
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Mar 8 13:16:03 2015 +0200

      acpi: fix aml_equal term implementation

      The DefLEqual op does not have a target operand. Remove it.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit aea10cdef2fb5c3bb8af598609ce19f725bf127f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 16:19:15 2015 +0100

      aml-build: append opcodes using build_append_byte

      Opcodes are raw bytes, they shouldn't be added
      using build_append_int. This only happens to work
      with 0 and 1 opcodes.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 7d433b0d85eba3d5083be6b74fd111f6de4ee373
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sat Mar 7 20:47:51 2015 +0100

      aml-build: don't modify child

      this code:
          aml_append(foo, bar);

      might, non-intuitively, modify bar, which means that e.g. the following
      might not DTRT:

          c = ....;
          aml_append(a, c);
          aml_append(b, c);

      to fix, simply allocate an intermediate array,
      and always modify that.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 1976058109890892db8ec88bfd3273f79c459f6b
  Merge: 8437f7b 280458a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 14:01:22 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Tue Mar 10 13:03:17 2015 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (73 commits)
        MAINTAINERS: Add jcody as blockjobs, block devices maintainer
        iotests: add O_DIRECT alignment probing test
        block/raw-posix: fix launching with failed disks
        MAINTAINERS: Add jsnow as IDE maintainer
        sheepdog: Fix misleading error messages in sd_snapshot_create()
        Add testcase for scsi-hd devices without drive property
        scsi-hd: fix property unset case
        block/vdi: Add locking for parallel requests
        iotests: Drop vpc from 004's and 104's format list
        iotests: Remove 006
        iotests: Fix 051's reference output
        virtio-blk: Remove the stale FIXME comment
        tests: Check QVIRTIO_F_ANY_LAYOUT flag in virtio-blk test
        libqos: Solve bug in interrupt checking when using MSIX in virtio-pci.c
        sheepdog: fix confused return values
        qtest/ahci: add fragmented dma test
        qtest/ahci: Add PIO and LBA48 tests
        qtest/ahci: Add DMA test variants
        libqos/ahci: add ahci command helpers
        qtest/ahci: Add a macro bootup routine
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 280458a34abcca2ba70843a089a35468c81e3740
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Fri Mar 6 12:16:06 2015 -0500

      MAINTAINERS: Add jcody as blockjobs, block devices maintainer

      The block layer maintainership is being split up into smaller, more
      manageable pieces.

      I propose that I take over / assist with the following areas:

          * blockjobs
          * archipelago
          * curl
          * gluster
          * nfs
          * rbd
          * sheepdog
          * ssh
          * vhdx

      As John Snow noted in a different patch:

      As we split out the block layer, we will begin using the qemu-block
      mailing list as a catchall for all of the block layer subcomponents.
      Please CC qemu-block@nongnu.org for all block layer patches, including
      any that touch the above listed areas.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1a6e597995c8c0125d1f305b583d6de083e44c73
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 5 15:38:18 2015 -0600

      iotests: add O_DIRECT alignment probing test

      This test case checks that image files can be opened even if I/O
      produces EIO errors.  QEMU should not refuse opening failed disks since
      the guest may be configured for multipath I/O where accessing failed
      disks is expected.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 22d182e82b4ba2fb78b2cc22bcec4e6a440b0ad6
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Mar 5 15:38:17 2015 -0600

      block/raw-posix: fix launching with failed disks

      Since commit c25f53b06eba1575d5d0e92a0132455c97825b83 ("raw: Probe
      required direct I/O alignment") QEMU has failed to launch if image files
      produce I/O errors.

      Previously, QEMU would launch successfully and the guest would see the
      errors when attempting I/O.

      This is a regression and may prevent multipath I/O inside the guest,
      where QEMU must launch and let the guest figure out by itself which
      disks are online.

      Tweak the alignment probing code in raw-posix.c to explicitly look for
      EINVAL on Linux instead of bailing.  The kernel refuses misaligned
      requests with this error code and other error codes can be ignored.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c095348b914b740d8364a2ccf748e4284de3b68b
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Mar 4 23:37:55 2015 -0500

      MAINTAINERS: Add jsnow as IDE maintainer

      It has been proposed that the block layer be split up into smaller,
      more manageable portions to help speed up the review and merging of
      block layer patches.

      As part of this process, I propose that I take over the IDE, ATA, ATAPI
      and FD devices.

      As we split out the block layer, we will begin using the qemu-block
      mailing list as a catchall for all of the block layer subcomponents.
      Please CC qemu-block@nongnu.org for all block layer patches, including
      any that touch the IDE/Floppy devices.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 27994d587940b0c72d5f1d69f6e1a62a02f26dc9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 14:49:50 2015 +0100

      sheepdog: Fix misleading error messages in sd_snapshot_create()

      If do_sd_create() fails, it first reports the error returned, then
      reports a another one with strerror(errno).  errno is meaningless at
      that point.

      Report just one error combining the valid information from both
      messages.

      Reported-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Liu Yuan <namei.unix@gmail.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 354483e50726140d9c6cb5ff0e1698bd5f17a2d5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Mar 3 15:59:26 2015 +0100

      Add testcase for scsi-hd devices without drive property

      Lets add a test for scsi devices without a drive. This was broken
      by a recent block patch, thus indicating that we need a testcase.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit df1d4c341a735334de23513f17bf110c8c49b3e7
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Wed Mar 4 11:02:16 2015 +0100

      scsi-hd: fix property unset case

      Commit c53659f0 ("BlockConf: Call backend functions to detect geometry
      and blocksizes") causes a segmentation fault on the invalid
      configuration of a scsi device without a drive.

      Let's check for conf.blk before calling blkconf_blocksizes. The error
      will be handled later on in scsi_realize anyway.

      Reported-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f0ab6f109630940146cbaf47d0cd99993ddba824
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 27 14:54:39 2015 -0500

      block/vdi: Add locking for parallel requests

      When allocating a new cluster, the first write to it must be the one
      doing the allocation, because that one pads its write request to the
      cluster size; if another write to that cluster is executed before it,
      that write will be overwritten due to the padding.

      See https://bugs.launchpad.net/qemu/+bug/1422307 for what can go wrong
      without this patch.

      Cc: qemu-stable <qemu-stable@nongnu.org>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aef58bdc1e7d8f37cdf838b49f160c520399c84f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 16:22:39 2015 -0500

      iotests: Drop vpc from 004's and 104's format list

      Both tests require the test image to have a specific size; this cannot
      be guaranteed by vpc (unless tuning the test specifically for that
      format).

      It is safe to exclude vpc from 004 because what is tested there is
      implemented in a generic part in the block layer and not
      format-specific.

      It is safe to exclude vpc from 104 because for vpc basically every image
      size is "unaligned", so if that would break at some point in time, we
      would quickly notice just by running the generic tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 005628bc8a1693c3dcb00ff2dc3a67cf92c61a13
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 16:22:38 2015 -0500

      iotests: Remove 006

      vpc does support images > 127 GB if done correctly. qemu does it
      correctly. Remove the test pretending otherwise.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2726958d5eaa3e8242a56014a33e2420280cdd57
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Mar 3 09:38:32 2015 -0500

      iotests: Fix 051's reference output

      Commit c4bacafb717de55538311b80a185ce9166b8daa2 changed (improved)
      qdev_init_nofail()'s error reporting, which affects iotest 051. Fix the
      reference output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c0542ea60d21b56a9157d3f6331d2df8990d3bb
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Feb 16 12:09:40 2015 +0800

      virtio-blk: Remove the stale FIXME comment

      By default, we have ioeventfd enabled, so the IO request processing is
      in IO thread; in the vcpu thread, guest mode is returned to as quickly
      as possible, and completion is delivered via irqfd. Therefore this
      comment from the initial implementation is barely relevant.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9b7d2d8b076ff12f0d7b4246aec8f421b4150aae
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:59:14 2015 +0100

      tests: Check QVIRTIO_F_ANY_LAYOUT flag in virtio-blk test

      Check the QVIRTIO_F_ANY_LAYOUT flag before performing operations with 2
      descriptor layout. This is to follow the specification strictly.

      This patch depends on:
      [PATCH v5 0/5] libqos: Virtio MMIO driver

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Message-id: 1424815154-27243-1-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1e34cf9681ec549e26f30daaabc1ce58d60446f7
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 17:34:14 2015 +0100

      libqos: Solve bug in interrupt checking when using MSIX in virtio-pci.c

      The MSIX interrupt was always acked without checking its value, which caused a
      race condition. If the ISR was raised between the read and the acking, the ISR
      was never detected and it timed out.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Tested-by: John Snow <jsnow@redhat.com>
      Message-id: 1424795655-16952-1-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 833a7cc36e63653641558ba27148076f9a32062f
  Author: Liu Yuan <liuyuan@cmss.chinamobile.com>
  Date:   Wed Feb 18 11:57:55 2015 +0800

      sheepdog: fix confused return values

      These functions mix up -1 and -errno in return values and would might cause
      trouble error handling in the call chain.

      This patch let them return -errno and add some comments.

      Cc: qemu-devel@nongnu.org
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Liu Yuan <liuyuan@cmss.chinamobile.com>
      Message-id: 1424231875-7131-1-git-send-email-namei.unix@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e0c59cc7608f84fcaddc827e05d38af8d10447a3
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:40 2015 -0500

      qtest/ahci: add fragmented dma test

      Test what happens when we try to use extremely short PRDTs
      to accomplish a small data transfer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bda39dc241b1c216158aa990936d08f0a1ad26e3
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:39 2015 -0500

      qtest/ahci: Add PIO and LBA48 tests

      In addition to DMA tests, test PIO and LBA48 command pathways in AHCI.
      To accomplish this, a primitive multiplexer for gtest is added.

      Though guests may prefer not to issue PIO commands directly except
      for single sector cases during early boot and shutdown, these pathways
      are still used for the transfer of ATAPI commands as well, and should
      be behaving well.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d6c403edc7ce890be12915f12eb02062bf275ca8
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:38 2015 -0500

      qtest/ahci: Add DMA test variants

      These test a few different pathways in the AHCI code.

      short:  Test the minimum transfer size, exactly one sector.
      simple: Test a transfer using a single PRD, in this case, 4K.
      double: Test transferring 8K, which we will split up as two PRDs.
      long:   Test transferring a lot of data using many PRDs, 256K.
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f9f963e0fbba98d7ece75287c40d0c1b249dc9b4
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:37 2015 -0500

      libqos/ahci: add ahci command helpers

      ahci_command_set_flags:  Set additional flags in the command header.
      ahci_command_clr_flags:  Clear flags from the command header.
      ahci_command_set_offset: Change the IO sector from 0.
      ahci_command_adjust:     Adjust many values simultaneously.

      To be used to adjust the command header if the default values/guesses
      were incorrect or undesirable.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

      [ kwolf: Fixed conflicting prototype for ahci_command_adjust() ]

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d63b4017c2dff9cf0f15d06d5f604a97a30ef4c5
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:36 2015 -0500

      qtest/ahci: Add a macro bootup routine

      Add a routine that can be used to engage the AHCI
      device at a not-granular level so that bringing up
      the functionality of the HBA is easy in future tests
      that are not concerned with testing the bring-up process.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4a42f6d408079830099dbffc1b0cb2869db69215
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Feb 25 18:06:35 2015 -0500

      libqos/ahci: Zero-fill AHCI headers

      Even though it's just the reserved space, make sure they're zeroes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424905602-24715-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit baca2b9e3a94be1690fc4a842a97b64a4c8f892c
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:06 2015 -0500

      qtest/ide: Test flush / retry for ISA and PCI

      This patch adds tests for werror and rerror functionality
      for the PCI and ISA ide buses.

      Tests for the AHCI device are to be included at a later
      date after requisite patches have been merged upstream
      to support needed functionality by the tests.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1424708286-16483-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c27c73aaf924655b2cc2e74384a639805acededb
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:05 2015 -0500

      ahci: Recompute cur_cmd on migrate post load

      When the AHCI HBA device is migrated, all of the information that
      led to the request being created is stored in the AHCIDevice
      structures, except for pointers into guest data where return
      information needs to be stored.

      The "cur_cmd" field is usually responsible for this.

      To rebuild the cur_cmd pointer post-migration, we can utilize
      the busy_slot index to figure out where the command header
      we are still processing is.

      This allows a machine in a halted state from rerror=stop or
      werror=stop to be migrated and resume operations without issue.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e8ef87433ee005d304ba19c56488474432eb0c53
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:04 2015 -0500

      ahci: add support for restarting non-queued commands

      This is easy, since start_dma already restarts processing from the
      beginning of the PRDT.

      Migration is also easy to cover; the comment about busy_slot is
      wrong, busy_slot will only be set if there is an error.  In this
      case we have nothing to do really.  The core IDE code will restart
      the operation and command list processing will proceed after the
      erroring command has been completed.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd6649101d044df446c66949cb6c1462c8989726
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Feb 23 11:18:03 2015 -0500

      ahci: Migrate IDEStatus

      Amazingly, we weren't doing this before.

      Make sure we migrate the IDEState structure that belongs to
      the AHCIDevice.IDEBus structure during migrations.

      No version numbering changes because AHCI is not officially
      migratable (and we can all see with good reason why) so we
      do not impact any official builds by altering the stream and
      leaving it at version 1.

      This fixes the rerror=stop/werror=stop test case where we wish
      to migrate a halted job. Previously, the error code would not
      migrate, so even if the job completed successfully, AHCI would
      report an error because it would still have the placeholder
      error code from initialization time.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d32c76b3add2cb5216ae6931ef06632b802a6f68
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:02 2015 -0500

      ide: support PIO restart for the ISA controller

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4e2b8b4a4e8fcc598f7b9df15aa8949a1ab096e8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:01 2015 -0500

      ide: make more functions static

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c71c06d437d4cccf753cb41731e5a71f54317a01
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:18:00 2015 -0500

      ide: commonize io_buffer_index initialization

      Resetting the io_buffer_index to 0 is commonized,
      with the exception of the case within ide_atapi_cmd_reply,
      where we need to reset this index to 0 prior to the
      ide_atapi_cmd_reply_end call.

      Note that not all calls to ide_atapi_cmd_reply_end
      expect the index to be 0, so setting it there is
      not appropriate.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d12b9ff2a4e21587e5b180008c88a0e6e1ec8ac5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:59 2015 -0500

      ide: migrate initial request state via IDEBus

      This only breaks backwards migration compatibility if the bus is in
      an error state.  It is in principle possible to avoid this by making
      two subsections (one for version 1, and one for version 2, but with
      the same name) with different "_needed" callbacks.  The v1 callback would
      return true if error_status != 0 and the bus is PATA; the v2 callback
      would return true if error_status != 0 and the bus is AHCI.

      Forward migration keeps working.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit dc5d0af49a90571813b9cbcea90c0bbbea0d4a22
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:58 2015 -0500

      ide: place initial state of the current request to IDEBus

      This moves more common restarting logic to the core IDE code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a96cb236290ef8e54b061b30c41835e435905d7a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:57 2015 -0500

      ide: replace set_unit callback with more IDEBus state

      Start moving the initial state of the current request to IDEBus, so that
      AHCI can use it.  The set_unit callback is not used anymore once this is
      done.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fe09c7c9f0e8ed8793e986cf616c8de0a9518fd7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:56 2015 -0500

      ide: remove restart_cb callback

      With restarts now handled by ide_restart_cb and
      the IDEDMAOps.restart_dma() member, remove the old
      restart_cb callback.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9898586d8929a7f1293fc64164b67a79289b074f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:55 2015 -0500

      ide: move restart callback to common code

      With BMDMA specific excised from the restart functions,
      create a HBA-agnostic restart callback to be shared
      between the different HBAs.

      Change the callback registered with the vmstate_change
      handler to always point to ide_restart_cb instead of
      relying on the IDEDMAOps.restart_cb() member.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d34fceda8feb6c36722f41f3e1db40cf2af82ea8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:54 2015 -0500

      ide: pass IDEBus to the restart_cb

      Pass the containing IDEBus to the restart_cb instead
      of the more specific BMDMAState child.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2745df813d82724f2633a9b2ba7f7c5717d7509b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:53 2015 -0500

      ide: do not use BMDMA in restart callback

      Whenever an error stops the VM, ide_handle_rw_error does
      "s->bus->dma->unit = s->unit".  So we can just use
      idebus_active_if.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f878c916077d510be3276dad7c36f606cdcea80a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:52 2015 -0500

      ide: introduce ide_register_restart_cb

      A helper is added that registers the IDEDMAOp .restart_cb()
      via qemu_add_vm_change_state_handler instead of requiring
      each HBA to register the callback themselves.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd8892c4e6d681517c687ec5ac86eed46b3bb23b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:51 2015 -0500

      ide: prepare to move restart to common code

      This patch adds the restart_dma callback and adjusts
      the ide_restart_dma function to utilize this callback
      to call the BMDMA-specific restart code instead of statically
      executing BMDMA-specific code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06b95b1ee75706592929e7e91cf18373fd0e6697
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 23 11:17:50 2015 -0500

      ide: start extracting ide_restart_dma out of bmdma_restart_dma

      This patch begins refactoring the restart dma functions
      out of bmdma to be shared with AHCI and other future
      IDE HBA implementations.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1424708286-16483-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0eb28a42284ec32e6f283985d2d638474a05eba4
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:58 2015 +0100

      BlockConf: Call backend functions to detect geometry and blocksizes

      geometry: hd_geometry_guess function autodetects the drive geometry.
      This patch adds a block backend call, that probes the backing device
      geometry. If the inner driver method is implemented and succeeds
      (currently only for DASDs), the blkconf_geometry will pass-through
      the backing device geometry. Otherwise will fallback to old logic.

      blocksize: This patch initializes blocksize properties to 0.
      In order to set the property a blkconf_blocksizes was introduced.
      If user didn't set physical or logical blocksize, it will
      retrieve its value from a driver (only succeeds for DASD), otherwise
      it will set default 512 value.

      The blkconf_blocksizes call was added to all users of BlkConf.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-6-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f0272c4db2a914453a6254f80bfe3b708a0b2426
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:57 2015 +0100

      block-backend: Add wrappers for blocksizes and geometry probing

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-5-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1a9335e4a94d0f0c635a5284aa3ba5dc50d24f70
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:56 2015 +0100

      block: Add driver methods to probe blocksizes and geometry

      Introduce driver methods of defining disk blocksizes (physical and
      logical) and hard drive geometry.
      Methods are only implemented for "host_device". For "raw" devices
      driver calls child's method.

      For now geometry detection will only work for DASD devices. To check
      that a local check_for_dasd function was introduced. It calls BIODASDINFO2
      ioctl and returns its rc.

      Blocksizes detection function will probe sizes for DASD devices.

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-4-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a4ed0d1b16d8932362ffecf8f6f79e6340a585f
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:55 2015 +0100

      raw-posix: Factor block size detection out of raw_probe_alignment()

      Put it in new probe_logical_blocksize().

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-3-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 892b7de832681cdfff22a6e96cb0280b59684024
  Author: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
  Date:   Mon Feb 16 12:47:54 2015 +0100

      block: add bdrv functions for geometry and blocksize

      Add driver functions for geometry and blocksize detection

      Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424087278-49393-2-git-send-email-tumanova@linux.vnet.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a069e2f1372a0a823ab506fc019852a2a652aa54
  Author: John Snow <jsnow@redhat.com>
  Date:   Fri Feb 6 16:26:17 2015 -0500

      blkdebug: fix "once" rule

      Background:
        The blkdebug scripts are currently engineered so that when a debug
      event occurs, a prefilter browses a master list of parsed rules for a
      certain event and adds them to an "active list" of rules to be used for
      the forthcoming action, provided the events and state numbers match.

        Then, once the request is received, the last active rule is used to
      inject an error if certain parameters match.

        This active list is cleared every time the prefilter injects a new
      rule for the first time during a debug event.

        The "once" rule currently causes the error injection, if it is
      triggered, to only clear the active list. This is insufficient for
      preventing future injections of the same rule.

      Remedy:
        This patch /deletes/ the rule from the list that the prefilter
      browses, so it is gone for good. In V2, we remove only the rule of
      interest from the active list instead of allowing the "once" rule to
      clear the entire list of active rules.

      Impact:
        This affects iotests 026. Several ENOSPC tests that used "once" can
      be seen to have output that shows multiple failure messages. After
      this patch, the error messages tend to be smaller and less severe, but
      the injection can still be seen to be working. I have patched the
      expected output to expect the smaller error messages.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423257977-25630-1-git-send-email-jsnow@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d2eed8c6d9601cddc9dff2940d87bc022e9bd03c
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:50 2015 -0500

      iotests: Add test for different refcount widths

      Add a test for errors specific to certain widths (i.e. snapshots with
      refcount_bits=1).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 06d05fa738915ab82577289a0b81b3e600c4e749
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:49 2015 -0500

      qcow2: Allow creation with refcount order != 4

      Add a creation option to qcow2 for setting the refcount order of images
      to be created, and respect that option's value.

      This breaks some test outputs, fix them.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5262caa75468adce44b57ed9c076b2f22bd9315f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:48 2015 -0500

      iotests: Prepare for refcount_bits option

      Some tests do not work well with certain refcount widths (i.e. you
      cannot create internal snapshots with refcount_bits=1), so make those
      widths unsupported.

      Furthermore, add another filter to _filter_img_create in common.filter
      which filters out the refcount_bits value.

      This is necessary for test 079, which does actually work with any
      refcount width, but invoking qemu-img directly leads to the
      refcount_bits value being visible in the output; use _make_test_img
      instead which will filter it out.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a17b83cc3d4aa61ed24e2682aaf8ada7130f03d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:47 2015 -0500

      qcow2: Use symbolic macros in qcow2_amend_options

      qcow2_amend_options() should not compare options against some inline
      strings but rather use the symbolic macros available for each of the
      creation options.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit bd4b167f84840865b788e9f236585f77a77b10fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 18 17:40:46 2015 -0500

      qcow2: refcount_order parameter for qcow2_create2

      Add a refcount_order parameter to qcow2_create2(), use that value for
      the image header and for calculating the size required for
      preallocation.

      For now, always pass 4.

      This addition requires changes to the calculation of the file size for
      the "full" and "falloc" preallocation modes. That in turn is a nice
      opportunity to add a comment about that calculation not necessarily
      being exact (and that being intentional).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b72faf9f78377e38342f78ffacdfa0726f5e7511
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:52 2015 -0500

      qcow2: Open images with refcount order != 4

      No longer refuse to open images with a different refcount entry width
      than 16 bits; only reject images with a refcount width larger than 64
      bits (which is prohibited by the specification).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 59c0cb7830be68080c6a0d1449253b954350e57d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:51 2015 -0500

      qcow2: More helpers for refcount modification

      Add helper functions for getting and setting refcounts in a refcount
      array for any possible refcount order, and choose the correct one during
      refcount initialization.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7453c96b78c2b09aa72924f933bb9616e5474194
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:50 2015 -0500

      qcow2: Helper function for refcount modification

      Since refcounts do not always have to be a uint16_t, all refcount blocks
      and arrays in memory should not have a specific type (thus they become
      pointers to void) and for accessing them, two helper functions are used
      (a getter and a setter). Those functions are called indirectly through
      function pointers in the BDRVQcowState so they may later be exchanged
      for different refcount orders.

      With the check and repair functions using this function, the refcount
      array they are creating will be in big endian byte order; additionally,
      using realloc_refcount_array() makes the size of this refcount array
      always cluster-aligned. Both combined allow rebuild_refcount_structure()
      to drop the bounce buffer which was used to convert parts of the
      refcount array to big endian byte order and store them on disk. Instead,
      those parts can now be written directly.

      [ kwolf: Fixed a build failure on 32 bit and another with old glib ]

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5fee192efdfe2161d392491e6f68bffb406b18e1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:49 2015 -0500

      qcow2: Helper for refcount array reallocation

      Add a helper function for reallocating a refcount array, independent of
      the refcount order. The newly allocated space is zeroed and the function
      handles failed reallocations gracefully.

      The helper function will always align the buffer size to a cluster
      boundary; if storing the refcounts in such an array in big endian byte
      order, this makes it possible to write parts of the array directly as
      refcount blocks into the image file.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0e06528e980b8ac7695a219f8405d3cdc52a1381
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:48 2015 -0500

      qcow2: Use 64 bits for refcount values

      Refcounts may have a width of up to 64 bits, so qemu should use the same
      width to represent refcount values internally.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2aabe7c7a16cee6b1b54592fa05b5f9c23c89bc0
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:47 2015 -0500

      qcow2: Use unsigned addend for update_refcount()

      update_refcount() and qcow2_update_cluster_refcount() currently take a
      signed addend. At least one caller passes a value directly derived from
      an absolute refcount that should be reached ("l2_refcount - 1" in
      expand_zero_clusters_in_l1()). Therefore, the addend should be unsigned
      as well; this will be especially important for 64 bit refcounts.

      Because update_refcount() then no longer knows whether the refcount
      should be increased or decreased, it now requires an additional flag
      which specified exactly that. The same applies to
      qcow2_update_cluster_refcount().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7324c10f96c821b00d691e2c8ced67d8536bf1d6
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:46 2015 -0500

      qcow2: Only return status from qcow2_get_refcount

      Refcounts can theoretically be of type uint64_t; in order to be able to
      represent the full range, qcow2_get_refcount() cannot use a single
      variable to represent both all refcount values and also keep some values
      reserved for errors.

      One solution would be to add an Error pointer parameter to
      qcow2_get_refcount(); however, no caller could (currently) pass that
      error message, so it would have to be emitted immediately and be
      passed to the next caller by returning -EIO or something similar.
      Therefore, an Error parameter does not offer any advantages here.

      The solution applied by this patch is simpler to use. Because no caller
      would be able to pass the error message, they would have to print it and
      free it, whereas with this patch the caller only needs to pass the
      returned integer (which is often a no-op from the code perspective,
      because that integer will be stored in a variable "ret" which will be
      returned by the fail path of many callers).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6e9d8ae6629aaf3c6d483032d219b988d78583f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:45 2015 -0500

      qcow2: Do not return new value after refcount update

      qcow2_update_cluster_refcount() does not have any quick access to the
      new refcount value, it has to call qcow2_get_refcount(). Some callers do
      not need that new value at all, others call qcow2_get_refcount()
      themselves anyway (albeit in a different code path, which can however be
      easily changed), therefore there is no advantage in making
      qcow2_update_cluster_refcount() return the new value. Drop it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0709c5a1530b046183b6e96d9631affcff76c1fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:44 2015 -0500

      qcow2: Add refcount_bits to format-specific info

      Add the bit width of every refcount entry to the format-specific
      information.

      In contrast to lazy_refcounts and the corrupt flag, this should be
      always emitted, even for compat=0.10 although it does not support any
      refcount width other than 16 bits. This is because if a boolean is
      optional, one normally assumes it to be false when omitted; but if an
      integer is not specified, it is rather difficult to guess its value.

      This new field breaks some test outputs, fix them.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 346a53df38e29021e4a9e8c2a759b05744902857
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Feb 10 15:28:43 2015 -0500

      qcow2: Add two new fields to BDRVQcowState

      Add two new fields regarding refcount information (the bit width of
      every entry and the maximum refcount value) to the BDRVQcowState.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a6ed700061fdd86b3c4b71366be42503ac2ce23
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:55 2015 +0100

      libqos: Add virtio MMIO support

      Add virtio MMIO support.
      Add virtio-blk-test MMIO test case.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-6-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 870a306dec0cfdf32c8179acfd2c4d0bfd000d6b
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:54 2015 +0100

      libqos: Add malloc generic

      This malloc is a basic interface implementation that works for any platform.
      It should be replaced in the future for a real malloc implementation for each
      of the platforms.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-5-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 50311a81f812d234ed0782df7a09971978e226a5
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:53 2015 +0100

      libqos: Remove PCI assumptions in constants of virtio driver

      Convert PCI-specific constants names of libqos virtio driver.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-4-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 38d8364f4f9388b9f3a593d2664d019cf6c72b38
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:52 2015 +0100

      tests: Prepare virtio-blk-test for multi-arch implementation

      Modularize functions in virtio-blk-test and add PCI suffix for PCI specific
      components.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-3-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 728312b8c81564e437902aeca9f51fdb1e7c52b6
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Tue Feb 24 22:21:51 2015 +0100

      libqos: Change use of pointers to uint64_t in virtio

      Convert use of pointers in functions of virtio to uint64_t in order to make it
      platform-independent.

      Add casting from pointers (in PCI functions) to uint64_t and vice versa through
      uintptr_t.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1424812915-25728-2-git-send-email-marc.mari.barcelo@gmail.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a209f4615c6853a226e847810b6c607c71b6a046
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Feb 17 17:55:53 2015 +0800

      virtio-blk: Check return value of blk_aio_ioctl

      Since commit 1dc936aa84 (virtio-blk: Use blk_aio_ioctl) we silently lose
      the request if blk_aio_ioctl returns NULL (not implemented).

      Fix it by directly returning VIRTIO_BLK_S_UNSUPP as we used to do.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

      [ kwolf: Fixed build error on win32 ]

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8437f7be3b1c49631e435c652707f2cee477149d
  Merge: 277263e 438940c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 10 11:44:59 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-03-04' into staging

      trivial patches for 2015-03-04

      # gpg: Signature made Tue Mar 10 05:16:59 2015 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-03-04: (44 commits)
        9pfs: remove useless return
        gdbstub: avoid possible NULL pointer dereference
        milkymist-pfpu: fix GCC 5.0.0 aggressive-loop-optimizations warning
        fix GCC 5.0.0 logical-not-parentheses warnings
        migration: Fix coding style (whitespace issues)
        oslib-posix: Fix compiler warning (-Wclobbered) and simplify the code
        disas/microblaze: Fix warnings caused by missing 'static' attribute
        disas/arm: Fix warnings caused by missing 'static' attribute
        vhost_net: Add missing 'static' attribute
        e500: fix memory leak
        gitignore: Ignore new tests
        gitignore: Track common.env in iotests gitignore
        sysbus: fix memory leak
        milkymist.c: fix memory leak
        macio: fix possible memory leak
        sparc/leon3.c: fix memory leak
        nbd: fix resource leak
        qemu-char: add cyrillic key 'numerosign' to Russian keymap
        qemu-char: add cyrillic characters 'numerosign' to VNC keysyms
        qapi-schema: Fix SpiceChannel docs
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b57489cfe48f9fedc10205c0494f144085733f30
  Author: Jorge Acereda Maciá <jacereda@gmail.com>
  Date:   Thu Feb 26 00:21:39 2015 +0100

      Fix crash when connecting to VNC through websocket

      Connecting to VNC through websocket crashes in vnc_flush() when trying
      to acquire a mutex that hasn't been initialized (vnc_init_state(vs)
      hasn't been called at this point).

      Signed-off-by: Jorge Acereda Macia <jacereda@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 006decd448ae3ce04f12e2bbdd3079ba74d25c89
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 08:45:06 2015 +0100

      vnc: -readconfig fix

      Now that -vnc goes through QemuOpts we can get vnc configuration
      via -readconfig too.  So setting display_remote in the command
      line parsing code doesn't cut it any more, we must check QemuOpts
      instead to see whenever any vnc display is configured.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9634f4e3b721f75f9ba4c87fe1499d5e95fc63ca
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Feb 17 09:28:17 2015 +0100

      vnc: set id at parse time not init time

      This way the generated id will be stored in -writeconfig cfg files.
      Also we can make vnc_auto_assign_id() local to vnc.c.

      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ac57622985220de064059971f9ccb00905e9bd04
  Author: Bill Paul <wpaul@windriver.com>
  Date:   Mon Mar 9 15:48:01 2015 -0700

      x86: fix SS selector in SYSRET

      According to my reading of the Intel documentation, the SYSRET instruction
      is supposed to force the RPL bits of the %ss register to 3 when returning
      to user mode. The actual sequence is:

      SS.Selector <-- (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *)

      However, the code in helper_sysret() leaves them at 0 (in other words, the "OR
      3" part of the above sequence is missing). It does set the privilege level
      bits of %cs correctly though.

      This has caused me trouble with some of my VxWorks development: code that runs
      okay on real hardware will crash on QEMU, unless I apply the patch below.

      Signed-off-by: Bill Paul <wpaul@windriver.com>
      Message-Id: <201503091548.01462.wpaul@windriver.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae071cc851d7150d3a9950c642570830bb85729e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:28 2015 +0100

      scsi: Convert remaining PCI HBAs to realize()

      These are "am53c974", "dc390", "lsi53c895a", "lsi53c810", "megasas",
      "megasas-gen2".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-5-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 390e90a90736f98ca47f2e767d7f2a15d68d6bc4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:27 2015 +0100

      scsi: Improve error reporting for invalid drive property

      When setting "realized" fails, scsi_bus_legacy_add_drive() passes the
      error to qerror_report_err(), then returns an unspecific "Setting
      drive property failed" error, which is reported further up the call
      chain.

      Example:

          $ qemu-system-x86_64 -nodefaults -S -display none \
          > -drive if=scsi,id=foo,file=tmp.qcow2 -global isa-fdc.driveA=foo
          qemu-system-x86_64: -drive if=scsi,id=foo,file=tmp.qcow2: Property 'scsi-disk.drive' can't take value 'foo', it's in use
          qemu-system-x86_64: Setting drive property failed
          qemu-system-x86_64: Initialization of device lsi53c895a failed: Device initialization failed

      Clean up the obvious way: simply return the original error to the
      caller.  Gets rid of the second message in the above error cascade.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-4-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9b3d111ad90886546614b2579eedcb4675b35d14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:26 2015 +0100

      hw: Propagate errors through qdev_prop_set_drive()

      Three kinds of callers:

      1. On failure, report the error and abort

         Passing &error_abort does the job.  No functional change.

      2. On failure, report the error and exit()

         This is qdev_prop_set_drive_nofail().  Error reporting moves from
         qdev_prop_set_drive() to its caller.  Because hiding away the error
         in the monitor right before exit() isn't helpful, replace
         qerror_report_err() by error_report_err().  Shouldn't make a
         difference, because qdev_prop_set_drive_nofail() should never be
         used in QMP context.

      3. On failure, report the error and recover

         This is usb_msd_init() and scsi_bus_legacy_add_drive().  Error
         reporting and freeing the error object moves from
         qdev_prop_set_drive() to its callers.

         Because usb_msd_init() can't run in QMP context, replace
         qerror_report_err() by error_report_err() there.

         No functional change.

         scsi_bus_legacy_add_drive() calling qerror_report_err() is of
         course inappropriate, but this commit merely makes it more obvious.
         The next one will clean it up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-3-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit fa617181839741727d0067ea68807133f498f29b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Mar 9 19:17:25 2015 +0100

      scsi: Clean up duplicated error in legacy if=scsi code

      Commit a818a4b changed scsi_bus_legacy_handle_cmdline() to report
      errors from scsi_bus_legacy_add_drive() with error_report() in
      addition to returning them.  That's inappropriate.

      Two kinds of callers:

      1. realize methods (devices "esp", "virtio-scsi-device" and
         "spapr-vscsi")

         The error object gets passed up the call chain until it gets
         reported again and freed.

         Example:

         $ qemu-system-arm -M virt -S -display none \
         > -drive if=scsi,id=foo,bus=1,file=tmp.qcow2 \
         > -device nec-usb-xhci -device usb-storage,drive=foo \
         > -device virtio-scsi-pci
         qemu-system-arm: -drive if=scsi,id=foo,bus=1,file=tmp.qcow2: Property 'scsi-disk.drive' can't take value 'foo', it's in use
         qemu-system-arm: -drive if=scsi,id=foo,bus=1,file=tmp.qcow2: Setting drive property failed
         qemu-system-arm: -device virtio-scsi-pci: Setting drive property failed
         qemu-system-arm: -device virtio-scsi-pci: Device initialization failed
         qemu-system-arm: -device virtio-scsi-pci: Device 'virtio-scsi-pci' could not be initialized

         The second message in this error cascade comes from
         scsi_bus_legacy_handle_cmdline().  The error object then gets
         passed up to the qdev_init() called from
         virtio_scsi_pci_init_pci(), which reports it again.

      2. init methods (devices "am53c974", "dc390", "lsi53c895a",
         "lsi53c810", "megasas", "megasas-gen2")

         init methods need to report their errors with qerror_report().
         These don't.  The inappropriate error_report() papers over the bug.

         error_report() isn't the same as qerror_report() in QMP context,
         but this can't actually happen: QMP can still only hot-plug, and
         callers call scsi_bus_legacy_handle_cmdline() only on cold-plug.
         Except for sysbus_esp_realize(), but that can't be hot-plugged at
         all, as far as I can tell.

      Fix the init methods and drop the inappropriate error_report() in
      scsi_bus_legacy_handle_cmdline().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425925048-15482-2-git-send-email-armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cba7054928b10a7fda57c64807451bbc9a31e42e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 9 15:28:37 2015 +0100

      cpus: initialize cpu->memory_dispatch

      This fixes a NULL pointer dereference in s390x-softmmu.

      On pretty much all other architectures, creating an MMIO region calls
      cpu_reload_memory_map.  On s390, however, there are no MMIO regions
      and everything is done via hypercalls.

      Fixes: 9d82b5a792236db31a75b9db5c93af69ac07c7c5
      Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 21b7cf9e07e5991c57b461181cfb5bbb6fe7a9d6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 5 16:53:48 2015 +0100

      rcu: handle forks safely

      After forking, only the calling thread is duplicated in the child process.
      The call_rcu thread has to be recreated in the child.  Exploit the fact
      that only one thread exists (same as when constructors run), and just redo
      the entire initialization to ensure the threads are in the proper state.

      The only additional things to do are emptying the list of threads
      registered with RCU, and unlocking the lock that was taken in the prepare
      callback (implementations are allowed to fail pthread_mutex_init()
      if the mutex is still locked).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 24fa90499f8b24bcba2960a3316d797f9b80b5e9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Mar 5 16:47:14 2015 +0100

      qemu-thread: do not use PTHREAD_MUTEX_ERRORCHECK

      PTHREAD_MUTEX_ERRORCHECK is completely broken with respect to fork.
      The way to safely do fork is to bring all threads to a quiescent
      state by acquiring locks (either in callers---as we do for the
      iothread mutex---or using pthread_atfork's prepare callbacks)
      and then release them in the child.

      The problem is that releasing error-checking locks in the child
      fails under glibc with EPERM, because the mutex stores a different
      owner tid than the duplicated thread in the child process.  We
      could make it work for locks acquired via pthread_atfork, by
      recreating the mutex in the child instead of unlocking it
      (we know that there are no other threads that could have taken
      the mutex; but when the lock is acquired in fork's caller
      that would not be possible.

      The simplest solution is just to forgo error checking.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 811c5727765eba00824c29a696350d4780d86c19
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 2 17:29:07 2015 -0600

      kvm_stat: add kvm_stat.1 man page

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Ademar Reis <areis@redhat.com>
      Reviewed-by: Wei Huang <wei@redhat.com>
      Message-Id: <1425338947-10296-3-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9a7dcb711bdaf4082bf333dbecfeb729bbff1f8e
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Mar 2 17:29:06 2015 -0600

      kvm_stat: add column headers to text UI

      The curses user interface shows both the accumulated total and the
      current event counts.  Add column headers so it's clear what the numbers
      mean.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Ademar Reis <areis@redhat.com>
      Reviewed-by: Wei Huang <wei@redhat.com>
      Message-Id: <1425338947-10296-2-git-send-email-stefanha@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 532cee4184877053398a2bdae4edc965084fc79e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 10:14:30 2015 +0100

      iscsi: Fix check for username

      The variable user in struct iscsi_url is a character array, not a pointer.
      Therefore its address will never be NULL.

      clang reports this error:

      block/iscsi.c:1329:20: warning:
       comparison of array 'iscsi_url->user' not equal to a null pointer
       is always true [-Wtautological-pointer-compare]

      Reviewed-by: Peter Lieven <pl@kamp.de>
      Acked-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Message-Id: <1425719670-5486-1-git-send-email-sw@weilnetz.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f3b18f35a23c60edbda6420cd4bd30b8bb11ea80
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      sun4u: switch m48t59 NVRAM to MMIO access

      Real sun4u systems memory-map the NVRAM on the (ISA) ebus, so switch over to
      MMIO from ioport access whilst setting the base year to 1968 as used by Sun
      systems. This allows all SPARC64 OSs included in my tests to correctly detect
      the NVRAM IC and read the hardware clock correctly upon boot.

      Note that this also requires a corresponding OpenBIOS update to r1330 in order
      to switch the SPARC64 NVRAM accessors over from ioport to MMIO.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit f2416d3ae4d38a078f0ff7662b26bed9b61f8096
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      MAINTAINERS: add myself as SPARC maintainer

      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 9bb9f217f56b678f3ad2bddeb9894880ae0320b7
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      doc: minor updates to SPARC32 and SPARC64 documentation

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 0278377dde6a5a845e886567c1e68a77766a89b1
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: add m48t59 sysbus device

      This is for subsequent use by the sun4u machine.

      Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 6de0497385cbbbbd5f20ca712389b3691ea5c96d
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: introduce new base-year qdev property

      Currently the m48t59 device uses the hardware model in order to determine
      whether the year value is offset from the hardware value. As this will
      soon be required by the x59 model, create a qdev base-year property to
      represent the base year and update the callers appropriately.

      Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 3168824682058457344faecdbe7014caa0e8dd6e
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: let init functions return a Nvram object

      Remove left-overs from header file.
      Move some functions only used by PReP to hw/ppc/prep.c

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 43745328881e839124d3d589644732cb65052819
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: add a Nvram interface

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 051ddccde29924cb200df3bca3db8c1a2aa10974
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: register a QOM type for each nvram type we support

      As m48t59 devices can only be created with m48t59_init() or m48t59_init_isa(),
      we know exactly which nvram types are required. Register only those three
      types.

      Remove .model and .size properties as they can be infered from nvram name.

      Rename type to 'isa-*' (and 'sysbus-*') to do like other devices ISA devices
      (isa-ide, isa-parallel, isa-serial...)

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 72cd63f817d5405f7f7339e3d389cee73c189b33
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Mon Mar 2 22:23:27 2015 +0000

      m48t59: move ISA ports/memory regions registration to QOM constructor

      -device m48t59_isa can now be used to create a fully functional nvram.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      CC: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 5dce07e1cb67aab265b16e39b0b9d812199a4d22
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Mar 9 11:12:52 2015 +0100

      elf-loader: Provide the possibility to relocate s390 ELF files

      On s390, we would like to load our "BIOS" s390-ccw.img to the end of the
      RAM. Therefor we need the possibility to relocate the ELF file so that
      it can also run from different addresses. This patch adds the necessary
      code to the QEMU ELF loader function.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Message-Id: <1425895973-15239-2-git-send-email-thuth@linux.vnet.ibm.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5c8d542004b7474560bc4cb017d597ea320bd4ac
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:27:09 2015 +0100

      s390-ccw.img: Reinitialize guessing on reboot

      guessed_disk_nature is a static zero variable. As the QEMU ELF
      loader does not zero the BSS section, lets do it explicitely here.

      This fixes reboot for some corner cases (like FCP flash
      devices with logical_block_size=512, physical_block_size=4096)

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Eugene (jno) Dvurechenski <jno@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1425310029-53396-3-git-send-email-borntraeger@de.ibm.com>

  commit 2be9d2927cca76d8475f0083e9ecc87baf1b8222
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:27:08 2015 +0100

      s390-ccw.img: Allow bigger ramdisk sizes or offsets

      The s390-ccw bios creates the the virtqueue at 100MB. For
      big ramdisks or offsets (via zipl) this gets overwritten.
      As a quick band-aid, lets move the virtqueue into the bss
      section, which is at 0x7f00000. As the bios code (text) is
      at 0x7e00000 we can now handle ramdisk which are  ~27MB
      bigger.

      Long term we want to make the s390-ccw bios position
      independent and load of at the end of memory.

      Reported-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Message-Id: <1425310029-53396-2-git-send-email-borntraeger@de.ibm.com>

  commit a310b283e357b54533c8168a92e8f1068efdc4d1
  Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
  Date:   Thu Mar 5 16:56:21 2015 +0100

      s390x/kvm: passing max memory size to accelerator

      With "KVM: s390: Allow userspace to limit guest memory size" KVM is able to
      do some optimizations based on the guest memory limit.

      The guest memory limit is computed by the initial definition and with the notion of
      hotplugged memory.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Guenther Hutzl <hutzl@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Message-Id: <1425570981-40609-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5e5ced386a4ae74e406453dd5a7927936b1911aa
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:53:39 2015 +0100

      virtio-ccw: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045219-19958-1-git-send-email-armbru@redhat.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f35dd5665142022ae9e8c2749db774da275549c2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:55:37 2015 +0100

      virtio-s390: Convert to realize()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045337-20138-3-git-send-email-armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3e300d24c4131060c6b3d3e20c890eb92f18597
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 14:55:36 2015 +0100

      virtio-s390: s390_virtio_device_init() can't fail, simplify

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-Id: <1425045337-20138-2-git-send-email-armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f16d3f58748acff4c23f9149c3261844b4d595d5
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:31 2015 +0100

      s390x/kvm: enable the new SIGP handling in user space

      All required SIGP handlers have been implemented in QEMU.

      Let's enable the new sigp handling in user space if the kernel supports it.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-11-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3b7b57807b5820e21555b711726e6abb1a4050f
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:30 2015 +0100

      s390x/kvm: deliver SIGP RESTART directly if stopped

      According to the PoP, a restart irq has to be delivered "without first honoring
      any other pending interruptions", if a cpu is in the STOPPED state.

      While it is hard to implement this case in kvm, it can easily be handled in qemu.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-10-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 3f10341ffbbf4271485c32ca96a75d99d1b6bf6d
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:29 2015 +0100

      s390x: add function to deliver restart irqs

      This patch adds a helper function to deliver restart irqs. To be able to be used
      by kvm, the psw load/store methods have to perform special cc-code handling only
      when running with tcg.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-9-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 4f2b55d18413ba09f8a4367a670192e46e967fc0
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:28 2015 +0100

      s390x/kvm: SIGP START is only applicable when STOPPED

      In preparation for other CPU states, SIGP START will only start a VCPU if it is
      in the STOPPED state.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-8-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 18ff949474cfbba892fdc34aa6ed7558afc78c5c
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:27 2015 +0100

      s390x/kvm: implement handling of new SIGP orders

      This patch adds handling code for the following SIGP orders:
      - SIGP SET ARCHITECTURE
      - SIGP SET PREFIX
      - SIGP STOP
      - SIGP STOP AND STORE STATUS
      - SIGP STORE STATUS AT ADDRESS

      SIGP STOP (AND STORE STATUS) are the only orders that can stay pending forever
      (and may only be interrupted by resets), so special care has to be taken about
      them. Their status also has to be tracked within QEMU. This patch takes
      care of migrating this status (e.g. if migration happens during a SIGP STOP).

      Due to the BQL, only one VCPU is currently able to execute SIGP handlers at a
      time. According to the PoP, BUSY should be returned if another SIGP order is
      currently being executed on a VCPU. This can only be implemented when the BQL
      does not protect all handlers. For now, all SIGP orders on all VCPUs will be
      serialized, which will be okay for the first shot.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-7-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 56dba22b7dc1c41ff7dca6593080a99bcca74b5c
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:26 2015 +0100

      s390x/kvm: trace all SIGP orders

      This patch adds tracing code for all SIGP orders (including the destination
      vcpu and the resulting condition code).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-6-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 36b5c84556f38421c43ee4ff213f7ab64fd66a51
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:25 2015 +0100

      s390x/kvm: helper to set the SIGP status in SigpInfo

      Whenever we set the SIGP status in the status register, we have to wipe out
      the lower 4 bytes and keep the higher 4 bytes. Also the condition code will
      always be set to STATUS_STORED.

      Let's introduce the wrapper for SigpInfo, as this will avoid most duplicate
      code in the future.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-5-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 22740e3fc0856b2b6e66c91056a7026f87f51482
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:24 2015 +0100

      s390x/kvm: pass the SIGP instruction parameter to the SIGP handler

      The parameter of the SIGP instruction will be neded in the future. Let's read it
      out and store it in the struct sigp_info, so it can be passed to the sigp
      handlers.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-4-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 6eb8f212d2686ed9b17077d554465df7ae06f805
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:23 2015 +0100

      s390x/kvm: more details for SIGP handler with one destination vcpu

      Whenever a sigp order is to be executed by a target vcpu, we use run_on_cpu().
      As we have only one pointer to pass all data to these sigp handlers, let's
      introduce the struct sigp_info and use it as a transport container.

      All orders targeting a single vcpu are now  dispatched from a separate
      handler. The destination vcpu is only valid for these orders and must not be
      checked for SIGP SET ARCHITECTURE.

      The sigp_info is filled with life in this new handler and used to pass the
      information about the sigp order to the existing handlers. The cc is set
      within these handlers.

      Rename sigp_cpu_start() and sigp_cpu_restart() on the way to match the SIGP
      order names (in order to avoid touching affected lines several times).

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-3-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5172b780c5d2e37ae0a2b48813fda0e54ea15c38
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Tue Feb 24 14:15:22 2015 +0100

      s390x: introduce defines for SIGP condition codes

      This patch introduces defines for the SIGP condition codes and replaces all
      occurrences of numeral condition codes with the new defines.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Message-Id: <1424783731-43426-2-git-send-email-jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 51628b1898b6bc15306e5c831962f858c2b48eb5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Mon Mar 2 16:13:59 2015 +0100

      synchronize Linux headers to 4.0-rc3

      synchronize linux headers up to
      commit 9eccca0843205f87c ("Linux 4.0-rc3")

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 438940cbc2eabbe9e403e5249dfa0be6c792c93b
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Wed Mar 4 20:03:41 2015 +0300

      9pfs: remove useless return

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3d0f44189178aab3a21a33ecf6a113b9abaea2bc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Mar 2 13:26:58 2015 +0100

      gdbstub: avoid possible NULL pointer dereference

      Coverity reports that s->chr is checked after put_packet dereferences it.
      Move the check earlier, consistent with the code used for user-mode
      emulation.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c6dc3dd72b747a057770087998a1f9ef0b3f1882
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Feb 20 17:06:16 2015 +0100

      milkymist-pfpu: fix GCC 5.0.0 aggressive-loop-optimizations warning

      man gcc:
        Warn if in a loop with constant number of iterations the compiler
        detects undefined behavior in some statement during one or more of
        the iterations.

      Milkymist pfpu has no jump instructions, so checking for MICROCODE_WORDS
      instructions should have kept us in bounds of s->microcode, but i++
      allowed one loop too many,

        hw/misc/milkymist-pfpu.c: In function ‘pfpu_write’:
        hw/misc/milkymist-pfpu.c:365:20: error: loop exit may only be reached after undefined behavior [-Werror=aggressive-loop-optimizations]
                         if (i++ >= MICROCODE_WORDS) {
                            ^
        hw/misc/milkymist-pfpu.c:167:14: note: possible undefined statement is here
             uint32_t insn = s->microcode[pc];
                      ^

      The code can still access out of bounds, because it presumes that PC register
      always begins at 0, and we allow writing to it.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Acked-by: Michael Walle <michael@walle.cc>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8c1ac475e30091ba77a075d5e2136ece4f7c9cd0
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Fri Feb 20 17:06:15 2015 +0100

      fix GCC 5.0.0 logical-not-parentheses warnings

      man gcc:
        Warn about logical not used on the left hand side operand of a
        comparison.  This option does not warn if the RHS operand is of a
        boolean type.

      By preferring bool over int where sensible, but without modifying any
      depending code, make GCC happy in cases like this,
        qemu-img.c: In function ‘compare_sectors’:
        qemu-img.c:992:39: error: logical not is only applied to the left hand
        side of comparison [-Werror=logical-not-parentheses]
                 if (!!memcmp(buf1, buf2, 512) != res) {

      hw/ide/core.c:1836 doesn't throw an error,
        assert(!!s->error == !!(s->status & ERR_STAT));
      even thought the second operand is int (and first hunk of this patch has
      a very similar case), maybe GCC developers still have a little faith in
      C programmers.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 02942db7982541716131ca486ca0d59eae107553
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:09:41 2015 +0100

      migration: Fix coding style (whitespace issues)

      * Remove trailing whitespace (fixes 9 errors from checkpatch.pl).
        One comment line was longer than 80 characters, so wrap it
        and fix a typo, too.
      * Replace tabs by blanks (fixes 1 error).

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2a0457bbba10c208358e4e52642abeadd5f10c33
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 13:52:06 2015 +0100

      oslib-posix: Fix compiler warning (-Wclobbered) and simplify the code

      gcc reports this warning with -Wclobbered:

      util/oslib-posix.c: In function ‘os_mem_prealloc’:
      util/oslib-posix.c:374:49: error: argument ‘memory’ might be clobbered by
       ‘longjmp’ or ‘vfork’ [-Werror=clobbered]

      Fix this and simplify the code by using an existing macro.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52b831de0099e627ee3505cb1c0c3d8eeefd3d65
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 14:18:35 2015 +0100

      disas/microblaze: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      disas/microblaze.c:289:3: warning:
       symbol 'opcodes' was not declared. Should it be static?
      disas/microblaze.c:570:6: warning:
       symbol 'register_prefix' was not declared. Should it be static?
      disas/microblaze.c:571:6: warning:
       symbol 'special_register_prefix' was not declared. Should it be static?
      disas/microblaze.c:572:6: warning:
       symbol 'fsl_register_prefix' was not declared. Should it be static?
      disas/microblaze.c:573:6: warning:
       symbol 'pvr_register_prefix' was not declared. Should it be static?

      Remove the unused variable special_register_prefix.
      The variable pvr_register_prefix was unused, too, but can be used.
      Add also 'const' where possible.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 35ff0798130b654a866dc4c944e8bf45575ad990
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Mar 1 14:05:51 2015 +0100

      disas/arm: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      disas/arm.c:1552:15: warning:
       symbol 'last_type' was not declared. Should it be static?
      disas/arm.c:1553:5: warning:
       symbol 'last_mapping_sym' was not declared. Should it be static?
      disas/arm.c:1554:9: warning:
       symbol 'last_mapping_addr' was not declared. Should it be static?

      Instead of adding 'static', the unused variables and the unused code which
      refers to those variables (which was deactivated a long time ago in
      commit 4b0f1a8b) are removed.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d122f1a254abb91e42b4f2b2e1f8ee8980785e68
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Feb 28 19:19:17 2015 +0100

      vhost_net: Add missing 'static' attribute

      This fixes a warning from smatch.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2343dd11a673597aa59813fd0cac2ae42e2e0312
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Sat Feb 28 20:27:43 2015 +0300

      e500: fix memory leak

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>

  commit acff77b1ea90366143cb16d6fb1840e5d43b6633
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Fri Feb 27 10:21:22 2015 -0500

      gitignore: Ignore new tests

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 08156b4c34c2083552dcade929f1b8ad436678ad
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Fri Feb 27 10:21:21 2015 -0500

      gitignore: Track common.env in iotests gitignore

      Rather than track it in the toplevel gitignore

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 84b5d556dc29c06402783e98ee0eaa3369eb48e1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:18 2015 +0800

      sysbus: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c2c17a245127cb456840e8dd9db9efc20a71e526
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:17 2015 +0800

      milkymist.c: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6c5819c4d685bf5f3c81edb462f4d17fb99ca2b5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:14 2015 +0800

      macio: fix possible memory leak

      If ret = macio_initfn_ide() is less than 0, the timer_memory
      will leak the memory it points to.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d71cdbfd540d91a6ae0005e59abfd782c424b07a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:13 2015 +0800

      sparc/leon3.c: fix memory leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9d0b65e6e8f255dd86630a6873b3859fb6a5477f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 15:50:11 2015 +0800

      nbd: fix resource leak

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3e4c67c9ce1eafe374f3070499d25ddeffb9f3ca
  Author: Wang Xin <wangxinxin.wang@huawei.com>
  Date:   Sat Feb 28 16:33:23 2015 +0800

      qemu-char: add cyrillic key 'numerosign' to Russian keymap

      numero sign is the number sign key of Russian keyboard layout, we
      get this key with 'shift + 3'. It's missing in current Russian keymap file,
      this patch fixes it.
      As number sign does not exsit in Russian keyboard layout[1][2], this
      patch also removes the 'numbersign' from Russian keymap.

      [1] http://en.wikipedia.org/wiki/Keyboard_layout#Russian
      [2] http://kbd-intl.narod.ru/english/layouts

      Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 09f4fbe47314c2f13f16bf081997611f7f4251ea
  Author: Wang Xin <wangxinxin.wang@huawei.com>
  Date:   Sat Feb 28 16:33:22 2015 +0800

      qemu-char: add cyrillic characters 'numerosign' to VNC keysyms

      This patch adds missing cyrillic character 'numerosign' to the VNC
      keysym table, it's needed by Russian keyboard. And I get the keysym from
      '<X11/keysymdef.h>', the current keysym table in Qemu was generated from
      it.

      Signed-off-by: Wang xin <wangxinxin.wang@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7e781c79449ec2b3b649712c85610b147e3d41ee
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Thu Feb 26 13:59:58 2015 -0500

      qapi-schema: Fix SpiceChannel docs

      The value is called channel-type, not connection-type

      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 611af7fdb65759193c357e7d415feabad21e3b74
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:08 2015 +0100

      xen: Remove xen_cmos_set_s3_resume()

      The function is not used anymore, and thus can be deleted.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 09526058d0a501106dcac842a455e187f1413d98
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:07 2015 +0100

      ui/vnc: Remove vnc_stop_worker_thread()

      This function is not used anymore, let's remove it.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b67072f0aba5837870163116da398005969495df
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 26 14:28:06 2015 +0100

      ui: Removed unused functions

      Remove qemu_console_displaystate(), qemu_remove_kbd_event_handler(),
      qemu_different_endianness_pixelformat() and cpkey(), since they are
      completely unused.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c65476612aa4842785939fa3fbea2123cc980c75
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:37 2015 +0800

      vhost: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d448527a4f19979f7005949025796121bdfdfa61
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:36 2015 +0800

      arm/digic_boards: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 27215a22ddade35e83cc8bb4f49a5bd91b98ca19
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:35 2015 +0800

      tpm: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ebbb419aa290dad2f8eb840398f5e87db0bad3a5
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:34 2015 +0800

      xtensa: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 78e5b17f0495acf19a8e7830018e95e759504a51
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:33 2015 +0800

      vfio: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit f6a16175962db8b2c7bd23374d5c138ef0171dcc
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:32 2015 +0800

      vhost-scsi: Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 81b07353c5e7ae9ae9360c357b7b4732b1cb03b4
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:31 2015 +0800

      Remove superfluous '\n' around error_report()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 01bbbcf41fbd6a3b8d58a9a09e257f5ab1797f1d
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:30 2015 +0800

      numa: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0c267a6b40e8a85d3a6dacee853531d1e98da122
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:29 2015 +0800

      pl330.c: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 15e10b3499782df5d2adc0d2941e445a67d78a8a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:28 2015 +0800

      a9gtimer: remove superfluous '\n' around error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit eec5eb42f597e652ad3b32d7bf13252966c4e85e
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Feb 25 12:22:27 2015 +0800

      block: remove superfluous '\n' around error_report/error_setg

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3599d46ba23062df580a23a50f8c103070d7365d
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Feb 26 16:35:07 2015 +0200

      qmp-commands.hx: Fix several typos

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5b7a580f1f2d9ca04cf77d33515b29a149c01f1f
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Fri Feb 20 14:58:23 2015 +0200

      qerror.h: Swap definitions that were not in alphabetical order

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 826a7cd9d94427aa72ff03f109632e48cf5f26ec
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:17:34 2015 -0500

      Add copyright and author after file split

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Reviewed-by:  Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit cc5d0e04ee313d0ceee5d8e4e697142eaf240dca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 12:30:43 2015 +0100

      cutils: refine strtol error handling in parse_debug_env

      Avoid truncation of a 64-bit long to a 32-bit int, and check for errno
      (especially ERANGE).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7c601803fb5f868a05ef762eebcc32bdfd1ebfdc
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Tue Feb 10 22:40:47 2015 +0300

      qemu-options: fix/document -incoming options

      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b155eb1d0409eff4d0e7f33c746c81434f0ea629
  Author: Gabriel L. Somlo <gsomlo@gmail.com>
  Date:   Thu Feb 5 11:45:30 2015 -0500

      smbios: document cmdline options for smbios type 2-4, 17 structures

      Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0dc9daf0be2a4ebb3c6529d1c458d8ccf26cd412
  Author: Borislav Petkov <bp@suse.de>
  Date:   Sun Feb 8 13:14:38 2015 +0100

      memsave: Improve and disambiguate error message

      When requesting a size which cannot be read, the error message shows
      a different address which is misleading to the user and it looks like
      something's wrong with the address parsing. This is because the input
      @addr variable is incremented in the memory dumping loop:

      (qemu) memsave 0xffffffff8418069c 0xb00000 mem
      Invalid addr 0xffffffff849ffe9c specified

      Fix that by saving the original address and size and use them in the
      error message:

      (qemu) memsave 0xffffffff8418069c 0xb00000 mem
      Invalid addr 0xffffffff8418069c/size 11534336 specified

      Signed-off-by: Borislav Petkov <bp@suse.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 31da45ce04c5e886369bf88bf727cef5ccb3b12b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 21 14:18:37 2015 +0100

      xilinx_ethlite: Clean up after commit 2f991ad

      The "fall through" added by the commit is clearly intentional.  Mark
      it so.  Hushes up Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 14cec170ea4724e6881ba2febb20e88a942e52d3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 10 15:51:23 2015 +0800

      xen-pt: fix Out-of-bounds read

      The array length of s->real_device.io_regions[] is
      "PCI_NUM_REGIONS - 1".

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d4cd45028898a37afb45fb449954115b4960d4e9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 10 15:51:22 2015 +0800

      xen-pt: fix Negative array index read

      Coverity spot:
      Function xen_pt_bar_offset_to_index() may return a negative
      value (-1) which is used as an index to d->io_regions[] down
      the line.

      Let's pass index directly as an argument to
      xen_pt_bar_reg_parse().

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9886e834f47adabdbfd54ab606788ce7326e6779
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:31:11 2014 -0200

      target-i386: Require APIC ID to be explicitly set before CPU realize

      On softmuu, instead of setting APIC ID automatically when creating a
      X86CPU, require the property to be set before realizing the object
      (which is already done by the CPU creation code on PC).

      Keep apic_id = 0 by default on *-user so it can simply create a new CPU
      object and realize it without extra steps (so target-i386 will be able
      to use cpu_generic_init() eventually).

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 54a402930ac6d1a9d6d402229ae8ba8bef7e598e
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:43:35 2014 -0200

      target-i386: Move APIC ID compatibility code to pc.c

      The APIC ID compatibility code is required only for PC, and now that
      x86_cpu_initfn() doesn't use x86_cpu_apic_id_from_index() anymore, that
      code can be moved to pc.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7e72a45c99fccfe5586d7c4e2f7441f28e24e450
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:20:10 2014 -0200

      target-i386: Move CPUX86State::cpuid_apic_id to X86CPU::apic_id

      The field doesn't need to be inside CPUX86State, and it is not specific
      for the CPUID instruction, so move and rename it.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 0f4b210e504d7db42b96882e94481f444e420fe3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Mar 3 22:54:03 2015 -0300

      target-i386: Remove unused APIC ID default code

      The existing apic_id = cpu_index code has no visible effect: the PC code
      already initializes the APIC ID according to the topology on
      pc_new_cpu(), and linux-user memcpy()s the CPU state (including
      cpuid_apic_id) on cpu_copy().

      Remove the dead code and simply let APIC ID to to be 0 by default. This
      doesn't change behavior of PC because apic-id is already explicitly set,
      and doesn't affect linux-user because APIC ID was already always 0.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 5eb2f7a4df03b53f7eaf56d2dd53d75328909826
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:57:50 2015 -0200

      target-i386: Eliminate unnecessary get_cpuid_vendor() function

      The function was used in only two places. In one of them, the function
      made the code less readable by requiring temporary te[bcd]x variables.
      In the other one we can simply inline the existing code.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8c3329e50ad74245acbea89bdaa8af12ecf4972c
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:48:55 2015 -0200

      target-i386: Simplify listflags() function

      listflags() had lots of unnecessary complexity. Instead of printing to a
      buffer that will be immediately printed, simply call the printing
      function directly. Also, remove the fbits and flags arguments that were
      always set to the same value. Also, there's no need to list the flags in
      reverse order.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 869b7649b534b51dd9e6ddbbdeb7397e083f527f
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:41:06 2014 -0200

      target-i386: Move topology.h to include/hw/i386

      This will allow the PC code to use the header, and lets us eliminate the
      QEMU_INCLUDES hack inside tests/Makefile.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 277263e1b320d759a760ba6c5ea75ec268f929e5
  Merge: 0048fa6 a9ab06d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 9 14:04:14 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-03-09

      This is my current patch queue for 2.3. Highlights include:

        * pseries: 2.3 machine
        * pseries: Export RTC via QOM
        * pseries: EEH support
        * mac: save/restore support
        * fix POWER5 hosts
        * random bug fixes

      # gpg: Signature made Mon Mar  9 14:00:53 2015 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (38 commits)
        target-ppc: Fix warnings from Sparse
        sPAPR: Implement sPAPRPHBClass EEH callbacks
        sPAPR: Implement EEH RTAS calls
        target-ppc: Add versions to server CPU descriptions
        PPC: Introduce the Virtual Time Base (VTB) SPR register
        PPC: Remove duplicate OPENPIC defines in default-configs
        ppc64-softmmu: Remove duplicated OPENPIC from config
        Revert "default-configs/ppc64: add all components of i82378 SuperIO chip used by prep"
        spapr_vio: Convert to realize()
        openpic: convert to vmstate
        openpic: switch IRQQueue queue from inline to bitmap
        openpic: fix up loadvm under -M mac99
        openpic: fix segfault on -M mac99 savevm
        target-ppc: force update of msr bits in cpu_post_load
        target-ppc: move sdr1 value change detection logic to helper_store_sdr1()
        cuda.c: include adb_poll_timer in VMStateDescription
        adb.c: include ADBDevice parent state in KBDState and MouseState
        macio.c: include parent PCIDevice state in VMStateDescription
        display cpu id dump state
        Openpic: check that cpu id is within the number of cpus
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a9ab06d1187f5967d315052da948afba6c3ba651
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Mar 7 23:16:38 2015 +0100

      target-ppc: Fix warnings from Sparse

      Sparse report:

      target-ppc/mmu-hash64.c:353:9: warning: returning void-valued expression
      target-ppc/mmu-hash64.c:620:9: warning: returning void-valued expression

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2aad88f4b05303531bc9aad6531258616d95af52
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Fri Feb 20 15:58:53 2015 +1100

      sPAPR: Implement sPAPRPHBClass EEH callbacks

      The patch implements sPAPRPHBClass EEH callbacks so that the EEH
      RTAS requests can be routed to VFIO for further handling.

      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee954280da8d9ea7afd28b4c288da15fb8b4efca
  Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
  Date:   Fri Feb 20 15:58:52 2015 +1100

      sPAPR: Implement EEH RTAS calls

      The emulation for EEH RTAS requests from guest isn't covered
      by QEMU yet and the patch implements them.

      The patch defines constants used by EEH RTAS calls and adds
      callbacks sPAPRPHBClass::{eeh_set_option, eeh_get_state, eeh_reset,
      eeh_configure}, which are going to be used as follows:

        * RTAS calls are received in spapr_pci.c, sanity check is done
          there.
        * RTAS handlers handle what they can. If there is something it
          cannot handle and the corresponding sPAPRPHBClass callback is
          defined, it is called.
        * Those callbacks are only implemented for VFIO now. They do ioctl()
          to the IOMMU container fd to complete the calls. Error codes from
          that ioctl() are transferred back to the guest.

      [aik: defined RTAS tokens for EEH RTAS calls]
      Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit d7586dc426472b5ad0f5c01b5c7c551eeb5a6003
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Wed Mar 4 12:31:26 2015 +1100

      target-ppc: Add versions to server CPU descriptions

      5b79b1c "target-ppc: Create versionless CPU class per family if KVM" added
      a dynamic CPU class registration with the name of the CPU family which
      QEMU is running on. For example, this allowed specifying "-cpu POWER7"
      on every version of POWER7 machine, not just the one which POWER7 was
      an alias of. I.e. before 5b79b1c, "-cpu POWER7" would not work on real
      POWER7 2.1 and would work on POWER7 2.3 only. The same story for POWER8.

      However that patch broke POWER5+ support as POWER5+ CPU uses the same
      name as the CPU class so dynamic registering of the POWER5+ class failed.

      This redefines POWER5+ server CPUs by adding a version to them and adding
      an alias for TCG case. KVM will use dynamically registered CPUs.

      While we are here, do the same for 970 CPU.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3ba55e399f7637d2b4054bcc30228cd2d0883823
  Author: Cyril Bur <cyril.bur@au1.ibm.com>
  Date:   Mon Mar 2 17:55:38 2015 +1100

      PPC: Introduce the Virtual Time Base (VTB) SPR register

      This patch adds basic support for the VTB.

      PowerISA:
      The Virtual Time Base (VTB) is a 64-bit incrementing counter.
      Virtual Time Base increments at the same rate as the Time Base until its value
      becomes 0xFFFF_FFFF_FFFF_FFFF (2 64 - 1); at the next increment its value
      becomes 0x0000_0000_0000_0000. There is no interrupt or other indication when
      this occurs.

      The operation of the Virtual Time Base has the following additional
      properties.
      1. Loading a GPR from the Virtual Time Base has no effect on the accuracy of
      the Virtual Time Base.
      2. Copying the contents of a GPR to the Virtual Time Base replaces the
      contents of the Virtual Time Base with the contents of the GPR.

      Signed-off-by: Cyril Bur <cyril.bur@au1.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6494ad9bf4f6e1561f078337d6d82018fd6e7516
  Author: Alexander Graf <agraf@suse.de>
  Date:   Mon Mar 2 14:31:58 2015 +0100

      PPC: Remove duplicate OPENPIC defines in default-configs

      The CONFIG_OPENPIC variable was declared multiple times. We only need it once.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 46ca0116657c225db0d7d3ee4fb0ed9fbf072257
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 17:46:27 2015 +1100

      ppc64-softmmu: Remove duplicated OPENPIC from config

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 25e1727884493596bfeecb8af569442983400a34
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 17:46:25 2015 +1100

      Revert "default-configs/ppc64: add all components of i82378 SuperIO chip used by prep"

      This reverts commit 9c9984242ce46ccf8636f5c19e81d794e84aa0c7 as even when
      it was applied, all supposedly new config options were already enabled.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28b07e737eb58f299b066c1c6b3740bb055a2cf9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 27 11:52:17 2015 +0100

      spapr_vio: Convert to realize()

      Bonus fix: always set an error on failure.  Some failures were silent
      before, except for the generic error set by device_realize().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5f6e7327a95bf4c7e9354cd00e03d7ffaf25f8e
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:52 2015 +0000

      openpic: convert to vmstate

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2ada66f944c0db9d037c7cf3ff1a4fd43283338d
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:51 2015 +0000

      openpic: switch IRQQueue queue from inline to bitmap

      This is in preparation for using VMSTATE_BITMAP in a followup vmstate
      migration patch.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 032ab092904ce1615e3cedcb9ebc775bd3d7fac6
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:50 2015 +0000

      openpic: fix up loadvm under -M mac99

      Issuing loadvm under -M mac99 would fail for two reasons: firstly an incorrect
      version number for openpic would cause openpic_load() to abort, and secondly
      a cut/paste error when restoring the IVPR and IDR registers caused subsequent
      vmstate sections to become misaligned and abort early.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4efef9864082c8daa2a0fcff2d5bc0bfca221d1f
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:49 2015 +0000

      openpic: fix segfault on -M mac99 savevm

      A simple copy/paste error causes savevm on -M mac99 to segfault.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2360b6e84f78d41fa0f76555a947148b73645259
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:48 2015 +0000

      target-ppc: force update of msr bits in cpu_post_load

      Since env->msr has already been restored by the time cpu_post_load is called,
      make sure that ppc_store_msr() is explicitly called with all msr bits except
      MSR_TGPR marked as invalid.

      This solves the issue where MSR flags aren't set correctly when restoring a VM
      snapshot, in particular the internal env->excp_prefix value when MSR_EP has
      been altered by a guest.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2828c4cd92b1c0590b959ec022888b1f6909949a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:47 2015 +0000

      target-ppc: move sdr1 value change detection logic to helper_store_sdr1()

      Otherwise when cpu_post_load calls ppc_store_sdr1() when restoring a VM
      snapshot the value is deemed unchanged and so the internal env->htab*
      variables aren't set correctly.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 6cb577dde5c2e19025f4f24fdff46c47ba8cd398
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:46 2015 +0000

      cuda.c: include adb_poll_timer in VMStateDescription

      Make sure that we include the adb_poll_timer when saving the VM state for
      client OSs that use it, e.g. Darwin.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5dffaa5b19b284718b40a4aba01abf0bcdabf7a
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:45 2015 +0000

      adb.c: include ADBDevice parent state in KBDState and MouseState

      The parent ADBDevice contains the device id on the ADB bus. Make sure that
      this state is included in both its subclasses since some clients (such as
      OpenBIOS) reprogram each device id after enumeration.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 026359238b50f56a90961d9aa62ef303371eca8c
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   Mon Feb 9 22:40:44 2015 +0000

      macio.c: include parent PCIDevice state in VMStateDescription

      This ensures that the macio PCI device is correctly configured when restoring
      from a VM snapshot.

      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 21e5d28a4798f536525338f4f9137d83a9556491
  Author: Tristan Gingold <gingold@adacore.com>
  Date:   Wed Feb 25 10:39:25 2015 +0100

      display cpu id dump state

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 04d2acbb57900f1cba2eef86b21ab78d854683db
  Author: Fabien Chouteau <chouteau@adacore.com>
  Date:   Wed Feb 25 10:50:28 2015 +0100

      Openpic: check that cpu id is within the number of cpus

      Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit eefaccc02bab659c8cb4c994b2f385c3f0a27551
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Tue Feb 10 15:36:16 2015 +1100

      pseries: Switch VGA endian on H_SET_MODE

      When the guest switches the interrupt endian mode, which essentially
      means a global machine endian switch, we want to change the VGA
      framebuffer endian mode as well in order to be backward compatible
      with existing guests who don't know about the new endian control
      register.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3c2784fc864d943ff70a2a5c9dea8e9a9b4d9e1d
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Tue Feb 10 15:36:15 2015 +1100

      vga: Expose framebuffer byteorder as a QOM property

      The VGA device model now supports having the framebuffer in either endian,
      and can be switched between these by the guest via a register in the qext
      region.

      However, in some cases (e.g. LE OS on the pseries machine) we have
      existing guest that don't know about the endian switch register, but other
      parts of the qemu code have better information to set a default endianness
      than the VGA code does of itself.

      In order to allow them to set a correct default endianness in these cases,
      without breaking abstraction walls, this patch exposes the VGA framebuffer
      endianness via a writable QOM property.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      [agraf: use instance_init for property exposure]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 34f2af3d3edf9d57c27811d3780cbc0ece319625
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:48 2015 +0100

      spapr: Clean up misuse of qdev_init() in xics-kvm creation

      We call try_create_xics() to create a "xics-kvm".  If it fails, we
      call it again to fall back to plain "xics".

      try_create_xics() uses qdev_init().  qdev_init()'s error handling has
      an unwanted side effect: it calls qerror_report_err(), which prints to
      stderr.  Looks like an error, but isn't.

      In QMP context, it would stash the error in the monitor instead,
      making the QMP command fail.  Fortunately, it's only called from board
      initialization, never in QMP context.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      While there, improve the error message when we can't satisfy an
      explicit user request for "xics-kvm", and exit(1) instead of abort().
      Simplify the abort when we can't create "xics".

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      [agraf: squash in fix for uninitialized variable from mdroth]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit fe656ebd4e4339972bae771a692109fd43ff5737
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 5 10:34:47 2015 +0100

      PPC: Clean up misuse of qdev_init() in kvm-openpic creation

      We call ppce500_init_mpic_kvm() to create a "kvm-openpic".  If it
      fails, we call ppce500_init_mpic_qemu() to fall back to plain
      "openpic".

      ppce500_init_mpic_kvm() uses qdev_init().  qdev_init()'s error
      handling has an unwanted side effect: it calls qerror_report_err(),
      which prints to stderr.  Looks like an error, but isn't.

      In QMP context, it would stash the error in the monitor instead,
      making the QMP command fail.  Fortunately, it's only called from board
      initialization, never in QMP context.

      Clean up by cutting out the qdev_init() middle-man: set property
      "realized" directly.

      While there, improve the error message when we can't satisfy an
      explicit user request for "kvm-openpic", and exit(1) instead of
      abort().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 74e5ae284b1c8ac36a77e57ab9a49178173c666f
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:53 2015 +1100

      pseries: Export RTC time via QOM

      On x86, the guest's RTC can be read with QMP, either from the RTC device's
      "date" property or via the "rtc-time" property on the machine (which is an
      alias to the former).  This is set up in the mc146818rtc driver, and
      doesn't work on other targets.

      This patch adds a similar "date" property to the pseries machine's RTAS RTC
      and adds a compatible alias to the machine.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 880ae7de5958a765699386777de0f3841d635e1d
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:52 2015 +1100

      pseries: Move rtc_offset into RTC device's state structure

      The initial creation of the PAPR RTC qdev class left a wart - the rtc's
      offset was left in the sPAPREnvironment structure, accessed via a global.

      This patch moves it into the RTC device's own state structure, were it
      belongs.  This requires a small change to the migration stream format.  In
      order to handle incoming streams from older versions, we also need to
      retain the rtc_offset field in the sPAPREnvironment structure, so that it
      can be loaded into via the vmsd, then pushed into the RTC device.

      Since we're changing the migration format, this also takes the opportunity
      to:

        * Change the rtc offset from a value in seconds to a value in
          nanoseconds, allowing nanosecond offsets between host and guest
          rtc time, if desired.

        * Remove both the already unused "next_irq" field and now unused
          "rtc_offset" field from the new version of the spapr migration
          stream

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 28df36a13a3b0b792d9df64f8db8a392df5e0b35
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:51 2015 +1100

      pseries: Make the PAPR RTC a qdev device

      At present the PAPR RTC isn't a "device" as such - it's accessed only via
      firmware/hypervisor calls, and is handled in the sPAPR core code.  This
      becomes inconvenient as we extend it in various ways.

      This patch makes the PAPR RTC a separate device in the qemu device model.

      For now, the only piece of device state - the rtc_offset - is still kept in
      the global sPAPREnvironment structure.  That's clearly wrong, but leaving
      it to be fixed in a following patch makes for a clearer separation between
      the internal re-organization of the device, and the behavioural changes
      (because the migration stream format needs to change slightly when the
      offset is moved into the device's own state).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f01c5d84775cfc877dc0b537565a168d043394e9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:50 2015 +1100

      pseries: Make RTAS time of day functions respect -rtc options

      In the 'pseries' machine the real time clock is provided by a
      paravirtualized firmware interface rather than a device per se; the RTAS
      get-time-of-day and set-time-of-day calls.

      Out current implementations of those work directly off host time (with
      an offset), not respecting options such as clock=vm which can be
      specified in the -rtc command line option.

      This patch reworks the RTAS RTC code to respect those options, primarily
      by basing them on the qemu_clock_get_ns(rtc_clock) function instead of
      directly on qemu_get_timedate() (which essentially handles host time, not
      virtual rtc time).

      As a bonus, this means our get-time-of-day function now also returns
      nanoseconds.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e5dad1d7d1618822dbadb1dd12efa1b5674b6c40
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:49 2015 +1100

      pseries: Add spapr_rtc_read() helper function

      The virtual RTC time is used in two places in the pseries machine.  First
      is in the RTAS get-time-of-day function which returns the RTC time to the
      guest.  Second is in the spapr events code which is used to timestamp
      event messages from the hypervisor to the guest.

      Currently both call qemu_get_timedate() directly, but we want to change
      that so we can properly handle the various -rtc options.  In preparation,
      create a helper function to return the virtual RTC time.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit bbade20633a6b4ed7333e03a76038eda98950946
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:48 2015 +1100

      pseries: Add more parameter validation in RTAS time of day functions

      Currently, the RTAS time of day functions only partially validate the
      number of parameters they receive and return.  Because of how the
      parameters are used, this is unlikely to lead to a crash, but it's messy.

      This patch adds the missing checks.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 12f421745cd763742377c7134f48fa12fb889ee3
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:47 2015 +1100

      pseries: Move sPAPR RTC code into its own file

      At the moment the RTAS (firmware/hypervisor) time of day functions are
      implemented in spapr_rtas.c along with a bunch of other things.  Since
      we're going to be expanding these a bit, move the RTAS RTC related code
      out into new file spapr_rtc.c.  Also add its own initialization function,
      spapr_rtc_init() called from the main machine init routine.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 87774a4a4217b5cddc693f0678d0fc2bfc7f2ec1
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:46 2015 +1100

      Add more VMSTATE_*_TEST variants for integers

      Currently, vmstate.h includes helper macro variants for 8, 16 and 32-bit
      unsigned integers which include a "test" function which can selectively
      enable or disable the field's presence in the migration stream.

      There aren't similar helpers for 64-bit unsigned integers, or any size of
      signed integers.  This patch remedies this.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 8e099d14f5233f330c4a6f03ff655219cd789c8f
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 6 14:55:45 2015 +1100

      Generalize QOM publishing of date and time from mc146818rtc.c

      The mc146818rtc driver exposes the current RTC date and time via the "date"
      property in QOM (which is also aliased to the machine's "rtc-time"
      property).  Currently it uses a custom visitor function rtc_get_date to
      do this.

      This patch introduces new helpers to the QOM core to expose struct tm
      valued properties via a getter function, so that this functionality can be
      more easily duplicated in other RTC implementations.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b194df478ae7607d93b47a8307e623c9f9f2b3ab
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Jan 30 12:53:19 2015 +1100

      spapr-pci: Enable huge BARs

      At the moment sPAPR only supports 512MB window for MMIO BARs. However
      modern devices might want bigger 64bit BARs.

      This extends MMIO window from 512MB to 62GB (aligned to
      SPAPR_PCI_WINDOW_SPACING) and advertises it in 2 records in
      the PHB "ranges" property. 32bit gets the space from
      SPAPR_PCI_MEM_WIN_BUS_OFFSET till the end of 4GB, 64bit gets the rest
      of the space. If no space is left, 64bit range is not advertised.

      The MMIO space size is set to old value of 0x20000000 by default
      for pseries machines older than 2.3.

      The approach changes the device tree which is a guest visible change, however
      it won't break migration as:
      1. we do not support migration to older QEMU versions
      2. migration to newer QEMU will migrate the device tree as well and since
      the new layout only extends the old one and does not change address mappigns,
      no breakage is expected here too.

      SLOF change is required to utilize this extension.

      Suggested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3dab024430cf72ea65afce227585f9768fb3bfa7
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Fri Jan 30 12:53:18 2015 +1100

      spapr: Add pseries-2.3 machine

      The next patch will make MMIO space bigger and keep the old value for
      older pseries machines.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e4ac9687103f907eadea10d6176eb2e989d1e36
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Wed Jan 14 13:33:39 2015 +1100

      pseries: Limit PCI host bridge "index" value

      pseries guests can have large numbers of PCI host bridges.  To avoid the
      user having to specify a number of different configuration values for every
      one, the device supports an "index" property which is a shorthand setting
      the various window and configuration addresses from a predefined sensible
      set.

      There are some problems with the details at present:
        * The "index" propery is signed, but negative values will create PCI
      windows below where we expect, potentially colliding with other devices
        * No limit is imposed on the "index" property and large values can
      translate to extremely large window addresses.  With PCI passthrough in
      particular this can mean we exceed various mapping and physical address
      limits causing the guest host bridge to not work in strange ways.

      This patch addresses this, by making "index" unsigned, and imposing a
      limit.  Currently the limit allows indices from 0..255 which is probably
      enough host bridges for the time being.  It's fairly easy to extend if
      we discover we need more.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ad3e67d05a65da2e3696ed45b999e061ccb7a879
  Author: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
  Date:   Mon Jan 26 19:51:58 2015 +0530

      target-ppc: Use right page size with hash table lookup

      We look at two sizes specified in ISA (4K, 64K). If not found matching,
      we consider it 16MB.

      Without this patch we would fail to lookup address above 16MB range.
      Below 16MB happened to work before because the kernel have a liner
      mapping and we always looked up hash for 0xc000000000000000. The
      actual real address was computed by using the 16MB offset
      with the real address found with the above hash.

      Without Fix:
      (gdb) x/16x 0xc000000001000000
      0xc000000001000000 <list_entries+453208>:       Cannot access memory at address 0xc000000001000000
      (gdb)

      With Fix:
      (gdb)  x/16x 0xc000000001000000
      0xc000000001000000 <list_entries+453208>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000010 <list_entries+453224>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000020 <list_entries+453240>:       0x00000000      0x00000000      0x00000000      0x00000000
      0xc000000001000030 <list_entries+453256>:       0x00000000      0x00000000      0x00000000      0x00000000

      Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ee9a569ab88edd0755402aaf31ec0c69decf7756
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Thu Jan 29 16:04:58 2015 +1100

      spapr_vio/spapr_iommu: Move VIO bypass where it belongs

      Instead of tweaking a TCE table device by adding there a bypass flag,
      let's add an alias to RAM and IOMMU memory region, and enable/disable
      those according to the selected bypass mode.
      This way IOMMU memory region can have size of the actual window rather
      than ram_size which is essential for upcoming DDW support.

      This moves bypass logic to VIO layer and keeps @bypass flag in TCE table
      for migration compatibility only. This replaces spapr_tce_set_bypass()
      calls with explicit assignment to avoid confusion as the function could
      do something more that just syncing the @bypass flag.

      This adds a pointer to VIO device into the sPAPRTCETable struct to provide
      the sPAPRTCETable device a way to update bypass mode for the VIO device.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 20a1f9d07125bead22efd1dc208b4d14ae1b2a21
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 17 14:47:54 2015 +0100

      qcow2: Remove unused struct QCowCreateState

      The only user went away five years ago with commit a9420734 ('qcow2:
      Simplify image creation'). It's about time to remove it.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6dcf097fad2773fdee9ea12f8452dcc259e9ee1
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Thu Feb 12 08:35:49 2015 +0300

      block/raw-posix: fix compilation warning on OSX

      block/raw-posix.c:947:19: warning: unused variable 's' [-Wunused-variable]
          BDRVRawState *s = aiocb->bs->opaque;

      This variable is used only when on of the following macros are defined
      CONFIG_XFS, CONFIG_FALLOCATE, CONFIG_FALLOCATE_PUNCH_HOLE or
      CONFIG_FALLOCATE_ZERO_RANGE. Fortunately, CONFIG_FALLOCATE_PUNCH_HOLE
      and CONFIG_FALLOCATE_ZERO_RANGE could be defined only along with
      CONFIG_FALLOCATE. Therefore checking for CONFIG_XFS or CONFIG_FALLOCATE
      would be enough.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Peter Maydell <peter.maydell@linaro.org>
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 876eb1b0cc2b04927739cba10e4e73e8b990d65e
  Author: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
  Date:   Fri Feb 13 18:20:53 2015 +0900

      sheepdog: selectable object size support

      Previously, qemu block driver of sheepdog used hard-coded VDI object size.
      This patch enables users to handle VDI object size.

      When you start qemu, you don't need to specify additional command option.

      But when you create the VDI which doesn't have default object size
      with qemu-img command, you specify object_size option.

      If you want to create a VDI of 8MB object size,
      you need to specify following command option.

       # qemu-img create -o object_size=8M sheepdog:test1 100M

      In addition, when you don't specify qemu-img command option,
      a default value of sheepdog cluster is used for creating VDI.

       # qemu-img create sheepdog:test2 100M

      Signed-off-by: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp>
      Acked-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0cc84887068eeb59eed84dbab6547b39e83d739c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Feb 11 15:56:01 2015 +0100

      vpc: Implement bdrv_co_get_block_status()

      This implements bdrv_co_get_block_status() for VHD images. This can
      significantly speed up qemu-img convert operation because only with this
      function implemented sparseness can be considered. (Before, converting a
      1 TB empty image took several minutes for me, now it's instantaneous.)

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 3f3f20dcd34fc2fcf6dea2fe4e9b45d1c4d67288
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Feb 11 17:19:57 2015 +0100

      vpc: Fix size in fixed image creation

      If total_sectors is rounded to match the geometry, total_size needs to
      be changed as well. Otherwise we end up with an image whose geometry
      describes a disk larger than the image file, which doesn't end well.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 7c2eed3efa86c19436bc33372bfa9d7fbb6fda2c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Feb 10 11:15:59 2015 +0100

      test-coroutine: Regression test for yield bug

      This adds a test for reentering a coroutine that previously yielded to a
      coroutine that has meanwhile terminated.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit cd12bb567cdcd9665a5acdecd6ac8afd9a977003
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 11:31:52 2015 +0100

      coroutine: Clean up qemu_coroutine_enter()

      qemu_coroutine_enter() is now the only user of coroutine_swap(). Both
      functions are short, so inline it.

      Also, using COROUTINE_YIELD is now even more confusing because this code
      is never called during qemu_coroutine_yield() any more. In fact, this
      value is never read back, so we can just introduce a new COROUTINE_ENTER
      which documents the purpose of the task switch better.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 315a1309defd8ddf910c6c17e28cbbd7faf92f2e
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 11:17:53 2015 +0100

      coroutine: Fix use after free with qemu_coroutine_yield()

      Instead of using the same function for entering and exiting coroutines,
      and hoping that it doesn't add any functionality that hurts with the
      parameters used for exiting, we can just directly call into the real
      task switch in qemu_coroutine_switch().

      This fixes a use-after-free scenario where reentering a coroutine that
      has yielded still accesses the old parent coroutine (which may have
      meanwhile terminated) in the part of coroutine_swap() that follows
      qemu_coroutine_switch().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0048fa6c807fc8fb5c52873562ea3debfa65f085
  Merge: 6608c7e 59ea3e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 9 09:14:28 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, pc, virtio fixes and cleanups

      A bunch of fixes all over the place.
      All of ACPI refactoring has been merged.
      Legacy pci commands have been dropped.
      virtio header cleanup
      initial patches from virtio-1.0 branch

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      * remotes/mst/tags/for_upstream: (130 commits)
        acpi: drop unused code
        aml-build: comment fix
        acpi-build: fix typo in comment
        acpi: update generated files
        vhost user:support vhost user nic for non msi guests
        aml-build: fix build for glib < 2.22
        acpi: update generated files
        Makefile.target: binary depends on config-devices
        acpi-test-data: update after pci rewrite
        acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb().
        pci-hotplug-old: Has been dead for five major releases, bury
        pci: Give a few helpers internal linkage
        acpi: make build_*() routines static to aml-build.c
        pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs
        pc: acpi-build: drop template patching and create PCI bus tree dynamically
        tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation
        pc: acpi-build: simplify PCI bus tree generation
        tests: add ACPI blobs for qemu with bridge cases
        tests: bios-tables-test: add support for testing bridges
        tests: ACPI test blobs update due to PCI0._CRS changes
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

      Conflicts:
      	hw/pci/pci-hotplug-old.c

  commit 6608c7e9eb65727524f6f590b1e716ec6e7877d4
  Merge: 9c31a82 12004c9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 14:32:38 2015 +0000

      Merge remote-tracking branch 'remotes/xtensa/tags/20150307-xtensa' into staging

      Xtensa updates:

      - implement do_unassigned_access callback;
      - fix ML605 xtfpga FLASH size.

      # gpg: Signature made Sat Mar  7 12:35:05 2015 GMT using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20150307-xtensa:
        target-xtensa: xtfpga: fix ml605 flash size
        target-xtensa: implement do_unassigned_access callback
        hw/xtensa: allow reads/writes in the system I/O region

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9c31a8219a8fb6e790d5510987ae2c810ff968b5
  Merge: 033c7dd a3b0421
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 12:47:13 2015 +0000

      Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging

      * remotes/qmp-unstable/queue/qmp:
        docs: add memory-hotplug.txt
        qemu-options.hx: improve -m description
        virtio-balloon: Add some trace events
        virtio-balloon: Fix balloon not working correctly when hotplug memory
        pc-dimm: add a function to calculate VM's current RAM size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 59ea3e7532a85b15bd551335b27fa97db48efa8d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 11:49:21 2015 +0100

      acpi: drop unused code

      Recent changes left acpi_get_hex unused,
      and clag is unhappy about it:
          error: unused function 'acpi_get_hex'

      Drop it, as well as some unused macros.

      Signer-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 56521fb88f7e3d2e3c7cf87d5f85e17e563c0df7
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 10:36:52 2015 +0100

      aml-build: comment fix

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e71fd76454ac78f8feee69acb301263f2bc7a55c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 8 10:24:42 2015 +0100

      acpi-build: fix typo in comment

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 033c7ddf86fe4315069ac4cf3cfab9bc6035dee7
  Merge: b6d527f 7c6044a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 09:47:55 2015 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150304-1' into staging

      misc spice/qxl fixes.

      # gpg: Signature made Wed Mar  4 13:57:42 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150304-1:
        hmp: info spice: take out webdav
        hmp: info spice: Show string channel name
        qxl: drop update_displaychangelistener call for secondary qxl devices
        vga: refactor vram_size clamping and rounding
        qxl: refactor rounding up to a nearest power of 2
        spice: fix invalid memory access to vga.vram
        qxl: document minimal video memory for new modes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b6d527fbc0b64a2ba7d83623e47b05c745b88043
  Merge: fff795a aa68578
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 07:33:45 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150303-1' into staging

      xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      # gpg: Signature made Tue Mar  3 07:38:43 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150303-1:
        xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fff795ab383e2052cfef792e74a3086e12a14f14
  Merge: cff6abd 76349f5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 06:43:32 2015 +0000

      Merge remote-tracking branch 'remotes/gonglei/tags/bootdevice-next-20150303' into staging

      bootdevice: bug fixes

      # gpg: Signature made Tue Mar  3 05:18:39 2015 GMT using RSA key ID DDE30FBB
      # gpg: Good signature from "Gonglei <arei.gonglei@huawei.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 5178 9C82 617F 2F58 8693  63B1 BA7A 65B0 DDE3 0FBB

      * remotes/gonglei/tags/bootdevice-next-20150303:
        bootdevice: add check in restore_boot_order()
        bootdevice: check boot order argument validation before vm running

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cff6abd6f2fc1af588207b27f2a6b96e15bd96dc
  Merge: c10b028 bebe80f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Mar 8 00:16:27 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150303' into staging

      TriCore RRR1, RRR2 instructions and bugfixes

      # gpg: Signature made Tue Mar  3 01:12:02 2015 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150303:
        target-tricore: Add instructions of RRR1 opcode format, which have 0xc3 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x43 as first opcode
        target-tricore: Add instructions of RRR1 opcode format, which have 0x83 as first opcode
        target-tricore: Add instructions of RRR2 opcode format
        target-tricore: fix msub32_suov return wrong results
        target-tricore: Fix RLC_ADDI, RLC_ADDIH using wrong microcode helper

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12004c9eb4486a134b1f49b17890a364adca5f8c
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Feb 16 22:30:21 2015 +0300

      target-xtensa: xtfpga: fix ml605 flash size

      ML605 daughterboard has 16MB flash, not 32MB. Change board definition
      accordingly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 4246e225c0e8fbcf17051aa83a4198293c007cc4
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Wed Feb 12 14:35:56 2014 +0400

      target-xtensa: implement do_unassigned_access callback

      Depending on access type raise either InstrPIFDataError or
      LoadStorePIFDataError exception.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 8bb3b575448aeff086b2849943da47dce3c2b6ec
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Mon Feb 17 20:57:45 2014 +0400

      hw/xtensa: allow reads/writes in the system I/O region

      Ignore writes to unassigned areas of system I/O regison and return 0 for
      reads. This makes drivers for unimportant unimplemented hardware blocks
      happy.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit a3b042179859c68b3d08f8aa43866d28d6b56987
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Thu Feb 26 14:43:07 2015 -0500

      docs: add memory-hotplug.txt

      This document describes how to use memory hotplug in QEMU.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>

  commit 9fcc07948608423539f2030f8ea12aadbcdbb6ed
  Author: Luiz Capitulino <lcapitulino@redhat.com>
  Date:   Thu Feb 26 14:35:45 2015 -0500

      qemu-options.hx: improve -m description

      Add memory hotplug options to the command-line format. Also,
      add a complete command-line example and improve description.

      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>

  commit 6adfdc5a6a4c2540a802e10fe0370d3ffb14487b
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:10 2014 +0800

      virtio-balloon: Add some trace events

      Add some trace events for easier debugging

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 463756d03164d640e3de00460488ba97302bf77e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:09 2014 +0800

      virtio-balloon: Fix balloon not working correctly when hotplug memory

      When do memory balloon, it takes the 'ram_size' as the VM's current ram size,
      But 'ram_size' is the startup configured ram size, it does not take into
      account the hotplugged memory.

      As a result, the balloon result will be confused.
      Steps to reproduce:
      (1)Start VM: qemu -m size=1024,slots=4,maxmem=8G
      (2)In VM: #free -m : 1024M
      (3)qmp balloon 512M
      (4)In VM: #free -m : 512M
      (5)hotplug pc-dimm 1G
      (6)In VM: #free -m : 1512M
      (7)qmp balloon 256M
      (8)In VM: #free -m :1256M
      We expect the VM's available ram size to be 256M after 'qmp balloon 256M'
      command, but VM's real available ram size is 1256M.

      For "qmp balloon" is not performance critical code, we use function
      'get_current_ram_size' to get VM's current ram size.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 87a45cfee6b169a68e43f284a8a3c1bc20bd5dc9
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 17 13:11:08 2014 +0800

      pc-dimm: add a function to calculate VM's current RAM size

      The global parameter 'ram_size' does not take into account
      the hotplugged memory.

      In some codes, we use 'ram_size' as current VM's real RAM size,
      which is not correct.

      Add function 'get_current_ram_size' to calculate VM's current RAM size,
      it will enumerate present memory devices and also plus ram_size.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit c10b02836ff02fcd09367316260f9368c5c92f28
  Merge: 3539bbb 0b7e89b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 4 15:33:05 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

      # gpg: Signature made Mon Mar  2 21:45:18 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/tracing-pull-request:
        trace: add DTrace reserved words for .d files
        unbreak dtrace tracing due to double _ in rdma names

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 09d219a31cf87ed98150c0a9e772e54f470f2a01
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Mar 4 16:05:32 2015 +0100

      acpi: update generated files

      Fixes up build on systems without iasl.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3539bbb93e944ffde31c61c369ea9eedcc5697a6
  Merge: 576a94d 47cbe50
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Mar 4 14:37:31 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150302.0' into staging

      Updates for QEMU 2.3-rc0:
       - Error reporting and static cleanup (Alexey Kardashevskiy)
       - Runtime mmap disable for tracing (Samuel Pitoiset)
       - Support for host directed device request (Alex Williamson)

      # gpg: Signature made Mon Mar  2 18:42:50 2015 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150302.0:
        vfio-pci: Enable device request notification support
        vfio: allow to disable MMAP per device with -x-mmap=off option
        vfio: Make type1 listener symbols static
        vfio: Add ioctl number to error report

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c6044a94e52db8aef9a71d616c7a0914adb71ab
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Mar 3 09:27:28 2015 +0100

      hmp: info spice: take out webdav

      Obvious suggestion for the next spice-protocol
      release: Add some way to #ifdef new stuff.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Cole Robinson <crobinso@redhat.com>

  commit 24f938a682d934b133863eb421aac33592f7a09e
  Author: Haifeng Gao <gaohaifeng.gao@huawei.com>
  Date:   Sat Feb 28 17:02:02 2015 +0800

      vhost user:support vhost user nic for non msi guests

      Currently, vhost user nic doesn't support non msi guests(like pxe stage) by default.
      Vhost user nic can't fall back to qemu like normal vhost net nic does. So we should
      enable it for non msi guests.

      Signed-off-by: Haifeng Gao <gaohaifeng.gao@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2e5feadbf8133b9b108919a2f576943b448a1a06
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Mar 3 17:40:45 2015 +0100

      aml-build: fix build for glib < 2.22

      g_ptr_array_new_with_free_func is there since glib 2.22,
      use the older g_ptr_array_foreach instead.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 576a94d8bcaa1bb07a81d9ffd2cf76095a66ad9a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Mar 3 11:36:09 2015 +0100

      vl: take iothread lock very early

      If the iothread lock isn't taken by the main thread, the RCU callbacks
      might run concurrently with the main thread.  QEMU's not ready for that.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3180aadb1f00fa0f0b47bccbcae5b1d47dc5ff74
  Merge: 5efde22 21618b3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 12:07:47 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - more config options
      - bootdevice, iscsi, virtio-scsi fixes
      - build system patches for MinGW and config-devices.mak
      - qemu_mutex_lock_iothread deadlock fixes
      - another tiny patch from the record/replay series

      # gpg: Signature made Mon Mar  2 09:59:14 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        cpus: be more paranoid in avoiding deadlocks
        cpus: fix deadlock and segfault in qemu_mutex_lock_iothread
        virtio-scsi: Allocate op blocker reason before blocking
        Makefile.target: binary depends on config-devices
        Makefile: don't silence mak file test with V=1
        Makefile: fix up parallel building under MSYS+MinGW
        iscsi: Handle write protected case in reopen
        Give ivshmem its own config option
        Create specific config option for "platform-bus"
        Add specific config options for PCI-E bridges
        bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'
        timer: replace time() with QEMU_CLOCK_HOST
        virtio-scsi-dataplane: Call blk_set_aio_context within BQL
        block: Forbid bdrv_set_aio_context outside BQL
        scsi: give device a parent before setting properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aa6857891df614c620e6e9fc4bc4af6e0e49cafd
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Mar 2 17:02:53 2015 +0100

      xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set

      At the moment, when the XHCI driver in edk2
      (MdeModulePkg/Bus/Pci/XhciDxe/XhciDxe.inf) runs on QEMU, with the options

        -device nec-usb-xhci -device usb-kbd

      it crashes with:

        ASSERT MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c(1759):
        TrsRing != ((void*) 0)

      The crash hits in the following edk2 call sequence (all files under
      MdeModulePkg/Bus/):

      UsbEnumerateNewDev()                         [Usb/UsbBusDxe/UsbEnumer.c]
        UsbBuildDescTable()                        [Usb/UsbBusDxe/UsbDesc.c]
          UsbGetDevDesc()                          [Usb/UsbBusDxe/UsbDesc.c]
            UsbCtrlGetDesc(USB_REQ_GET_DESCRIPTOR) [Usb/UsbBusDxe/UsbDesc.c]
              UsbCtrlRequest()                     [Usb/UsbBusDxe/UsbDesc.c]
                UsbHcControlTransfer()             [Usb/UsbBusDxe/UsbUtility.c]
                  XhcControlTransfer()             [Pci/XhciDxe/Xhci.c]
                    XhcCreateUrb()                 [Pci/XhciDxe/XhciSched.c]
                      XhcCreateTransferTrb()       [Pci/XhciDxe/XhciSched.c]
                    XhcExecTransfer()              [Pci/XhciDxe/XhciSched.c]
                      XhcCheckUrbResult()          [Pci/XhciDxe/XhciSched.c]
                        //
                        // look for TRB_TYPE_DATA_STAGE event [1]
                        //
                    //
                    // Store a copy of the device descriptor, as the hub device
                    // needs this info to configure endpoint. [2]
                    //
        UsbSetConfig()                             [Usb/UsbBusDxe/UsbDesc.c]
          UsbCtrlRequest(USB_REQ_SET_CONFIG)       [Usb/UsbBusDxe/UsbDesc.c]
            UsbHcControlTransfer()                 [Usb/UsbBusDxe/UsbUtility.c]
              XhcControlTransfer()                 [Pci/XhciDxe/Xhci.c]
                XhcSetConfigCmd()                  [Pci/XhciDxe/XhciSched.c]
                  XhcInitializeEndpointContext()   [Pci/XhciDxe/XhciSched.c]
                    //
                    // allocate transfer ring for the endpoint [3]
                    //

      USBKeyboardDriverBindingStart()              [Usb/UsbKbDxe/EfiKey.c]
        UsbIoAsyncInterruptTransfer()              [Usb/UsbBusDxe/UsbBus.c]
          UsbHcAsyncInterruptTransfer()            [Usb/UsbBusDxe/UsbUtility.c]
            XhcAsyncInterruptTransfer()            [Pci/XhciDxe/Xhci.c]
              XhcCreateUrb()                       [Pci/XhciDxe/Xhci.c]
                XhcCreateTransferTrb()             [Pci/XhciDxe/XhciSched.c]
                  XhcSyncTrsRing()                 [Pci/XhciDxe/XhciSched.c]
                    ASSERT (TrsRing != NULL) [4]

      UsbEnumerateNewDev() in the USB bus driver issues a GET_DESCRIPTOR
      request, in order to determine the number of configurations that the
      endpoint supports. The requests consists of three stages (three TRBs),
      setup, data, and status. The length of the response is determined in [1],
      namely from the transfer event that the host controller generates in
      response to the request's middle stage (ie. the data stage).

      If the length of the answer is correct (a full GET_DESCRIPTOR request
      takes 18 bytes), then the XHCI driver that underlies the USB bus driver
      "snoops" (caches) the descriptor data for later [2].

      Later, the USB bus driver sends a SET_CONFIG request. The underlying XHCI
      driver allocates a transfer ring for the endpoint, relying on the data
      snooped and cached in step [2].

      Finally, the USB keyboard driver submits an asynchronous interrupt
      transfer to manage the keyboard. As part of this it asserts [4] that the
      ring has been allocated in step [3].

      And this ASSERT() fires. The root cause can be found in the way QEMU
      handles the initial GET_DESCRIPTOR request.

      Again, that request consists of three stages (TRBs, Transfer Request
      Blocks), "setup", "data", and "status". The XhcCreateTransferTrb()
      function sets the IOC ("Interrupt on Completion") flag in each of these
      TRBs.

      According to the XHCI specification, the host controller shall generate a
      Transfer Event in response to *each* individual TRB of the request that
      had the IOC flag set. This means that QEMU should queue three events:
      setup, data, and status, for edk2's XHCI driver.

      However, QEMU only generates two events:
      - one for the setup (ie. 1st) stage,
      - another for the status (ie. 3rd) stage.

      No event is generated for the middle (ie. data) stage. The loop in QEMU's
      xhci_xfer_report() function runs three times, but due to the "reported"
      variable, only the first and the last TRBs elicit events, the middle (data
      stage) results in no event queued.

      As a consequence:
      - When handling the GET_DESCRIPTOR request, XhcCheckUrbResult() in [1]
        does not update the response length from zero.

      - XhcControlTransfer() thinks that the response is invalid (it has zero
        length payload instead of 18 bytes), hence [2] is not reached; the
        device descriptor is not stashed for later, and the number of possible
        configurations is left at zero.

      - When handling the SET_CONFIG request, (NumConfigurations == 0) from
        above prevents the allocation of the endpoint's transfer ring.

      - When the keyboard driver tries to use the endpoint, the ASSERT() blows
        up.

      The solution is to correct the emulation in QEMU, and to generate a
      transfer event whenever IOC is set in a TRB.

      The patch replaces

        !reported && (IOC || foo)    == !reported && IOC ||
                                        !reported && foo

      with

        IOC || (!reported && foo)    == IOC ||
                                        !reported && foo

      which only changes how

        reported && IOC

      is handled. (Namely, it now generates an event.)

      Tested with edk2 built for "qemu-system-aarch64 -M virt" (ie.
      "ArmVirtualizationQemu.dsc", aka "AAVMF"), and guest Linux.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 22fa7da0005c939c940634da069ecb9bbb199a2a
  Author: Cole Robinson <crobinso@redhat.com>
  Date:   Sun Mar 1 09:29:18 2015 -0500

      hmp: info spice: Show string channel name

      Useful for debugging.

      https://bugzilla.redhat.com/show_bug.cgi?id=822418
      Signed-off-by: Cole Robinson <crobinso@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 20ca3763abbb77ae9942f3e854bdeec36a147a29
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Mon Mar 2 17:01:50 2015 +0100

      qxl: drop update_displaychangelistener call for secondary qxl devices

      Commit 3dcadce5076d4b42fa395c39662d65e050b77784 added three
      update_displaychangelistener call sites:

      Two for primary qxl cards, when entering/leaving vga mode, which are
      correct.

      One for secondary qxl cards, which is wrong because we don't register
      a displaychangelistener in the first place for secondary cards.

      Remove it.

      Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
      Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 619616ce31a5a5d167bf26f40d920b26da0a7bfd
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:53 2015 +0100

      vga: refactor vram_size clamping and rounding

      Make the code a bit more obvious.

      We don't have min/max, so a general helper for clamp probably isn't
      acceptable either.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bb7443f6d6f09411ea10f06e6cb0d416bd1ccebd
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:52 2015 +0100

      qxl: refactor rounding up to a nearest power of 2

      We already have pow2floor, mirror it and use instead of a function with
      similar results (same in used domain), to clarify our intent.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 876d516311c1538a7d29f2abec48b7cda0645eea
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:51 2015 +0100

      spice: fix invalid memory access to vga.vram

      vga_common_init() doesn't allow more than 256 MiB vram size and silently
      shrinks any larger value.  qxl_dirty_surfaces() used the unshrinked size
      via qxl->shadow_rom.surface0_area_size when accessing the memory, which
      resulted in segfault.

      Add a workaround for this case and an assert if it happens again.

      We have to bump the vga memory limit too, because 256 MiB wouldn't have
      allowed 8k (it requires more than 128 MiB).
      1024 MiB doesn't work, but 512 MiB seems fine.

      Proposed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 03d9825d15e17e444e00bd4caa9edb0d57022794
  Author: Radim Krčmář <rkrcmar@redhat.com>
  Date:   Tue Feb 17 17:30:50 2015 +0100

      qxl: document minimal video memory for new modes

      The alternative to removing existing comments.

      Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 76349f5ba8f4e2f0b8c93c12ec0950a8bc77408a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 13:13:47 2015 +0000

      bootdevice: add check in restore_boot_order()

      qemu_boot_set() can't fail in restore_boot_order(),
      then simply assert it doesn't fail, by passing
      &error_abort if boot_set_handler set.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit f05f47bb5f07ca32a23edf1df3dd75f5004f9325
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Feb 3 11:31:09 2015 +0000

      bootdevice: check boot order argument validation before vm running

      Either 'once' option or 'order' option can take effect for -boot at
      the same time, that is say initial startup processing can check only
      one. And pc.c's set_boot_dev() fails when its boot order argument
      is invalid. This patch provide a solution fix this problem:

       1. If "once" is given, register reset handler to restore boot order.

       2. Pass the normal boot order to machine creation.  Should fail when
         the normal boot order is invalid.

       3. If "once" is given, set it with qemu_boot_set().  Fails when the
         once boot order is invalid.

       4. Start the machine.

       5. On reset, the reset handler calls qemu_boot_set() to restore boot
         order.  Should never fail.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 5efde22aa781d37df58f0060430f459491dcfd62
  Merge: 0856579 b3adf5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 01:28:54 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-26' into staging

      QemuOpts: Convert various setters to Error

      # gpg: Signature made Thu Feb 26 13:56:43 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-26:
        qtest: Use qemu_opt_set() instead of qemu_opts_parse()
        pc: Use qemu_opt_set() instead of qemu_opts_parse()
        qemu-sockets: Simplify setting numeric and boolean options
        block: Simplify setting numeric options
        qemu-img: Suppress unhelpful extra errors in convert, amend
        QemuOpts: Propagate errors through opts_parse()
        QemuOpts: Propagate errors through opts_do_parse()
        QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use
        block: Suppress unhelpful extra errors in bdrv_img_create()
        qemu-img: Suppress unhelpful extra errors in convert, resize
        QemuOpts: Convert qemu_opts_set() to Error, fix its use
        QemuOpts: Convert qemu_opt_set_number() to Error, fix its use
        QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bebe80fc78cc91c4225cfb98ef3a916b9c861c60
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Feb 6 14:48:33 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0xc3 as first opcode

      Add helpers helper_addsur_h/_ssov which adds one halfword and subtracts one
      halfword, rounds / and saturates each half word independently.

      Add microcode helper functions:
          * gen_maddsu_h/sus_h: multiply two halfwords left justified and add to the
                                first one word and subtract from the second one word
                                / and saturate each resulting word independetly.
          * gen_maddsum_h/sums_h: multiply two halfwords in q-format left justified
                                  and add to the first one word and subtract from
                                  the second one word / and saturate each resulting
                                  word independetly.
          * gen_maddsur32_h/32s_h: multiply two halfwords in q-format left justified
                                   and add to the first one word and subtract from
                                   the second one word, round both results / and
                                   saturate each resulting word independetly.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit b00aa8ecbc6fd7468178a0dabc7dfd0b7e1b8cd6
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Feb 3 18:36:53 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x43 as first opcode

      Add helpers:
          * madd64_q_ssov: multiply two 32 bit q-format number, add them with a
                           64 bit q-format number and saturate.
          * madd32_q_add_ssov: add two 64 bit q-format numbers and return a 32 bit
                               result.
          * maddr_q_ssov: multiplay two 32 bit q-format numbers, add a 32 bit
                          q-format number and saturate.
          * maddr_q: multiplay two 32 bit q-format numbers and add a 32 bit
                     q-format number.

      Note: madd instructions in the q format can behave strange, e.g.
      0x1 + (0x80000000 * 0x80000000) << 1 for 32 bit signed values does not cause an
      overflow on the guest, because all intermediate results should be handled as if
      they are indefinitely precise. We handle this by inverting the overflow bit for
      all cases: a + (0x80000000 * 0x80000000) << 1.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2e430e1cdcbac8825bc44b42844cbb011b859847
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Jan 29 15:35:56 2015 +0000

      target-tricore: Add instructions of RRR1 opcode format, which have 0x83 as first opcode

      Add helpers:
          * add64_ssov: adds two 64 bit values and saturates the result.
          * addr_h/_ssov: adds two halfwords with two words in q-format with rounding
                          / and saturates each result independetly.

      Add microcode generator:
          * gen_add64_d: adds two 64 bit values.
          * gen_addsub64_h: adds/subtracts one halfwords with a word and adds/
                            subtracts another halftword with another word.
          * gen_madd_h/s_h: multiply four halfwords, add each result left justfied
                            to two word values / and saturate each result.
          * gen_maddm_h/s_h: multiply four halfwords, add each result left justfied
                             to two words values in q-format / and saturate each
                             result.
          * gen_maddr32/64_h/s_h: multiply four halfwords, add each result left
                                  justfied to two halftwords/words values in q-format
                                  / and saturate each result.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2984cfbdb4dbc31d614aaa0303374dff951e7a31
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 14:57:51 2015 +0000

      target-tricore: Add instructions of RRR2 opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 3debbb5af5f63440b170b71bf3aecc0e778f5691
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 28 12:15:05 2015 +0000

      target-tricore: fix msub32_suov return wrong results

      If the signed result of the multiplication overflows, we would get a negative
      value, which would result in a addition instead of a subtraction.

      Now we do the overflow calculation and saturation by hand instead of using
      suov32_neg.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f0cab01b6c9bb9c2f5085837ca86d70d144cca9d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Feb 6 15:06:05 2015 +0000

      target-tricore: Fix RLC_ADDI, RLC_ADDIH using wrong microcode helper

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0856579cac2f1dacecd847cfcd89680d26ff78f5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Mar 3 00:29:17 2015 +0000

      Revert "Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging"

      This reverts commit b8a173b25c887a606681fc35a46702c164d5b2d0, reversing
      changes made to 5de090464f1ec5360c4f30faa01d8a9f8826cd58.

      (I applied this pull request when I should not have done so, and
      am now immediately reverting it.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0b7e89b103b899c21b9ab37dbf9b832db8d18108
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Aug 14 11:39:23 2014 +0100

      trace: add DTrace reserved words for .d files

      DTrace on Mac OS X fails due to trace events using 'self' as an argument
      name:

        GEN   trace/generated-tracers-dtrace.h
      dtrace: failed to compile script trace/generated-tracers-dtrace.dtrace: line 1330: syntax error, unexpected DT_KEY_SELF, expecting ) near "self"
      make: *** [trace/generated-tracers-dtrace.h] Error 1

      Filter argument names according to the list of DTrace .d file reserved
      keywords.

      Note that DTrace on Mac and Linux still do not work after this patch.
      There are additional build issues remaining.

      Reported-by: Henk Poley <henkpoley@gmail.com>
      Tested-by: Henk Poley <henkpoley@gmail.com>
      Cc: Lluís Vilanova <vilanova@ac.upc.edu>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ba795761857082a9bb8c4be1f28e7cdd82f039b0
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Feb 16 16:58:05 2015 +0000

      unbreak dtrace tracing due to double _ in rdma names

      It looks like the dtrace trace code gets upset if you have trace names
      with __ in, which the migration/rdma.c code does.

      Rename the functions and the associated traces.

      Fixes: 733252deb8b7d37beacda5976c2769e18642b2fa

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reported-by: Andreas Färber <afaerber@suse.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Andreas Färber <afaerber@suse.de>
      Message-id: 1424105885-12149-1-git-send-email-dgilbert@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47cbe50cc8d8e59129311bcdb827e1116e935bde
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio-pci: Enable device request notification support

      Linux v4.0-rc1 vfio-pci introduced a new virtual interrupt to allow
      the kernel to request a device from the user.  When signaled, QEMU
      will by default attmempt to hot-unplug the device.  This is a one-
      shot attempt with the expectation that the kernel will continue to
      poll for the device if it is not returned.  Returning the device when
      requested is the expected standard model of cooperative usage, but we
      also add an option option to disable this feature.  Initially this
      opt-out is set as an experimental option because we really should
      honor kernel requests for the device.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6ee47c90081b3ab5980eeef1a8b12b54bac98bb5
  Author: Samuel Pitoiset <samuel.pitoiset@gmail.com>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio: allow to disable MMAP per device with -x-mmap=off option

      Disabling MMAP support uses the slower read/write accesses but allows to
      trace all MMIO accesses, which is not good for performance, but very
      useful for reverse engineering PCI drivers. This option allows to
      disable MMAP per device without a compile-time change.

      Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 51b833f4405426b63b66380117bbe1f4c8976021
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 11:38:55 2015 -0700

      vfio: Make type1 listener symbols static

      They are not used from anywhere but common.c which is where these are
      defined so make them static.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 46f770d4a55ceb21583ac573326f81901a3f1723
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Mon Mar 2 11:38:54 2015 -0700

      vfio: Add ioctl number to error report

      This makes the error report more informative.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 48ce35b7645154eff6b685b3178aacf33f2ff871
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Mar 2 16:14:33 2015 +0100

      acpi: update generated files

      Fixes up build on systems without iasl.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8a173b25c887a606681fc35a46702c164d5b2d0
  Merge: 5de0904 de13197
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 14:25:48 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

      * remotes/ehabkost/tags/x86-pull-request:
        target-i386: Move APIC ID compatibility code to pc.c
        target-i386: Require APIC ID to be explicitly set before CPU realize
        target-i386: Set APIC ID using cpu_index on CONFIG_USER
        linux-user: Check for cpu_init() errors
        target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id
        target-i386: Simplify error handling on cpu_x86_init_user()
        target-i386: Eliminate cpu_init() function
        target-i386: Rename cpu_x86_init() to cpu_x86_init_user()
        target-i386: Move topology.h to include/hw/i386
        target-i386: Eliminate unnecessary get_cpuid_vendor() function
        target-i386: Simplify listflags() function

      Conflicts:
      	target-i386/cpu.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5de090464f1ec5360c4f30faa01d8a9f8826cd58
  Merge: 2dffe55 4bc6a3e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 13:20:43 2015 +0000

      Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

      QOM infrastructure fixes and device conversions

      * Assertion fix for device_add with non-device types
      * Documentation fix
      * qdev_init() error reporting cleanups

      # gpg: Signature made Tue Feb 24 13:56:33 2015 GMT using RSA key ID 3E7E013F
      # gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
      # gpg:                 aka "Andreas Färber <afaerber@suse.com>"

      * remotes/afaerber/tags/qom-devices-for-peter:
        parallel: parallel_hds_isa_init() shouldn't fail
        parallel: Factor out common parallel_hds_isa_init()
        serial: serial_hds_isa_init() shouldn't fail
        serial: Factor out common serial_hds_isa_init()
        etsec: Replace qdev_init() by qdev_init_nofail()
        leon3: Replace unchecked qdev_init() by qdev_init_nofail()
        ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()
        qdev: Improve qdev_init_nofail()'s error reporting
        qom: Fix typo, 'my_class_init' -> 'derived_class_init'
        qdev: Avoid type assertion in qdev_build_hotpluggable_device_list()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2dffe5516e74215fadf2e0f5ee401db4d5a86f7a
  Merge: 041ccc9 dde1111
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Mar 2 12:13:45 2015 +0000

      Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

      NUMA fixes queue

      # gpg: Signature made Mon Feb 23 19:28:42 2015 GMT using RSA key ID 984DC5A6
      # gpg: Can't check signature: public key not found

      * remotes/ehabkost/tags/numa-pull-request:
        numa: Rename set_numa_modes() to numa_post_machine_init()
        numa: Rename option parsing functions
        numa: Move QemuOpts parsing to set_numa_nodes()
        numa: Make max_numa_nodeid static
        numa: Move NUMA globals to numa.c
        vl.c: Remove unnecessary zero-initialization of NUMA globals
        numa: Move NUMA declarations from sysemu.h to numa.h

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 21618b3e55ad2c6fede0bffcaea466091811ce59
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 27 20:01:03 2015 +0100

      cpus: be more paranoid in avoiding deadlocks

      For good measure, ensure that the following sequence:

         thread 1 calls qemu_mutex_lock_iothread
         thread 2 calls qemu_mutex_lock_iothread
         VCPU thread are created
         VCPU thread enters execution loop

      results in the VCPU threads letting the other two threads run
      and obeying iothread_requesting_mutex even if the VCPUs are
      not halted.  To do this, check iothread_requesting_mutex
      before execution starts.

      Tested-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6b49809c597331803ea941eadda813e5bb4e8fe2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 27 19:58:23 2015 +0100

      cpus: fix deadlock and segfault in qemu_mutex_lock_iothread

      When two threads (other than the low-priority TCG VCPU thread)
      are competing for the iothread lock, a deadlock can happen.  This
      is because iothread_requesting_mutex is set to false by the first
      thread that gets the mutex, and then the VCPU thread might never
      yield from the execution loop.  If iothread_requesting_mutex is
      changed from a bool to a counter, the deadlock is fixed.

      However, there is another bug in qemu_mutex_lock_iothread that
      can be triggered by the new call_rcu thread.  The bug happens
      if qemu_mutex_lock_iothread is called before the CPUs are
      created.  In that case, first_cpu is NULL and the caller
      segfaults in qemu_mutex_lock_iothread.  To fix this, just
      do not do the kick if first_cpu is NULL.

      Reported-by: Leon Alrae <leon.alrae@imgtec.com>
      Reported-by: Andreas Gustafsson <gson@gson.org>
      Tested-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f6758f7d6b8b483eb1d061937ed06da830c1ecb8
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 27 12:11:53 2015 -0500

      virtio-scsi: Allocate op blocker reason before blocking

      s->blocker is really only used in hw/scsi/virtio-scsi.c; the only places
      where it is used in hw/scsi/virtio-scsi-dataplane.c is when it is
      allocated and when it is freed. That does not make a whole lot of sense
      (and is actually wrong because this leads to s->blocker potentially
      being NULL when blk_op_block_all() is called in virtio-scsi.c), so move
      the allocation and destruction of s->blocker to the device realization
      and unrealization in virtio-scsi.c, respectively.

      Case in point:

      $ echo -e 'eject drv\nquit' | \
          x86_64-softmmu/qemu-system-x86_64 \
              -monitor stdio -machine accel=qtest -display none \
              -object iothread,id=thr -device virtio-scsi-pci,iothread=thr \
              -drive if=none,file=test.qcow2,format=qcow2,id=drv \
              -device scsi-cd,drive=drv

      Without this patch:

      (qemu) eject drv
      [1]    10102 done
             10103 segmentation fault (core dumped)

      With this patch:

      (qemu) eject drv
      Device 'drv' is busy: block device is in use by data plane
      (qemu) quit

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Message-Id: <1425057113-26940-1-git-send-email-mreitz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 92144c70939d9d029807c10a038acd07289f71bd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:52 2015 +0100

      Makefile.target: binary depends on config-devices

      relink binary whenever config-devices.mak changes:
      this makes sense as we are adding/removing devices,
      so binary has to be relinked to be up to date.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e32dccddb0b1fa335bf251c155e907f9d47accfd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Mar 1 19:39:36 2015 +0100

      acpi-test-data: update after pci rewrite

      more trivial changes as more code has been rewritten in C.
      we also got rid of extra Scope operators.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1d51570166171cd85dfcd08b2eac2f02a3fda6fe
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Thu Feb 26 09:16:43 2015 +0800

      acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb().

      Replace string "slot" in acpi_memory_plug_cb() with macro PC_DIMM_SLOT_PROP.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit f51074cdc6e750daa3b6df727d83449a7e42b391
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 26 17:21:13 2015 +0100

      pci-hotplug-old: Has been dead for five major releases, bury

      Commit 79ca616 (v1.6.0) accidentally disabled legacy x86-only HMP
      commands pci_add, pci_del: it defined CONFIG_PCI_HOTPLUG only as make
      variable, not as preprocessor macro, killing the code conditional on
      defined(CONFIG_PCI_HOTPLUG_OLD).

      In all this time, nobody reported the loss.  I only noticed it when I
      tried to test some error reporting change that forced me to touch this
      old crap again.

      Fun: git-log hw/pci/pci-hotplug-old.c shows our faith in the backward
      compatibility god has been strong enough to sacrifice at its altar
      about a dozen times, but not strong enough to even once verify the
      legacy feature's still there, let alone works.

      Remove the commands along with the code backing them.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6dbcb81956b16d794c9c0257b94bd4c6feba713f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 26 17:21:14 2015 +0100

      pci: Give a few helpers internal linkage

      None of them should be used in new code.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit af59b35ce1aa3e69488e7308b632d5af2ac54948
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:20 2015 +0000

      acpi: make build_*() routines static to aml-build.c

      build_*() routines were used for composing AML
      structures manually in acpi-build.c but after
      conversion to AML API they are not used outside
      of aml-build.c anymore, so hide them from external
      users.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 72f15d6e53485e8d1754e56e0013bed2e5816fa8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:19 2015 +0000

      pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 62b52c266582d3241a468dc08dbaa81e337cb03f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:18 2015 +0000

      pc: acpi-build: drop template patching and create PCI bus tree dynamically

      Replace AML template patching with direct composing
      of PCI device entries in C. It allows to simplify
      PCI tree generation further and saves us about 400LOC
      scattered through different files, confining tree
      generation to one C function which is much easier
      to deal with.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 752bba815ec5b67e2aa6d7c86fd2be80e45c203b
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:17 2015 +0000

      tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b23046abe78f48498a423b802d6d86ba0172d57f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:16 2015 +0000

      pc: acpi-build: simplify PCI bus tree generation

      it basicaly does the same as original approach,
      * just without bus/notify tables tracking (less obscure)
        which is easier to follow.
      * drops unnecessary loops and bitmaps,
        creating devices and notification method in the same loop.
      * saves us ~100LOC

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71096d6cc5b4341e9b7ee59f10594d5f36ce12b9
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:15 2015 +0000

      tests: add ACPI blobs for qemu with bridge cases

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3a9c86df2169881978e697109ae9bb8a6ce41e92
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:14 2015 +0000

      tests: bios-tables-test: add support for testing bridges

      Adds alternative ACPI table blob selection for testing
      non default QEMU configurations. If blob file for test
      variant is not present, fallback to default blob.

      With this change implement testing with a coldplugged
      bridge.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 194c8615d7d819887180f196675ba987c4bf43bc
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:13 2015 +0000

      tests: ACPI test blobs update due to PCI0._CRS changes

      PCI0._CRS was moved into SSDT and became the same for
      PIIX4/Q35 machines.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8ac6f7a6d64386426daa6c34676d296cafe19a80
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:12 2015 +0000

      pc: acpi-build: drop template patching and create Device(SMC) dynamically

      patch moves SMC device into SSDT and creates it only
      when device is present, which makes ACPI tables smaller
      in default case when device is not present.

      Also it fixes wrong IO range in CRS if "iobase"
      property is set to a non default value.

      PS:
      Testing with XP shows that current default "iobase"
      used SMC device conflicts with floppy controller IO,
      but it's topic for another patch and I'd leave it
      to SMC device author for resolving conflict.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      CC: agraf@suse.de
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1142e45ffdc5bf76ae920a25495e13223f5d5ed2
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:11 2015 +0000

      pc: export applesmc IO port/len

      IO port and length will be used in following patch
      to correctly generate SMC ACPI device in SSDT.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7056045332b997a8cd298e3bf231ecf690accdf4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:10 2015 +0000

      acpi: add acpi_irq_no_flags() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 4ec8d2b3f54dd1dcd9e2a80e529feff4e2603288
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:09 2015 +0000

      pc: acpi-build: drop remaining ssdt_misc template

      It drops empty ssdt_misc templete. It also hides
      from user almost all pointer arithmetic when building
      SSDT which makes resulting code a bit cleaner
      and concentrating only on composing ASL construct
      /i.e. a task build_ssdt() should be doing/.

      Also it makes one binary blob less stored in QEMU
      source tree by removing need to keep and update
      hw/i386/ssdt-misc.hex.generated file here in total
      saving us ~430LOC.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d31c909e57a131dec7a1e620f36573f2f5fca9e5
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:08 2015 +0000

      pc: acpi: drop manual hole punching for GPE0 resources

      Drops manual hole punching in PCI0._CRS on PIIX4 machine type
      for GPE0 resources. Resources will be consumed by Device(GPE0)
      that is attached to PCI namespace.
      There is GPE device with HID ACPI0006 since ACPI2.0
      that should be used for this purpose but none of Windows
      versions support it and show it as "unknown device",
      so reserve resource in old fashioned way with PNP0A06
      device to make windows happy and actually reserve resources.

      Along with last hole _CRS layout of PIIX4 machine becomes
      the same as Q35 one, so merge them together and use the same
      _CRS for both machine types.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c2d9c595ade376ad4c94c8c2cab23fd6f50805f7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:07 2015 +0000

      pc: acpi: drop manual hole punching for CPU hotplug resources

      Drops manual hole punching in PCI0._CRS on PIIX4 machine type
      for CPU hotplug resources.
      Resources will be consumed by Device(PRES) that is attached
      to PCI bus. The same way how it currently works for mem hotlpug.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8bec1a0a78203d2555b7446efa7ebe5d2601f79a
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:06 2015 +0000

      pc: acpi: drop manual hole punching for PCI hotplug resources

      Drops manual hole punching in PCI0._CRS for PIIX4 machine type.
      Resources will be consumed by Device(PHPR) that cwis attached
      to PCI bus. The same way how it currently works for mem hotlpug.

      Manual hole in PIIX4 _CRS wasn't correct anyway since it was
      legacy size 0xF while current PCIHP MMIO region is of size 0x14.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 60efd4297d44a1ac41ae46485098919376fdcab4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Feb 20 18:22:05 2015 +0000

      pc: acpi-build: create PCI0._CRS dynamically

      Replace template patching and runtime calculation
      in _CRS() method with static _CRS defined in SSDT.
      No functional change except of as mentined above
      and _CRS being moved from DSDT to SSDT.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9dd5c40ddfe332d8a03034d8e01208e5e1a4f5f7
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:20 2015 -0500

      tpm: Support for capability flags of TIS 1.3

      Provide the TIS 1.3 capability flags.
      The interface now looks like a TIS 1.3 interface. It's fully
      compatible with previous TIS 1.2 and drivers written for
      TIS 1.2 continue to work.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit fd859081453f94c3cbd6527289e41b7fddbf645f
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:19 2015 -0500

      tpm: Support for TIS selftest done flag

      Extend the backend to check whether the TPM_ContinueSelfTest
      finished successfully and provide a flag to the TIS front-end
      if it successfully finished. The TIS then sets a flag in
      all localities in the STS register and keeps it until the next
      reset.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2eae8c7516a99c1309199df8d88c0f0749fce2cb
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:18 2015 -0500

      tpm: Support for XFIFO register

      Support for the XFIFO register (range) of the TIS 1.3 specification.
      We support a range of 64 bytes.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit feeb755fde70e34dbec9709f3dab439172cf5153
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:17 2015 -0500

      tpm: Allow 32 & 16 bit accesses to the registers

      Improve the access to the registers with 32 and 16 bit reads and writes.
      Also enable access to a non-base register address, such as reads of the
      2nd byte of a register. Map the FIFO byte access to any byte within
      its 4 byte register (following specs).

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fdc694635ebf275763aa2eee721f69e556fba5e
  Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
  Date:   Mon Feb 23 09:27:16 2015 -0500

      tpm: Extend sts register to 32 bit

      More recent TIS specs extend the STS register to 32 bit. While
      we don't store the TIS interface state, yet, we can extend it
      without sideeffects.

      Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a6027b0f4bb4d8c8f14ac5fd8cbf05f5f7c6a503
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Thu Jan 29 17:24:41 2015 +0300

      balloon: call qdev_alias_all_properties for proxy dev in balloon class init

      The idea is that all other virtio devices are calling this helper
      to merge properties of the proxy device. This is the only difference
      in between this helper and code in inside virtio_instance_init_common.
      The patch should not cause any harm as property list in generic balloon
      code is empty.

      This also allows to avoid some dummy errors like fixed by this
          commit 91ba21208839643603e7f7fa5864723c3f371ebe
          Author: Gonglei <arei.gonglei@huawei.com>
          Date:   Tue Sep 30 14:10:35 2014 +0800
          virtio-balloon: fix virtio-balloon child refcount in transports

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Raushaniya Maksudova <rmaksudova@parallels.com>
      Revieved-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      CC: Christian Borntraeger <borntraeger@de.ibm.com>
      CC: Anthony Liguori <aliguori@amazon.com>
      CC: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a9ad5e1efcbbdf4b34bd7679613605efdb41bd04
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:52 2015 +0100

      Makefile.target: binary depends on config-devices

      relink binary whenever config-devices.mak changes:
      this makes sense as we are adding/removing devices,
      so binary has to be relinked to be up to date.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1424332114-13440-2-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 12ccfec9684679fc1945b5b5020487b2cb17dc06
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 08:48:46 2015 +0100

      Makefile: don't silence mak file test with V=1

      V=1 should show what's going on, it's not nice
      to silence things unconditionally.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Message-Id: <1424332114-13440-1-git-send-email-mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 23cab7b7a9cb365b15eee953a0dd6cdb9198ae6c
  Author: Vasily Efimov <real@ispras.ru>
  Date:   Wed Feb 18 15:59:37 2015 +0300

      Makefile: fix up parallel building under MSYS+MinGW

      This patch enables parallel building of QEMU in MSYS+MinGW environment.
      Currently an attempt to build QEMU in parallel fails on generation of
      version.lo (and version.o too).

      The cause of the failure is that when listing prerequisites "Makefile"
      references "config-host.h" by absolute path in some rules and by relative
      path in others. Make cannot figure out that these references points to the
      same file which leads to the race: the generation of "version.*" which
      requires "$(BUILD_DIR)/config-host.h" is launched in parallel with the
      generation of "config-host.h" needed by other "Makefile" targets.

      This patch removes "$(BUILD_DIR)/" prefix from corresponding prerequisite
      of "version.*". There is no other prerequisites "$(BUILD_DIR)/config-host.h"
      found.

      Also note that not every version of MSYS is able to build QEMU in parallel,
      see: "http://sourceforge.net/p/mingw/bugs/1950/". The suggested version is
      1.0.17.

      Signed-off-by: Vasily Efimov <real@ispras.ru>
      Message-Id: <1424264377-5992-1-git-send-email-real@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43ae8fb10c5f6ca78f242624c1f446e0050a9d43
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Feb 25 12:40:08 2015 +0800

      iscsi: Handle write protected case in reopen

      Save the write protected flag and check before reopen.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1424839208-5195-1-git-send-email-famz@redhat.com>
      [Fixed typo in the name of the new field. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8af738b3eecf69a795c6ff78121edbb81ab03684
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:37 2015 +1100

      Give ivshmem its own config option

      Currently the ivshmem device is built whenever both PCI and KVM support are
      included.  This patch gives it its own config option to allow easier
      customization of whether to include it.  It's enabled by default in the
      same circumstances as now - when both PCI and KVM are available.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425017077-18487-4-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2296594257d11a253d12f0219eef3f1a0201c2d9
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:36 2015 +1100

      Create specific config option for "platform-bus"

      Currently the "platform-bus" device is included for all softmmu builds.
      This bridge is intended for use on any platforms that require dynamic
      creation of sysbus devices.  However, at present it is used only for the
      PPC E500 target, with plans for the ARM "virt" target in the immediate
      future.

      To avoid a not-very-useful entry appearing in "qemu -device ?" output on
      other targets, this patch makes a specific config option for platform-bus
      and enables it (for now) only on ppc configurations which include E500
      and on ARM (which always includes the "virt" target).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Message-Id: <1425017077-18487-3-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4681867544f04f752bd98f39c3055493c80ea316
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Feb 27 17:04:35 2015 +1100

      Add specific config options for PCI-E bridges

      The i82801b11, ioh3420 and xio3130 PCI Express devices are currently
      included in the build unconditionally.

      While they could theoretically appear on any target platform with PCI-E,
      they're pretty unlikely to appear on platforms that aren't Intel derived.

      Therefore, to avoid presenting unlikely-to-be-relevant devices to the user,
      add config options to enable these components, and enable them by default
      only on x86 and arm platforms.

      (Note that this patch does include these for aarch64, via its inclusion of
      arm-softmmu.mak).

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-Id: <1425017077-18487-2-git-send-email-david@gibson.dropbear.id.au>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 57fe6a6e4a050f639ac3d2f7c32b4cd3bcde3978
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Feb 27 09:49:44 2015 +0800

      bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'

      Reproducer:

       $./qemu-system-x86_64 --enable-kvm -kernel /home/vmlinuz-2.6.32.12-0.7-default \
        -initrd /home/initrd-2.6.32.12-0.7-default -append \
       "root=/dev/ram rw console=ttyS0,115200" -dtb guest.dtb -vnc :10 --monitor stdio -smp 2
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) Segmentation fault (core dumped)

      Reported-by: Edivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Message-Id: <1425001784-6752-1-git-send-email-arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2ed1ebcf65edf6757d8904000889ce52cc0a9d1b
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Fri Feb 27 16:11:02 2015 +0300

      timer: replace time() with QEMU_CLOCK_HOST

      This patch replaces time() function calls with calls to
      qemu_clock_get_ns(QEMU_CLOCK_HOST). It makes such requests deterministic
      in record/replay mode of icount.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Message-Id: <20150227131102.11912.89850.stgit@PASHA-ISP>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0543055967e554b5be10c3f96c077bf26dcaf181
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Feb 15 11:06:31 2015 +0800

      virtio-scsi-dataplane: Call blk_set_aio_context within BQL

      It's not safe to call blk_set_aio_context from outside BQL because of
      the bdrv_drain_all there. Let's put it in the hotplug callback which
      will be called by qdev device realization for each scsi device attached
      to the bus.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-Id: <1423969591-23646-3-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e5b887cfc69991eee27be6cc0938c70a360fe45
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Feb 15 11:06:30 2015 +0800

      block: Forbid bdrv_set_aio_context outside BQL

      Even if the caller has both the old and the new AioContext's, there can
      be a deadlock, due to the leading bdrv_drain_all.

      Suppose there are four io threads (A, B, A0, B0) with A and B owning a
      BDS for each (bs_a, bs_b); Now A wants to move bs_a to iothread A0, and
      B wants to move bs_b to B0, at the same time:

        iothread A                           iothread B
      --------------------------------------------------------------------------
        aio_context_acquire(A0) /* OK */     aio_context_acquire(B0) /* OK */
        bdrv_set_aio_context(bs_a, A0)       bdrv_set_aio_context(bs_b, B0)
        -> bdrv_drain_all()                  -> bdrv_drain_all()
           -> acquire A /* OK */               -> acquire A /* blocked */
           -> acquire B /* blocked */          -> acquire B
           ...                                 ...

      Deadlock happens because A is waiting for B, and B is waiting for A.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1423969591-23646-2-git-send-email-famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2264750483107c45877d29813c497b4c87f64cb6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Feb 19 17:05:46 2015 +0100

      scsi: give device a parent before setting properties

      This mimics what is done in qdev_device_add, and lets the device be
      freed in case something goes wrong.  Otherwise, object_unparent returns
      immediately without freeing the device, which is on the other hand left
      in the parent bus's list of children.

      scsi_bus_legacy_handle_cmdline then returns an error, and the HBA is
      destroyed as well with object_unparent.  But the lingering device that
      was not removed in scsi_bus_legacy_add_drive cannot be removed now either,
      and bus_unparent gets stuck in an infinite loop trying to empty the list
      of children.

      The right fix of course would be to assert in bus_add_child that the
      device already has a bus, and remove the "safety net" that adds the
      drive to the QOM tree in device_set_realized.  I am not yet sure whether
      that would entail changing all callers to qdev_create (as well as
      isa_create and usb_create and the corresponding _try_create versions).

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Tested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b3adf5acb57dee14a74e57ab4f16cd1a83e5a7d2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:48:19 2015 +0100

      qtest: Use qemu_opt_set() instead of qemu_opts_parse()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 5bdb59a290cfc7332fdc23c6368310e0327e3828
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:46:36 2015 +0100

      pc: Use qemu_opt_set() instead of qemu_opts_parse()

      Less code, same result.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 62b3de693469508a58864bffefd3d54f897558b4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:51:56 2015 +0100

      qemu-sockets: Simplify setting numeric and boolean options

      Don't convert numbers or bools to strings for use with qemu_opt_set(),
      simply use qemu_opt_set_number() or qemu_opt_set_bool() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a8b18f8fd2d9f0df33c3739e76fedfd9355dfa8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 13 15:50:43 2015 +0100

      block: Simplify setting numeric options

      Don't convert numbers to strings for use with qemu_opt_set(), simply
      use qemu_opt_set_number() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit dc523cd348c47372faa7271c9aab2030f94c290d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 18:37:11 2015 +0100

      qemu-img: Suppress unhelpful extra errors in convert, amend

      img_convert() and img_amend() use qemu_opts_do_parse(), which reports
      errors with qerror_report_err().  Its error messages aren't helpful
      here, the caller reports one that actually makes sense.  Reproducer:

          $ qemu-img convert -o backing_format=raw in.img out.img
          qemu-img: Invalid parameter 'backing_format'
          qemu-img: Invalid options for file format 'raw'

      To fix, propagate errors through qemu_opts_do_parse().  This lifts the
      error reporting into callers.  Drop it from img_convert() and
      img_amend(), keep it in qemu_chr_parse_compat(), bdrv_img_create().

      Since I'm touching qemu_opts_do_parse() anyway, write a function
      comment for it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 4f81273dd9e036f9009ab902a2617a1167cf796d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 18:24:10 2015 +0100

      QemuOpts: Propagate errors through opts_parse()

      Since I'm touching qemu_opts_parse() anyway, write a function comment
      for it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit d93ae3cfb9ec36ea53d8ff24af812db6dd9bb62a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:59:06 2015 +0100

      QemuOpts: Propagate errors through opts_do_parse()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit f43e47dbf6de24db20ec9b588bb6cc762093dd69
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:52:20 2015 +0100

      QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use

      qemu_opt_set() is a wrapper around qemu_opt_set() that reports the
      error with qerror_report_err().

      Most of its users assume the function can't fail.  Make them use
      qemu_opt_set_err() with &error_abort, so that should the assumption
      ever break, it'll break noisily.

      Just two users remain, in util/qemu-config.c.  Switch them to
      qemu_opt_set_err() as well, then rename qemu_opt_set_err() to
      qemu_opt_set().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6be4194b9215ed29f258543ce34a1b4b2003864d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:49:02 2015 +0100

      block: Suppress unhelpful extra errors in bdrv_img_create()

      bdrv_img_create() uses qemu_opt_set(), which reports errors with
      qerror_report_err().  Its error messages aren't helpful here, the
      caller reports one that actually makes sense.  I don't know how to
      trigger the error conditions, though.

      Switch to qemu_opt_set_err() to get rid of the unwanted messages.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6750e795b167e3defab36502e61b8c57ede119eb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:43:08 2015 +0100

      qemu-img: Suppress unhelpful extra errors in convert, resize

      add_old_style_options() for img_convert() and img_resize() use
      qemu_opt_set(), which reports errors with qerror_report_err().  Its
      error messages aren't helpful here, the caller reports one that
      actually makes sense.  Reproducer:

          $ qemu-img convert -B raw in.img out.img
          qemu-img: Invalid parameter 'backing_file'
          qemu-img: Backing file not supported for file format 'raw'

      Switch to qemu_opt_set_err() to get rid of the unwanted messages.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 79087c782e1549a6f9c8303aafc0b74f4e637756
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 17:07:34 2015 +0100

      QemuOpts: Convert qemu_opts_set() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 39101f2511f6adf1ae4380f8d729dba1213b9d7a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 16:46:36 2015 +0100

      QemuOpts: Convert qemu_opt_set_number() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit cccb7967bdf19f9d31e65d2d07d4d311e07545c4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 16:37:44 2015 +0100

      QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use

      Return the Error object instead of reporting it with
      qerror_report_err().

      Change callers that assume the function can't fail to pass
      &error_abort, so that should the assumption ever break, it'll break
      noisily.

      Turns out all callers outside its unit test assume that.  We could
      drop the Error ** argument, but that would make the interface less
      regular, so don't.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 041ccc922ee474693a2869d4e3b59e920c739bc0
  Merge: 2559db0 912ae9c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 12:16:46 2015 +0000

      Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging

      * remotes/qmp-unstable/queue/qmp:
        qapi-types: add C99 index names to arrays
        monitor: Fix missing err = NULL in client_migrate_info()
        balloon: Fix typo
        hmp: Fix warning from smatch (wrong argument in function call)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dc33c0293505db9c747a6e27487a808ab2b62a6f
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 22:29:26 2015 +0100

      acpi-test: update expected files

      A bunch of code moved from dsdt to ssdt,
      plus we got trivial changes like 0->Zero which our test
      dosn't recognize as identity yet.
      Update expected files to suppress test warning.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit dd6b6b0c833ec7333056c55dbb8e518241aceefd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 21:45:11 2015 +0100

      acpi: drop unused generated files

      drop ssdt-mem.hex.generated and ssdt-proc.hex.generated:
      dsl files have been removed previously.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7ff3bc2e112514f001cb24f3ec16bda8ba7826fc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 21:43:48 2015 +0100

      acpi: update generated hex files

      Used for IASL builds.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 500b11ea5095ae77da5ddd6dd12f6c485b516a91
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:50 2015 +0000

      pc: acpi-build: reserve PCIHP MMIO resources

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 78c2d8722b9118509e3d4ed8bae67c3e4eaa443e
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:49 2015 +0000

      pc: pcihp: expose MMIO base and len as properties

      it will be used later to dynamically reserve MMIO region
      instead of manually punching holes in PCI0._CRS

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6ece7053d6a4a502d2ea5d24ecf512caaa1437c7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:48 2015 +0000

      acpi: add aml_word_bus_number(), aml_word_io(), aml_dword_memory(), aml_qword_memory() terms

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2c6b94d84e3677a40905c42604cf4cd4ef6f3a8e
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:47 2015 +0000

      pc: acpi-build: create memory hotplug IO region dynamically

      it replaces a static complied in DSDT MMIO region
      for memory hotplug with one created at runtime
      leaving only truly static memory hotplug related
      ASL bits in DSDT. And replaces template patching
      of MEMORY_SLOTS_NUMBER value with ASL API created
      named value.

      Later it also would make easier to reuse current
      ACPI memory hotplug on other targets.

      Also later it would be possible to move remaining
      memory hotplug ASL methods into build_ssdt() and
      add all memory hotplug related AML into SSDT only
      when memory hotplug is enabled, further reducing
      ACPI tables blob if memory hotplug isn't used.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 8698c0c0ed1ff3751ef91b61c0006620d5431be4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:46 2015 +0000

      pc: acpi-build: drop template patching and memory hotplug objects dynamically

      in addition it saves us ~330LOC and makes it one binary blob less
      stored in QEMU source tree by removing need to keep and update
      hw/i386/ssdt-mem.hex.generated file there.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e2ea299b01fbd9d4d0262cfbfcbdbd02ada984a5
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:45 2015 +0000

      acpi: add aml_reserved_field() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ddf1ec2ffe30bd6bb34acc020622741eafc16b79
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:44 2015 +0000

      pc: acpi-build: create CPU hotplug IO region dynamically

      it replaces a static complied in DSDT MMIO region
      for CPU hotplug with one created at runtime
      leaving only truly static CPU hotplug related ASL
      bits in DSDT.
      It also puts CPU_HOTPLUG_RESOURCE_DEVICE into
      PCI0 scope and reserves resources from it,
      preparing for dropping manual hole punching
      in PCI0._CRS.

      Later it also would make easier to reuse current
      ACPI CPU hotplug on other targets.

      Also later it would be possible to move remaining
      CPU hotplug ASL methods into build_ssdt() and
      add all CPU hotplug related AML into SSDT only
      when CPU hotplug is enabled, further reducing
      ACPI tables blob if CPU hotplug isn't used.

      impl. detail:
      Windows XP can't handle /BSODs/ OperationRegion
      declaration in DSDT when variable from SSDT is used
      for specifying its address/length and also when
      Field declared in DSDT with OperationRegion from
      SSDT if DSDT is being parsed before SSDT.
      But it works just fine when referencing named
      fields from another table. Hence OperationRegion
      and Field declaration are moved to SSDT to make
      XP based editions work.

      PS:
      Later Windows editions seem to be fine with above
      conditions.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 20843d16632c4da3d3d35ddc8d5eb047167693ce
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:43 2015 +0000

      pc: acpi-build: drop template patching and CPU hotplug objects dynamically

      in addition it saves us ~400LOC and makes it
      one binary blob less stored in QEMU source
      tree by removing need to keep and update
      hw/i386/ssdt-proc.hex.generated file there.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a7891dacadebb9c02e027c456a1d17ea0bdf6df8
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:42 2015 +0000

      acpi: add aml_eisaid() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3dd156435369153c1c1d890b9ef525f1d033a971
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:41 2015 +0000

      acpi: add aml_processor() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 15e44e56d7da9d4569c10aa8de5f109a71570670
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:40 2015 +0000

      acpi: add aml_equal() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a678508e46ac806d81bd401a483aef1b98734ae4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:39 2015 +0000

      acpi: add aml_varpackage() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cd61cb2e2c02c5c257a15a52b3d0616474e52997
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:38 2015 +0000

      pc: acpi-build: generate pvpanic device description dynamically

      Drops AML template patching and allows to
      save some space in SSDT if pvpanic device doesn't
      exist by not including disabled device description
      into SSDT. It also makes device description
      smaller by replacing _STA method with named value
      and dropping _INI method.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d5e5830f56452d857f9c26c06a886f09056482c1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:37 2015 +0000

      acpi: add aml_string() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b8a5d6894d94c8f7e815c64adff78b0d28a98ca6
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:36 2015 +0000

      acpi: add aml_local() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 214ae59f8e1c33db0f3fbbc4347bb3dacc6ce876
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:35 2015 +0000

      acpi: add aml_field() & aml_named_field() terms

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 31127938f496f56eb05dc407a31e4c5941fb436a
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:34 2015 +0000

      acpi: add aml_operation_region() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 19fff2d405d3bcc88fd7b860ec47797b3f7af977
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:33 2015 +0000

      acpi: include PkgLength size only when requested

      Named/Reserved{Field} definition uses PkgLength [1] encoding to specify
      field length, however it doesn't include size of PkgLength field itself,
      while other block objects that have explicit length of its body account
      for PkgLength size while encoding it [2].
      This special casing isn't mentioned in ACPI spec, but that's what 'iasl'
      compiles NamedField to so add extra argument to build_prepend_pkg_length()
      to allow it handle the case.

      --
      1. ACPI Spec 5.0, 20.2.5.2 Named Objects Encoding, page 822
      2. ACPI Spec 5.0, 5.4 Definition Block Encoding

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 52fa397c58667080979e8aa64177c0f69b1851b7
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:32 2015 +0000

      acpi: add aml_io() helper

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ad4a80bc6f4aa7ce8e67e924574521f04b8b19a4
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:31 2015 +0000

      acpi: add aml_resource_template() helper

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 04b8da543dd16afaea014032939db4cb54b15459
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:30 2015 +0000

      acpi: add aml_buffer() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ebc3028f7a2a164e442d734868e4168aa6040c81
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:29 2015 +0000

      pc: acpi-build: generate _S[345] packages dynamically

      Replaces template patching with packages composed
      using AML API.

      Note on behavior change:
      If S3 or S4 is disabled, respective packages won't
      be created and put into SSDT. Which saves us some
      space in SSDT and doesn't confuse guest OS with
      mangled package names as it was done originally.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3bfa74a7e8c0787877e0f23a873413ad8817c66c
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:28 2015 +0000

      acpi: add aml_package() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3f3992b7c4ed9850e7f5502a1294cd017a891b38
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:27 2015 +0000

      acpi: add aml_call1(), aml_call2(), aml_call3(), aml_call4() helpers

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 34189453f1783c934d3824ff4636684f3ab20810
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:26 2015 +0000

      acpi: add aml_notify() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 926f5aaefad164dabcdd771f4c15c9773383d9e9
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:25 2015 +0000

      acpi: add aml_and() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c263b3f754325ae76946a5ea0e1df9368fe289bd
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:24 2015 +0000

      acpi: add aml_store() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7193f3a67ee4794096255396eeac99f9624144e1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:23 2015 +0000

      acpi: add aml_arg() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit b25af5ad5953c9587e59c82cc668e574384f5245
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:22 2015 +0000

      acpi: add aml_return() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 295a515df0df655a902df6ebfc301096a3ee88ed
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:21 2015 +0000

      acpi: add aml_int() term

      * factor out ACPI const int packing out of build_append_value()
        and rename build_append_value() to build_append_int_noprefix()
        it will be reused for adding a plain integer value into AML.
        will be used by is aml_processor() and CRS macro helpers
      * extend build_append_int{_noprefix}() to support 64-bit values
        it will be used PCI for generating 64bit _CRS entries

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 3c054bd51a132a69e5180f8c6ffa9d46724e4a50
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:20 2015 +0000

      acpi: add aml_name() & aml_name_decl() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 32acac9eb3478cb1229654883f938ab21d28d998
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:19 2015 +0000

      acpi: add aml_if() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ea2407d7e8adae1ab6cd0ca0366752d101d2344f
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:18 2015 +0000

      acpi: add aml_method() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit be06ebd0a4d42ccd3d79fae24e48c264be377356
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:17 2015 +0000

      acpi: add aml_device() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 011bb7490bf32d84e644d79570f603651e4f80cb
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:16 2015 +0000

      pc: acpi-build: use aml_scope() for \_SB scope

      prepares for incremental conversion of SSDT content to AML API

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2ef7c27b78c663557771076b45e6f4be1b3c78d6
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:15 2015 +0000

      acpi: add aml_scope() term

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0f2707e4e733614f2cd566e7210c1cff6f3b5b42
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Wed Feb 18 19:14:14 2015 +0000

      acpi: introduce AML composer aml_append()

      Adds for dynamic AML creation, which will be used
      for piecing ASL/AML primitives together and hiding
      from user/caller details about how nested context
      should be closed/packed leaving less space for
      mistakes and necessity to know how AML should be
      encoded, allowing user to concentrate on ASL
      representation instead.

      For example it will allow to create AML like this:

      init_aml_allocator();
      ...
      Aml *scope = aml_scope("PCI0")
      Aml *dev = aml_device("PM")
          aml_append(dev, aml_name_decl("_ADR", aml_int(addr)))
      aml_append(scope, dev);
      ...
      free_aml_allocator();

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e0d2be2ad6461ccdcf3e3930742a6b18a7ee5eb8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:37:35 2015 +0100

      virtio_ring.h: s/__inline__/inline/

      Thomas Huth noticed that some linux headers
      use __inline__, change to inline to be consistent
      with the rest of QEMU.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 714e601379e125cde88bea6d4a3ea8f78ffbdf62
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:44:35 2015 +0100

      standard-headers: include stdint.h

      The importing script got it right already, I just forgot to re-run it.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6a19cd34b175bfc99bf5aa877e6e8eda636848f9
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:42:30 2015 +0100

      virtio-serial-bus.c: drop virtio_ids.h

      virtio-serial.h pulls that in already.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit c16758cb4f273f72606cd9002fa31c2651822fcd
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Feb 18 16:37:35 2015 +0100

      update-linux-headers.sh: s/__inline__/inline/

      Thomas Huth noticed that some linux headers
      use __inline__, change to inline to be consistent
      with the rest of QEMU.

      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7c2c1fa5f428b7087721f7312ee82b9de05da6ca
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 10:53:24 2015 +0000

      pc: acpi: use local var for accessing ACPI tables blob in acpi_build()

      except of shortening of lines and making code a bit more readable,
      it will reduce renaming noise when changing tables blob from GArray* to
      Aml* type.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a20275fa502f57a50517d31c6b770e0eeff8feca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jan 28 18:30:38 2015 +0200

      acpi-build: skip hotplugged bridges

      hotplugged bridges don't get bsel allocated so acpi hotplug doesn't work
      for them anyway.  OTOH adding them in ACPI creates a host of problems,
      e.g. they can't be hot-unplugged themselves which is surprising to
      users.

      So let's just skip these.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ef546f1275f6563e8934dd5e338d29d9f9909ca6
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:06 2014 +0100

      virtio: add feature checking helpers

      Add a helper function for checking whether a bit is set in the guest
      features for a vdev as well as one that works on a feature bit set.

      Convert code that open-coded this: It cleans up the code and makes it
      easier to extend the guest feature bits.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0cd09c3a6cc2230ba38c462fc410b4acce59eb6f
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:05 2014 +0100

      virtio: feature bit manipulation helpers

      Add virtio_{add,clear}_feature helper functions for manipulating a
      feature bits variable. This has some benefits over open coding:
      - add check that the bit is in a sane range
      - make it obvious at a glance what is going on
      - have a central point to change when we want to extend feature bits

      Convert existing code manipulating features to use the new helpers.

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit a590fd5ba8f01724eee169f097f65603f0c3a8f8
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Thu Dec 11 14:25:04 2014 +0100

      virtio: cull virtio_bus_set_vdev_features

      The only user of this function was virtio-ccw, and it should use
      virtio_set_features() like everybody else: We need to make sure
      that bad features are masked out properly, which this function did
      not do.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit ad67a0f278ff9ad036a986384f1e3e94717af08e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:58 2015 +0100

      s390: use standard headers

      Drop duplicated macros in favor of values from
      standard headers.

      Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9abd373c645050c958763d66107685f1512f843c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:53 2015 +0100

      standard-headers: add s390 virtio headers

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 44fb1dd4cef6d8be87cef7437fb350d0ebf2f837
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:48 2015 +0100

      scripts: add arch specific standard-headers

      Copy arch specific virtio headers.
      ATM this applies to s390 only.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit cbbe4f50a028ff49e983a2a8d82c8b0ae49bc756
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:43 2015 +0100

      virtio-pci: use standard headers

      Drop duplicate code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit aa2e69fe2dd69ac2008b066c4c558a4b5c6a7e10
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:37 2015 +0100

      linux-headers: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 05e492b0dbe42232b2ee9edffb016c68e6519a61
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:32 2015 +0100

      update-linux-headers: use standard-headers

      Drop the linux-specific virtio headers, use the copy from
      standard-headers instead.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9b70c1790acacae54d559d38ca69186a85040bb8
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:26 2015 +0100

      virtio-serial: switch to standard-headers

      Drop duplicate code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 019adbd3715e98b5a09fab1370cc2c6904f79b6d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:20 2015 +0100

      virtio-scsi: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3e96b2db080db986b813b58228e2553621b4b675
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:15 2015 +0100

      virtio-rng: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit b93a5ba3d1e840feef70a9cd367c6818ac63911e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:09 2015 +0100

      virtio-net,tap: use standard-headers

      Drop duplicated code.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 907eb3e5b6fad79308977ec7f885ef549e64daca
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:36:03 2015 +0100

      virtio-blk: switch to standard-headers

      Drop duplicated code. Minor codechanges were required
      as geometry is a sub-structure now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 8744a6a8d500d3509de1f5e33b8cd7d22ec37cf1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:57 2015 +0100

      virtio-9p: use standard headers

      Drop code duplicated from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 73706bd1275bef2e7b3962d1be18a20cb8df7f66
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:52 2015 +0100

      virtio-balloon: use standard headers

      Drop code duplicated from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit e9600c6ca9e9ecc123105e1e3660314fe821a4cb
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:46 2015 +0100

      virtio: use standard-headers

      Drop a bunch of code duplicated from virtio_config.h and virtio_ring.h.
      This makes us rename event index accessors which conflict,
      as reusing the ones from virtio_ring.h isn't trivial.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit 4fbe0f322d5413482efbf9c0d2329fdc32bea6d1
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:40 2015 +0100

      virtio: use standard virtio_ring.h

      Switch to virtio_ring.h from standard headers.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 9fbe302b2a4c349c1a8fa93a3f79f08e7007d80c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:31 2015 +0100

      include: import virtio headers from linux 4.0

      Add files imported from linux-next (what will become linux 4.0) using
      scripts/update-linux-headers.sh

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 1ff0b555d3c6ba291adf0c4c76e222acfeb52f1d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 16 22:35:25 2015 +0100

      scripts/update-linux-headers.sh: pull virtio hdrs

      It doesn't make sense to copy values manually:
      the only issue with getting headers from linux
      seems to be dealing with linux/types, we
      can easily fix that automatically while importing.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>

  commit afaa2e4bc4e17360307cb86fbb1d5d350ae22961
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:40:30 2015 +0100

      acpi-build: simplify rsdp management for legacy

      For legacy machine types, rsdp is not in RAM, so we need a copy of rsdp
      for fw cfg. We previously used g_array_free with false parameter,
      but this seems to confuse people.
      This also wastes a bit of memory as the buffer is unused for new
      machine types.

      Let's just use plain g_memdup, and free original memory together with
      the array.

      TODO: rationalize tcpalog memory management, and get rid of the mfre
      parameter.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 384fb32ea7984ed6e5fdcea0bbc3d5b01238806b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:04:40 2015 +0100

      acpi: has_immutable_rsdp->!rsdp_in_ram

      As comment in acpi-build.c notes, RSDP is not really immutable.  So it's
      really a question of whether it's in RAM, name the variable accordingly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 42d859001d180ea788aa2d34a7be021ac8c447f2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Feb 15 17:12:11 2015 +0100

      acpi-build: fix ACPI RAM management

      This fixes multiple issues around ACPI RAM management:

      RSDP and linker RAM aren't currently marked dirty
      on update, so they won't be migrated correctly.

      Let's handle all tables in the same way: set correct size (assert if
      too big), update, mark RAM dirty.

      This also drops assert checking that table size didn't change: table
      size is fundamentally dynamic and depends on hw configuration,
      just set the correct size and use that (memory core asserts if size is
      too large).

      This also means we can drop tracking table size, memory core does this
      for us now.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 129ddaf31be583fb7c97812e07e028661005ce42
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Feb 17 10:15:30 2015 +0100

      exec: round up size on MR resize

      Block size must fundamentally be a multiple of target page size.
      Aligning automatically removes need to worry about the alignment
      from callers.

      Note: the only caller of qemu_ram_resize (acpi) already happens to have
      size padded to a power of 2, but we would like to drop the padding in
      ACPI core, and don't want to expose target page size knowledge to ACPI.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Paolo Bonzini <ponzini@redhat.com>

  commit 358774d780ee8f91429323f44bef1f53afa448bf
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 13:59:55 2015 +0000

      pc: acpi-build: migrate RSDP table

      Makes sure that RSDP stays the same
      /i.e. matches ACPI tables blob in source/
      if guest is migrated during RSDP reading or
      has been already shadowed by firmware.

      Fix applies only to new machine types starting
      from 2.3, so it won't break migration for old
      machine types.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit 6e00619b1eb2050bf2c75d52edfe7b4566704922
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Mon Feb 9 13:59:54 2015 +0000

      pc: acpi-build: update linker on guest access

      Linker table is build only once, so if later during
      tables rebuild sizes of other ACPI tables change
      pointers will be patched incorrectly due to wrong
      offsets in linker. Resulting in guest not being able
      to find ACPI tables.
      Fix it by updating 'linker' table with the rest of
      tables when firmware reads it.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit d70414a5788c3d51f8ce4d2f437e669e6b99dc59
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Feb 9 13:59:53 2015 +0000

      acpi: update RSDP on guest access

      RSDT offset can change across reboots and that makes
      immutable RSDP, which is build at startup, point to
      incorrect place in ACPI table blob. That results in
      BIOS corrupting tables and guest OS failing to find
      ACPI tables.
      We really should have put it in a ROM region, but
      we can't change that for old machine types,
      let's just set the callback and update it explicitly.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit f2c385220598523c8b9fefbfff1a6754cfd8232a
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Thu Jan 29 14:48:41 2015 +0100

      pc: memory: Validate alignment of maxram_size to page size

      If the maxram_size is not aligned and dimm devices were added on the
      command line qemu would terminate with a rather unhelpful message:

      ERROR:hw/mem/pc-dimm.c:150:pc_dimm_get_free_addr: assertion failed:
      (QEMU_ALIGN_UP(address_space_size, align) == address_space_size)

      In case no dimm device was originally added on the commandline qemu
      exits on the assertion failure.

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 214224adb4ebc9f3d211b867f588413e13f05bb3
  Author: Peter Krempa <pkrempa@redhat.com>
  Date:   Thu Jan 29 14:48:40 2015 +0100

      vl.c: Fix error messages when parsing maxmem parameters

      Produce more human readable error messages and fix few spelling
      mistakes.

      Also remove a redundant check for the max memory size.

      Signed-off-by: Peter Krempa <pkrempa@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Peter Krempa <pkrempa@redhat.com>

  commit c0e57a6022fdb2b00e7946bbfa2ad1f9515527cd
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:41 2015 +0800

      acpi, piix4: Add unplug cb for piix4.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to piix4, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 91a734a6fa0fcd03a7ffc32a7b45a3c2735d82be
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:40 2015 +0800

      acpi, ich9: Add unplug cb for ich9.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to ich9, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 232391c19ec69e6781667c53cb3c3bc57932bb95
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:39 2015 +0800

      acpi, pc: Add unplug cb for pc machine.

      Memory and CPU hot unplug are both asynchronous procedures.
      When the unplug operation happens, unplug request cb is called first.
      And when guest OS finished handling unplug, unplug cb will be called
      to do the real removal of device.

      This patch adds hotunplug cb to pc machine, which memory and CPU
      hot unplug will use it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 469b8ad283d748648960e2260a4a3c415b1b3956
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:38 2015 +0800

      acpi, ich9: Add hotunplug request cb for ich9.

      Memory and CPU hot unplug are both asynchronous procedures.
      They both need unplug request cb when the unplug operation happens.

      This patch adds hotunplug request cb for ich9, and memory and CPU
      hot unplug will share it.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit d9c5c5b8a81433921a75390a9951436424b5c4c5
  Author: Tang Chen <tangchen@cn.fujitsu.com>
  Date:   Wed Jan 28 15:45:37 2015 +0800

      acpi, pc: Add hotunplug request cb for pc machine.

      Memory and CPU hot unplug are both asynchronous procedures.
      They both need unplug request callback to initiate unplug operation.

      Add unplug handler to pc machine that will be used by following
      CPU and memory unplug patches.

      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
      Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 25f8dd96598042a88fdd970d5531584b589b10e4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:04:07 2015 +0100

      qdev: Don't exit when running into bad -global

      -global lets you set a nice booby-trap for yourself:

          $ qemu-system-x86_64 -nodefaults -S -display none -usb -monitor stdio -global usb-mouse.usb_version=l
          QEMU 2.1.94 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          Parameter 'usb_version' expects an int64 value or range
          $ echo $?
          1

      Not nice.  Until commit 3196270 we even abort()ed.

      The same error triggers if you manage to screw up a machine type's
      compat_props.  To demonstrate, change HW_COMPAT_2_1's entry to

                  .driver   = "usb-mouse",\
                  .property = "usb_version",\
                  .value    = "1", \

      Then run

          $ qemu-system-x86_64 -usb -M pc-i440fx-2.1 -device usb-mouse
          upstream-qemu: -device usb-mouse: Parameter 'usb_version' expects an int64 value or range
          $ echo $?
          1

      One of our creatively cruel error messages.

      Since this is actually a coding error, we *should* abort() here.
      Replace the error by an assertion failure in this case.

      But turn the fatal error into a mere warning when the faulty
      GlobalProperty comes from the user.  Looks like this:

          $ qemu-system-x86_64 -nodefaults -S -display none -usb -monitor stdio -global usb-mouse.usb_version=l
          QEMU 2.1.94 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          Warning: global usb-mouse.usb_version=l ignored (Parameter 'usb_version' expects an int64 value or range)
          (qemu)

      This is consistent with how we handle similarly unusable -global in
      qdev_prop_check_globals().

      You could argue that the error should make device_add fail.  Would be
      harder, because we're running within TypeInfo's instance_post_init()
      method device_post_init(), which can't fail.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

  commit d313858dfc2b0b5e6c126f1920863fe43dc9d5b6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:37 2015 +0100

      pci-assign: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 042a24db0a6051313220e161bf1a19c545540d08
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:36 2015 +0100

      qxl: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit f409edf74360805e53e16e6a51ca766e8891f3b7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:35 2015 +0100

      cirrus-vga: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit b8a2dac04aea1f6c801bbb6c44a33ee7cd4ff533
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:34 2015 +0100

      ide/ich: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 28d85904daafda4e099d6a61371ab8e5c1f395bd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:33 2015 +0100

      serial-pci: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit eb1bef94b4067b19abac91fec001c690a58b2174
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:32 2015 +0100

      pcnet: Convert to realize

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 4c3b22459d3589cf84d1ccadc6b09e586497820d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:31 2015 +0100

      pcnet: pcnet_common_init() always returns 0, change to void

      The next commit will exploit the fact it never fails.  This one makes
      it obvious.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 9af21dbee14c5165598d17115ade63184ec0dd8b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:30 2015 +0100

      pci: Trivial device model conversions to realize

      Convert the device models where initialization obviously can't fail.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 7ee6c1e182cca6ccf5253569fca3d05826efb4e9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:29 2015 +0100

      pci: Permit incremental conversion of device models to realize

      Call the new PCIDeviceClass method realize().  Default it to
      pci_default_realize(), which calls old method init().

      To convert a device model, make it implement realize() rather than
      init().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 133e9b228df16d11de01529c217417e78d1d9370
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 19 15:52:28 2015 +0100

      pci: Convert core to realize

      Implement DeviceClass methods realize() and unrealize() instead of
      init() and exit().  The core's initialization errors now get
      propagated properly, and QMP sends them instead of an unspecific
      "Device initialization failed" error.  Unrealize can't fail, so no
      change there.

      PCIDeviceClass is unchanged: it still provides init() and exit().
      Therefore, device models' errors are still not propagated.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 661875e948ece4723ebe4e7628060c27cad06df1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:38 2015 +0000

      acpi: drop min-bytes in build_package()

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit eae8bded9a1a19561054654f5113aeb978d7b4c1
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:37 2015 +0000

      acpi: add build_append_namestring() helper

      Use build_append_namestring() instead of build_append_nameseg()
      So user won't have to care whether name is NameSeg, NamePath or
      NameString.

      See for reference ACPI 5.0: 20.2.2 Name Objects Encoding

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 19934e0e3d0f70eefe8d9e51e71c1cb80f4659d0
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Jan 30 13:29:36 2015 +0000

      acpi: move generic aml building helpers into dedictated file

      the will be later used for composing AML primitives
      and all that could be reused later for ARM machines
      as well.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Acked-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 12e63900f01ce54702745d83f985e26042adda9b
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Sun Feb 1 11:54:26 2015 +0200

      bios linker: validate pointer within table

      buios linker assumes pointer parameter it gets
      is within table, validate this.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 16771613a89838020ee6d84be40b46c6a8180824
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Jan 28 18:18:50 2015 +0200

      acpi-build: fix memory leak with bridge hp off

      When bridge hotplug is disabled for old machine types,
      we never free memory allocated for temporary tables.
      Fix this up.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 2559db069628981bfdc90637fac5bf1b4f4e8ef5
  Merge: 11d39a1 21f5826
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 11:18:30 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-roms-20150219-1' into staging

      seabios: update to 1.8.0 release

      # gpg: Signature made Thu Feb 19 08:36:30 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-roms-20150219-1:
        seabios: update to 1.8.0 release

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11d39a131020cc5c54ff9bc86d3259f7d32bf849
  Merge: c5c6d7f e95d24f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 09:08:54 2015 +0000

      Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20150218' into staging

      Features for s390x/kvm

      1. guest reIPL changes (Fan Zhang)
      Implements subcode 5 and 6 of diag 0x308. This allows to use
      /sys/firmware/[re]ipl/ccw/* and the chreipl and lsreipl tools in
      Linux. In addition to the normal "change the disk" this also
      allows to switch from booting an external kernel into rebooting
      from a disk.

      2. Memory page table walking (Thomas Huth)
      Fix several page table walking functions, used in several places
      like gdb server and instruction handling. Also use these functions
      in several I/O related functions.

      # gpg: Signature made Wed Feb 18 09:13:22 2015 GMT using RSA key ID B5A61C7C
      # gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

      * remotes/borntraeger/tags/s390x-20150218: (29 commits)
        s390x/helper: Remove s390_cpu_physical_memory_map
        s390x/pci: Rework memory access in zpci instruction
        s390x/ioinst: Rework memory access in TPI instruction
        s390x/ioinst: Rework memory access in CHSC instruction
        s390x/ioinst: Rework memory access in STCRW instruction
        s390x/ioinst: Rework memory access in TSCH instruction
        s390x/ioinst: Set condition code in ioinst_handle_tsch() handler
        s390x/ioinst: Rework memory access in STSCH instruction
        s390x/ioinst: Rework memory access in SSCH instruction
        s390x/ioinst: Rework memory access in MSCH instruction
        s390x/css: Make schib parameter of css_do_msch const
        s390x/mmu: Add function for accessing guest memory
        s390x/kvm: Add function for injecting pgm access exceptions
        s390x/mmu: Clean up mmu_translate_asc()
        s390x/mmu: Check bit 52 in page table entry
        s390x/mmu: Renaming related to the ASCE confusion
        s390x/mmu: Add support for read-only regions
        s390x/mmu: Fix the exception codes for illegal table entries
        s390x/mmu: Fix exception types when checking the ASCEs
        s390x/mmu: Fix translation exception code in lowcore
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c5c6d7f81a6950d8e32a3b5a0bafd37bfa5a8e88
  Merge: 68b459e 3339488
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 26 07:01:08 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-18' into staging

      Clean up around error_get_pretty(), qerror_report_err()

      # gpg: Signature made Wed Feb 18 10:10:07 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-18:
        qemu-char: Avoid qerror_report_err() outside QMP command handlers
        qemu-img: Avoid qerror_report_err() outside QMP command handlers
        vl: Avoid qerror_report_err() outside QMP command handlers
        tpm: Avoid qerror_report_err() outside QMP command handlers
        numa: Avoid qerror_report_err() outside QMP command handlers
        net: Avoid qerror_report_err() outside QMP command handlers
        monitor: Avoid qerror_report_err() outside QMP command handlers
        monitor: Clean up around monitor_handle_fd_param()
        error: Use error_report_err() where appropriate
        error: New convenience function error_report_err()
        vhost-scsi: Improve error reporting for invalid vhostfd

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de13197a38cf45c990802661a057f64a05426cbc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:43:35 2014 -0200

      target-i386: Move APIC ID compatibility code to pc.c

      The APIC ID compatibility code is required only for PC, and now that
      x86_cpu_initfn() doesn't use x86_cpu_apic_id_from_index() anymore, that
      code can be moved to pc.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e1356dd70aef11425883dd4d2885f1d208eb9d57
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:31:11 2014 -0200

      target-i386: Require APIC ID to be explicitly set before CPU realize

      Instead of setting APIC ID automatically when creating a X86CPU, require
      the property to be set before realizing the object (which all callers of
      cpu_x86_create() already do).

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 9c235e83f1c3437be6ca45755909efb745c10deb
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:28:45 2014 -0200

      target-i386: Set APIC ID using cpu_index on CONFIG_USER

      The PC CPU initialization code already sets apic-id based on the CPU
      topology, and CONFIG_USER doesn't need the topology-based APIC ID
      calculation code.

      Make CONFIG_USER set apic-id before realizing the CPU (just like PC
      already does), so we can simplify x86_cpu_initfn later. As there is no
      CPU topology configuration in CONFIG_USER, just use cpu_index as the
      APIC ID.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 696da41b1b741f6056e52c572e05abd790637be1
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 16:48:51 2015 -0200

      linux-user: Check for cpu_init() errors

      This was the only caller of cpu_init() that was not checking for NULL
      yet.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 9e9d3863adcbd1ffeca30f240f49805b00ba0d87
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:20:10 2014 -0200

      target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id

      The field doesn't need to be inside CPUState, and it is not specific for
      the CPUID instruction, so move and rename it.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 18b0e4e77142ace948497a053bd5b56c1b849592
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 14:51:00 2014 -0200

      target-i386: Simplify error handling on cpu_x86_init_user()

      Isolate error handling path from the "if (error)" checks.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 15258d46baef5f8265ad5f1002905664cf58f051
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:07:01 2014 -0200

      target-i386: Eliminate cpu_init() function

      Instead of putting extra logic inside cpu.h, just do everything inside
      cpu_x86_init_user().

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 644dba250a3ed04079792f0d6cc918fb1483e6a5
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:05:20 2014 -0200

      target-i386: Rename cpu_x86_init() to cpu_x86_init_user()

      The function is used only for CONFIG_USER, so make its purpose clear.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 8a3f75b39db7d2c891d1e91dde5180d3ff9e10f7
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Dec 18 23:41:06 2014 -0200

      target-i386: Move topology.h to include/hw/i386

      This will allow the PC code to use the header, and lets us eliminate the
      QEMU_INCLUDES hack inside tests/Makefile.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 08e1a1e5a175ecbfdb761db5a62090498f736969
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:57:50 2015 -0200

      target-i386: Eliminate unnecessary get_cpuid_vendor() function

      The function was used in only two places. In one of them, the function
      made the code less readable by requiring temporary te[bcd]x variables.
      In the other one we can simply inline the existing code.

      Reviewed-by: Andreas Färber <afaerber@suse.de>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit a3c2ca7d29ff39cd5b06e48fa1e42c91d05ebd36
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Tue Feb 3 15:48:55 2015 -0200

      target-i386: Simplify listflags() function

      listflags() had lots of unnecessary complexity. Instead of printing to a
      buffer that will be immediately printed, simply call the printing
      function directly. Also, remove the fbits and flags arguments that were
      always set to the same value. Also, there's no need to list the flags in
      reverse order.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 68b459eaa660be17d3547aa581502fe2c572c84f
  Merge: 3d30395 1ce6be2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 13:14:37 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-02-18' into staging

      hmp: Normalize HMP command handler names

      # gpg: Signature made Wed Feb 18 10:59:44 2015 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-monitor-2015-02-18:
        hmp: Name HMP info handler functions hmp_info_SUBCOMMAND()
        hmp: Name HMP command handler functions hmp_COMMAND()
        hmp: Clean up declarations for long-gone info handlers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d30395f7fb3315e4ecf0de4e48790e1326bbd47
  Merge: c28d486 c3cf77c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 11:54:15 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150218-1' into staging

      usb: error handling fixes from Markus, make sysbus ehci arm-only.

      # gpg: Signature made Wed Feb 18 09:54:13 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-usb-20150218-1:
        Make sysbus EHCI devices ARM only by default
        PPC: Don't use legacy -usbdevice support for setting up board
        r2d: Don't use legacy -usbdevice support for setting up board
        usb: Change usb_create_simple() to abort on failure
        usb: Suppress bogus error when automatic usb-hub creation fails
        usb: Do not prefix error_setg() messages with "Error: "
        usb: Improve -usbdevice error reporting a bit
        usb: usb_create() can't fail, drop useless error handling

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c28d4869ea1235b80ef59d5f5e8ca96bc4155c0c
  Merge: 73104fd ee17cbd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 25 11:05:10 2015 +0000

      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2015-02-16-v2-tag' into staging

      tag for qga-pull-2015-02-16-v2

      v2:

      * generalized QAPI function definition for guest-memory-block-size
        to guest-memory-block-info for future extensibility (Eric)

      # gpg: Signature made Tue Feb 17 22:36:08 2015 GMT using RSA key ID F108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

      * remotes/mdroth/tags/qga-pull-2015-02-16-v2-tag:
        qemu-ga-win: Fail loudly on bare 'set-time'
        qga: add memory block command that unsupported
        qga: implement qmp_guest_get_memory_block_info() for Linux with sysfs
        qga: implement qmp_guest_set_memory_blocks() for Linux with sysfs
        qga: implement qmp_guest_get_memory_blocks() for Linux with sysfs
        qga: introduce three guest memory block commmands with stubs
        qga: implement file commands for Windows guest
        guest agent: guest-file-open: refactoring
        utils: drop strtok_r from envlist_parse
        qga: add guest-set-user-password command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 73104fd399c6778112f64fe0d439319f24508d9a
  Merge: 3dc1061 0dc3f44
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 13:58:18 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - vhost-scsi: add bootindex property
      - RCU: fix MemoryRegion lifetime issues in PCI; document the rules;
      convert of AddressSpaceDispatch and RAMList
      - KVM: add kvm_exit reasons for aarch64

      # gpg: Signature made Mon Feb 16 16:32:32 2015 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (21 commits)
        Convert ram_list to RCU
        exec: convert ram_list to QLIST
        cosmetic changes preparing for the following patches
        exec: protect mru_block with RCU
        rcu: add g_free_rcu
        rcu: introduce RCU-enabled QLIST
        exec: RCUify AddressSpaceDispatch
        exec: make iotlb RCU-friendly
        exec: introduce cpu_reload_memory_map
        docs: clarify memory region lifecycle
        pci: split shpc_cleanup and shpc_free
        pcie: remove mmconfig memory leak and wrap mmconfig update with transaction
        memory: keep the owner of the AddressSpace alive until do_address_space_destroy
        rcu: run RCU callbacks under the BQL
        rcu: do not let RCU callbacks pile up indefinitely
        vhost-scsi: set the bootable value of channel/target/lun
        vhost-scsi: add a property for booting
        vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface
        vhost-scsi: add bootindex property
        qdev: support to get a device firmware path directly
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3dc10613c313a042a111e46a977733411495ea8c
  Merge: 3dd2d1a b9c6494
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 12:59:13 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      Pull request

      v2:
       * Fix C11 typedef redefinitions in ahci and libqos malloc [Peter]
       * Fix lx -> PRIx64 format specifiers in ahci [Peter]

      # gpg: Signature made Mon Feb 16 15:45:53 2015 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (65 commits)
        block: Keep bdrv_check*_request()'s return value
        block: Remove "growable" from BDS
        block: Clamp BlockBackend requests
        qemu-io: Use BlockBackend
        qemu-io: Remove "growable" option
        qemu-io: Use blk_new_open() in openfile()
        qemu-nbd: Use blk_new_open() in main()
        qemu-img: Use BlockBackend as far as possible
        qemu-img: Use blk_new_open() in img_rebase()
        qemu-img: Use blk_new_open() in img_open()
        block/xen: Use blk_new_open() in blk_connect()
        blockdev: Use blk_new_open() in blockdev_init()
        iotests: Add test for driver=qcow2, format=qcow2
        block: Add Error parameter to bdrv_find_protocol()
        block: Add blk_new_open()
        block: Lift some BDS functions to the BlockBackend
        iotests: Add test for qemu-img convert to NBD
        qemu-img: Fix qemu-img convert -n
        qemu-iotests: Add 093 for IO throttling
        qemu-iotests: Allow caller to disable underscore convertion for qmp
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3dd2d1a33976a7ec4aa3a6a29e5183af53949237
  Merge: bf2fd13 9e0ff75
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 12:07:28 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150216-1' into staging

      vnc: fixup some QemuOpts conversion fallout.

      # gpg: Signature made Mon Feb 16 08:13:32 2015 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150216-1:
        vnc: fix coverity warning
        ui/vnc: optimize full scanline updates
        vnc: auto assian an id when calling change vnc qmp interface
        vnc: introduce an wrapper for auto assign vnc id
        vnc: using bool type instead of int for QEMU_OPT_BOOL
        vnc: correct missing property about vnc_display
        vnc: fix qemu crash when not configure vnc option

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf2fd13af3925f3a081fdeab8e8a1c8830431e46
  Merge: cd2d554 1ab2aea
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 24 11:08:40 2015 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150213-2' into staging

      MIPS patches 2015-02-13

      Changes:
      * bug fixes, cleanups and minor improvements

      # gpg: Signature made Sat Feb 14 17:01:37 2015 GMT using RSA key ID 0B29DA6B
      # gpg: Can't check signature: public key not found

      * remotes/lalrae/tags/mips-20150213-2:
        linux-user: correct stat structure in MIPS N32
        target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction
        target-mips: fix broken snapshotting
        target-mips: use CP0EnLo_XI instead of magic number
        target-mips: ll and lld cause AdEL exception for unaligned address
        target-mips: fix detection of the end of the page during translation
        target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors
        isa: remove isa_mem_base variable
        gt64xxx: remove isa_mem_base usage
        piix4: use PCI address space instead of system memory
        mips: remove isa_mem_base usage
        jazz: remove usage of isa_mem_base
        jazz: do not explode QEMUMachineInitArgs structure
        isa: add memory space parameter to isa_bus_new

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4bc6a3e54e06c47b8e23bfa3d873fa2f42dfec02
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:08 2015 +0100

      parallel: parallel_hds_isa_init() shouldn't fail

      It shouldn't fail, and no caller checks for failure.  Make failure
      fatal.

      Maintainers of affected machines cc'ed.

      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 07dc788054d714a07df08e2eacc8c2e1c47b9a58
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:07 2015 +0100

      parallel: Factor out common parallel_hds_isa_init()

      Maintainers of affected machines cc'ed.

      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit c6f10a5876a81f7a016714df06730c48210ee419
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:06 2015 +0100

      serial: serial_hds_isa_init() shouldn't fail

      It shouldn't fail, and no caller checks for failure.  Make failure
      fatal.

      Maintainers of affected machines cc'ed.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b6607a1a204d52fe13746cc9c3d2da4303e39b18
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:05 2015 +0100

      serial: Factor out common serial_hds_isa_init()

      It's the same old loop copied five times, plus another instance where
      it's clipped to two iterations and unrolled.

      No external users of serial_isa_init() are left, so give it internal
      linkage.

      Maintainers of affected machines cc'ed.

      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit aef0d55a4bc52b1713de88c100ba6dc451578e50
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:04 2015 +0100

      etsec: Replace qdev_init() by qdev_init_nofail()

      etsec_create() is a helper to create and realize the eTSEC.  It's
      currently unused.  Similar helpers for other NICs use
      qdev_init_nofail().  Match that.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit cd7c50a48dd484637aec36c351728ad0f140805a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:03 2015 +0100

      leon3: Replace unchecked qdev_init() by qdev_init_nofail()

      grlib_irqmp_create(), grlib_gptimer_create() and
      grlib_apbuart_create() are helpers to create and realize GRLIB
      devices.  Their only caller leon3_generic_hw_init() doesn't check for
      failure.  Only the first can actually fail, and only when the caller
      fails to set up a pointer property, which is a programming error.

      Replace qdev_init() by qdev_init_nofail().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fabien Chouteau <chouteau@adacore.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit e25b89e5208564220b9ea3a728f899b37ff6dc2d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:02 2015 +0100

      ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()

      isa_ide_init()'s callers don't check for failure.  isa_ide_init()
      looks like it could fail, but since isa_ide_realizefn() can't fail, it
      actually can't.  Replace its qdev_init() by qdev_init_nofail() to make
      it obvious.

      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit dde11116782c1891a057165539efc014cf365026
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:22 2015 -0200

      numa: Rename set_numa_modes() to numa_post_machine_init()

      This function does some initialization that needs to be done after
      machine init. The function may be eventually removed if we move the
      CPUState.numa_node initialization to the CPU init code, but while the
      function exists, lets give it a name that makes sense.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 1c1e6732786d46c7b0ab160cbf61122c53bb44cc
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:21 2015 -0200

      numa: Rename option parsing functions

      Renaming set_numa_nodes() and numa_init_func() to parse_numa_opts() and
      parse_numa() makes the purpose of those functions clearer.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 7dcd1d70fe2886a1e30d32678b795e6b9b6dd5c4
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:20 2015 -0200

      numa: Move QemuOpts parsing to set_numa_nodes()

      This allows us to make numa_init_func() static.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 25712ffe8478a95abd7b82e2f085c7c929498643
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:19 2015 -0200

      numa: Make max_numa_nodeid static

      Now the only code that uses the variable is inside numa.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit de1a7c84c49affff5884175d621c95196007ea23
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:18 2015 -0200

      numa: Move NUMA globals to numa.c

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 61b388c14c5b042e6a43caaba842e351b2c88edd
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:17 2015 -0200

      vl.c: Remove unnecessary zero-initialization of NUMA globals

      There's no need to zero-initialize globals, they are automatically
      initialized to zero.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit e35704ba9ce0cd1e3c401f3bfbf3faf98b0b6885
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Sun Feb 8 16:51:16 2015 -0200

      numa: Move NUMA declarations from sysemu.h to numa.h

      Not all sysemu.h users need the NUMA declarations, and keeping them in a
      separate file makes it easier to see what are the interfaces provided by
      numa.c.

      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

  commit 912ae9c88669d0a0cbae1f20b8c80dde8e526251
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Thu Feb 19 11:13:10 2015 +0100

      qapi-types: add C99 index names to arrays

      It's not easy to figure out how monitor translates
      strings: most QEMU code deals with translated indexes,
      these are translated using _lookup arrays,
      so you need to find the array name, and find the
      appropriate offset.

      This patch adds C99 indexes to lookup arrays, which makes it possible to
      find the correct key using simple grep, and see that the matching is
      correct at a glance.

      Example:

      Before:

      const char *MigrationCapability_lookup[] = {
          "xbzrle",
          "rdma-pin-all",
          "auto-converge",
          "zero-blocks",
          NULL,
      };

      After:

      const char *MigrationCapability_lookup[] = {
          [MIGRATION_CAPABILITY_XBZRLE] = "xbzrle",
          [MIGRATION_CAPABILITY_RDMA_PIN_ALL] = "rdma-pin-all",
          [MIGRATION_CAPABILITY_AUTO_CONVERGE] = "auto-converge",
          [MIGRATION_CAPABILITY_ZERO_BLOCKS] = "zero-blocks",
          [MIGRATION_CAPABILITY_MAX] = NULL,
      };

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 606ee8f5eadd79627216bbdde4da0337cb7d4360
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 12 09:57:20 2015 +0800

      monitor: Fix missing err = NULL in client_migrate_info()

      When SPICE isn't used, we either fail an assertion in error_set(),
      or leak an error object.  Broken in commit b25d81b.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 438e8289d7746188f0684313d25d38d2a77747c9
  Author: Eric Blake <eblake@redhat.com>
  Date:   Tue Feb 10 15:40:30 2015 -0700

      balloon: Fix typo

      Commit 422e0501 introduced a typo (unless removing an 'o' from
      balloon is how you deflate it?)

      Signed-off-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit f19e44bc9d5b9302d9ca4dcee52de3fc5d8b50f5
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sun Feb 8 15:40:48 2015 +0100

      hmp: Fix warning from smatch (wrong argument in function call)

      Fix this warning:
      hmp.c:414:38: warning: Using plain integer as NULL pointer

      qmp_query_block expects a pointer argument, so passing false is wrong.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

  commit 21f5826a04d38e19488f917e1eef22751490c769
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Feb 19 09:33:03 2015 +0100

      seabios: update to 1.8.0 release

      'git shortlog 8936dbb2..4c59f5d8' for seabios repo:

      David Woodhouse (4):
            Update EFI_COMPATIBILITY16_TABLE to match 0.98 spec update
            build: use -m16 where available instead of asm(".code16gcc")
            romlayout: Use .code16 not .code16gcc
            vgabios: Use .code16 not .code16gcc

      Gerd Hoffmann (2):
            add scripts/tarball.sh
            build: set LC_ALL=C

      Hannes Reinecke (1):
            megasas: read addional PCI I/O bar

      Ian Campbell (1):
            romlayout: Use "rep ; nop" not "rep nop".

      Kevin O'Connor (139):
            vgabios: Return from handle_1011() if handler found.
            edd: Move EDD get drive parameters (int 1348) logic from disk.c to block.c.
            edd: Use sectors==-1 to detect removable media.
            edd: Separate out ATA and virtio specific parts of fill_edd().
            cdemu: store internal cdemu fields in standard "el-torito" spec format.
            Move cdemu call interface and disk_ret helper code to disk.c.
            smm: Replace SMI assembler code with C code.
            smm: Use a C struct to define the layout of the SMM area.
            smp: Replace QEMU SMP init assembler code with C; run only in 32bit mode.
            Don't enable thread preemption during S3 resume vga option rom execution.
            Remove old Bochs bios fixed address string at 0xfff00.
            Move most of the VAR16FIXED() defs to misc.c.
            build: Avoid absolute paths during "whole-program" compiling.
            Make sure handle_smi() and handle_smp() are compiled out if not enabled.
            Remove the TODO file.
            Abstract reset call (and possible 16bit mode switch) into reset() function.
            build: Remove unused function getSectionsStart() from layoutrom.py.
            build: Extract section visiting logic in layoutrom.py.
            build: Refactor layoutrom.py gc() function.
            build: Use customized entry point for each type of build.
            build: Refactor findInit() function.
            build: Rework getRelocs() to use a hash instead of categories in layoutrom.py
            build: Keep segmented sections separate until final link step.
            build: Use fileid instead of category to write sections in layoutrom.py.
            build: Only export needed fields in LayoutInfo in layoutrom.py.
            build: Get fixed address variables from 32bit compile pass (not 16bit)
            build: Minor - fix comments referring to old tools/ directory.
            xhci: Update the times for usb command timeouts.
            ehci: Update usb command timeouts to use usb_xfer_time()
            uhci: Update usb command timeouts to use usb_xfer_time()
            ohci: Update usb command timeouts to use usb_xfer_time()
            vgabios: Fix broken build resulting from e5749978.
            boot: Change ":rom%d" boot order rom instance to ":rom%x"
            Minor - remove stray tab from src/fw/smm.c.
            build: Update kconfig to version in Linux 3.16.
            usb: Fix usb_xfer_time() to work when called in 16bit mode.
            xhci: Call usb_desc2pipe() on xhci_update_pipe().
            xhci: Remove 16bit code wrappers.
            xhci: Use high memory instead of low memory for internal storage.
            xhci: Move root hub and setup code to top of file.
            xhci: Add xhci_check_ports() and xhci_free_pipes() functions.
            ehci: Move port power up from ehci_hub_detect() to check_ehci_ports().
            usb-hub: Enable power to all ports prior to calling usb_enumerate().
            xhci: Change xhci_hub_detect() to use connect status instead of link state.
            uhci: Repeatedly poll for device detect for 100ms.
            ohci: Repeatedly poll for device detect for 100ms.
            ehci: Stall uhci/ohci init only until default port routing is done.
            usb: Perform device detect polling on all usb controllers.
            ehci: Fix bug in hub port assignment
            Revert "Use the extra stack for 16bit USB and PS2 keyboard/mouse commands."
            pmm: Fix entry point to support non-zero %ss
            Move stack hop code below call32/call16 code in stacks.c
            Add need_hop_back() call that determines if stack_hop_back is needed
            Update invoke_mouse_handler() to use need_hop_back()
            Update stack_hop_back() to jump to 16bit mode if called in 32bit mode.
            Track when entering via call32() and use the same mode for stack_hop_back()
            Simplify farcall16 code
            Update reset() to use call16_back()
            build: Support declaring 32bit C functions that must reside in the f-segment
            Move call16() functions from romlayout.S to inline assembler in stacks.c
            Break up call32() into call32() and call32_sloppy()
            Fully restore 16bit state during call16_sloppy()
            Implement call32 mechanism using SMIs.
            Move a20 code from system.c and ps2port.h to x86.h
            Backup and restore a20 on call32_sloppy()
            usb: Rename ?hci_control() to ?hci_send_control()
            usb: Rename usb_getFrameExp() to usb_get_period()
            usb: Rename findEndPointDesc() to usb_find_desc()
            usb: Rename send_default_control() to usb_send_default_control()
            usb: Rename free_pipe() to usb_free_pipe()
            usb: Clarify usb freelist manipulations
            xhci: Change xhci_update_pipe() to xhci_realloc_pipe() and use for alloc too
            uhci: Export uhci_realloc_pipe() instead of uhci_alloc_pipe()
            ohci: Export ohci_realloc_pipe() instead of ohci_alloc_pipe()
            ehci: Export ehci_realloc_pipe() instead of ehci_alloc_pipe()
            usb: Use usb_realloc_pipe for pipe alloc, update, and free.
            Use 32bit memcpy in int1587 when applicable
            Don't clobber %ax on ENTRY_INTO32 macro
            Create assembler macros for saving and restoring 'struct bregs'
            Do full BREGS backup/restore for pmm, pnp, and irqentry_extrastack
            Remove unused macro ENTRY_ST
            vgabios: Don't declare custom internal BDA storage in std/bda.h
            vgabios: Cache a pointer to the current mode struct in the BDA
            vgabios: Don't pass vmode_g to vgafb_move_chars() / vgafb_clear_chars()
            vgabios: Rename vbe_flags to flags
            vgabios: Set cursor shape fixes
            vgabios: Refactor get/set_cursor_shape() code
            vgabios: Only init BDA device details in init_bios_area()
            vgabios: Only set the dcc_index=8 if stdvga ports are available
            vgabios: Move standard table definitions to std/vga.h
            vgabios: Fill in available legacy modes in video_func_static at runtime
            vgabios: Add support for reading framebuffer in "direct" mode
            Fix PNP regression introduced in 99cb8f3e due to missed conversion
            Minor - move PORT_PS2_CTRLB from hw/ps2port.h to hw/timer.c
            vgabios: Support emulating text mode attributes while in graphics mode
            vgabios: Add software cursor capability
            Use an aligned stack offset when entering on the extra stack
            Minor - comment updates in romlayout.S
            Fix build issue on gcc34
            pciinit: Fix build warning in mch_pci_slot_get_irq()
            floppy: Make sure to yield() during floppy PIO
            Minor - be consistent in placement of .code16/32 in romlayout.S
            Use macros for .code16/32 mode switches in inline asm in stacks.c
            Eliminate FUNCFSEG - only force portions of inline asm to f-segment
            usb: Update USB hub code to support super speed hubs
            Simplify README files - point to online documentation instead
            sdcard: Initial support for SD cards on PCI SDHCI controllers on QEMU
            Add wiki documentation to repository
            docs: Don't point to repo README files
            docs: Add info on MODE16/MODESEGMENT compile time flags
            docs: Add page describing SeaBIOS final object linking
            scsi: Move cdb_* functions above scsi_* functions
            scsi: Move process_scsi_op() to hw/blockcmd.c and rename
            cdrom: call scsi_process_op() instead of cdb_read()
            scsi: Don't export cdb_* functions
            cdrom: Break up very large read requests into smaller requests
            block: Check for read/write requests over 64K
            usb: Add support for OHCI bulk transfers
            readserial: Enhance pipe support
            docs: Add documentation on using readserial.py script
            uhci: Enable "depth" tree traversal for bulk transfers
            uhci: Increase bulk transfer STACKTDS to 16
            vgabios: Support emulated text in gfx_read_char()
            ehci: No need to support td array wrapping
            ehci: Simplify fillTDbuffer() and rename
            ehci: Merge ehci_send_control with ehci_send_bulk
            ohci: Merge ohci_send_control with ohci_send_bulk
            uhci: Merge uhci_send_control with uhci_send_bulk
            xhci: Merge xhci_send_control with xhci_send_bulk
            usb: Use usb_send_pipe() now that all drivers have x_send_pipe()
            xhci: Move xhci_xfer_x() functions together
            xhci: Merge some xhci_xfer_x() functions into xhci_send_pipe()
            usb: Control transfers always have an 8 byte command size
            usb: Minor - properly free memory on get_device_config() error path
            checkstack: Handle callw instruction
            docs: Document why v1.6.3 release came after v0.6.2
            docs: Update release history with dates of stable releases
            docs: There is only one VAR16 flag now
            docs: Note v1.8.0 release

      Marcel Apfelbaum (1):
            hw/pci: reserve IO and mem for pci express downstream ports with no devices attached

      Markus Armbruster (1):
            boot: Fix boot order for SCSI target, lun > 9

      Paolo Bonzini (5):
            piix: add and use dev-piix.h
            smm: complete SMM setup
            smm: unify SMM handlers
            vgabios: fix graphics operation with Bochs VGA in non-DISPI modes
            vgabios: implement read char in graphics mode

      zhanghailiang (1):
            acpi: use specified macro instead of magic-number

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1ce6be24df0a2f634b61b9b882ac6d10af485ad6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 14:18:24 2015 +0100

      hmp: Name HMP info handler functions hmp_info_SUBCOMMAND()

      Some are called do_info_SUBCOMMAND() (old ones, usually), some
      hmp_info_SUBCOMMAND(), some SUBCOMMAND_info(), sometimes SUBCOMMAND
      pointlessly differs in spelling.

      Normalize to hmp_info_SUBCOMMAND(), where SUBCOMMAND is exactly the
      subcommand name with '-' replaced by '_'.

      Exceptions:

      * sun4m_irq_info(), sun4m_pic_info() renamed to sun4m_hmp_info_irq(),
        sun4m_hmp_info_pic().

      * lm32_irq_info(), lm32_pic_info() renamed to lm32_hmp_info_irq(),
        lm32_hmp_info_pic().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 3e5a50d64ca9c323f8099fdf1aef02813598882d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 13:55:43 2015 +0100

      hmp: Name HMP command handler functions hmp_COMMAND()

      Some are called do_COMMAND() (old ones, usually), some hmp_COMMAND(),
      and sometimes COMMAND pointlessly differs in spelling.

      Normalize to hmp_COMMAND(), where COMMAND is exactly the command name
      with '-' replaced by '_'.

      Exceptions:

      * do_device_add() and client_migrate_info() *not* renamed to
        hmp_device_add(), hmp_client_migrate_info(), because they're also
        QMP handlers.  They still need to be converted to QAPI.

      * do_memory_dump(), do_physical_memory_dump(), do_ioport_read(),
        do_ioport_write() renamed do hmp_* instead of hmp_x(), hmp_xp(),
        hmp_i(), hmp_o(), because those names are too cryptic for my taste.

      * do_info_help() renamed to hmp_info_help() instead of hmp_info(),
        because it only covers help.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 08d15d6c23a371ad75f8a242d6daceb19ff1468a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 12:07:09 2015 +0100

      hmp: Clean up declarations for long-gone info handlers

      Leftovers from
      d1f2964 qapi: Convert query-spice
      791e7c8 qapi: Convert query-migrate
      0fe6a7f slirp: Drop statistic code

      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit c3cf77cb63b71618224129df41f114488e0f74e4
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Wed Feb 18 16:01:01 2015 +1100

      Make sysbus EHCI devices ARM only by default

      A number of ARM embedded boards include EHCI USB host controllers which
      appear as directly mapped devices, rather than sitting on a PCI bus.

      At present code to emulate such devices is included whenever EHCI support
      is included.  This patch adjusts teh config options to only include them
      in builds targetting ARM by default.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c86580b889a0c22deba3afd4672472f23a1249d0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:14 2015 +0100

      PPC: Don't use legacy -usbdevice support for setting up board

      It's tempting, because usbdevice_create() is so simple to use.  But
      there's a lot of unwanted complexity behind the simple interface.
      Switch to usb_create_simple().

      Cc: Alexander Graf <agraf@suse.de>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 456dcd8ab45a83dd51cca357cd9aa6ad337dc20d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:13 2015 +0100

      r2d: Don't use legacy -usbdevice support for setting up board

      It's tempting, because usbdevice_create() is so simple to use.  But
      there's a lot of unwanted complexity behind the simple interface.
      Switch to usb_create_simple().

      Cc: Magnus Damm <magnus.damm@gmail.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 599655c91f3a55ac75007e851deca09010787bd7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:12 2015 +0100

      usb: Change usb_create_simple() to abort on failure

      Instead of returning null pointer.  Matches pci_create_simple(),
      isa_create_simple(), sysbus_create_simple().  It's unused since the
      previous commit, but I'll put it to use again shortly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit bd8b92d5c8387c2c94f06665514c05000169fafd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:11 2015 +0100

      usb: Suppress bogus error when automatic usb-hub creation fails

      USBDevice's realize method usb_qdev_realize() automatically creates a
      usb-hub when only one port is left.  Creating devices in realize
      methods is questionable, but works.

      If usb-hub creation fails, an error is reported to stderr, but the
      failure is otherwise ignored.  We then create the actual device using
      the last port, which may well succeed.

      Example:

          $ qemu -nodefaults -S -display none -machine usb=on -monitor stdio
          QEMU 2.2.50 monitor - type 'help' for more information
          (qemu) device_add usb-mouse
          [Repeat 36 times]
          (qemu) info usb
            Device 0.0, Port 1, Speed 12 Mb/s, Product QEMU USB Mouse
            Device 0.0, Port 2, Speed 12 Mb/s, Product QEMU USB Hub
            Device 0.0, Port 2.1, Speed 12 Mb/s, Product QEMU USB Mouse
          [More mice and hubs omitted...]
            Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
          (qemu) device_add usb-mouse
          usb hub chain too deep
          Failed to initialize USB device 'usb-hub'
          (qemu) info usb
          [...]
            Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
            Device 0.0, Port 2.8.8.8.8.8, Speed 12 Mb/s, Product QEMU USB Mouse

      Despite the "Failed" message, the command actually succeeded.

      In QMP, it's worse.  When adding the 37th mouse via QMP, the command
      fails with

          {"error": {"class": "GenericError", "desc": "usb hub chain too deep"}}

      Additionally, "Failed to initialize USB device 'usb-hub'" is reported
      on stderr.  Despite the command failure, the device was created.  This
      is wrong.

      Fix by avoiding qdev_init() for usb-hub creation, so we can ignore
      errors cleanly.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 06f22eb78f3eb557c667f5d0a46099e43a2aeb0d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:10 2015 +0100

      usb: Do not prefix error_setg() messages with "Error: "

      Because it produces beauties like

          (qemu) usb_add mouse
          Failed to initialize USB device 'usb-mouse': Error: tried to attach usb device QEMU USB Mouse to a bus with no free ports

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3bc36a401e0f33e63a4d2c58b646ddf78efb567c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:09 2015 +0100

      usb: Improve -usbdevice error reporting a bit

      Most LegacyUSBFactory usbdevice_init() methods realize with
      qdev_init_nofail(), even though their caller usbdevice_create() can
      handle failure.  Okay if it really can't fail (I didn't check), but
      somewhat brittle.

      usb_msd_init() and usb_bt_init() call qdev_init().  The latter
      additionally reports an error when qdev_init() fails.

      Realization failure produces multiple error reports: a specific one
      from qdev_init(), and generic ones from usb_bt_init(),
      usb_create_simple(), usbdevice_create() and usb_parse().

      Remove realization from the usbdevice_init() methods.  Realize in
      usbdevice_create(), and produce exactly one error message there.  You
      still get another one from usb_parse().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4806ec9b2c57ff42a91d5419ac1137fffd1c9fb5
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 13:28:08 2015 +0100

      usb: usb_create() can't fail, drop useless error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 33394884060b6501ef39b124eeaa111f61c59f7f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:21:26 2015 +0100

      qemu-char: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in legacy chardev parser
      qemu_chr_parse_compat().  Legacy chardev syntax is not to be used in
      QMP.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6936f299a47acf84b4d926d0eec4cdf3cf2274ba
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:14:02 2015 +0100

      qemu-img: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a720a390b1b2260d245bcc96923bf17e186b4b7e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:12:59 2015 +0100

      vl: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helpers
      machine_set_property() and object_create().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bc09a287d85505eabd1f548eae3a188ece902e49
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:11:17 2015 +0100

      tpm: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helper
      configure_tpm().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 29b762f5f0efdb6a0cb693be6df2988c195523db
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:06:23 2015 +0100

      numa: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in initial startup helper
      numa_init_func() and board setup helper
      memory_region_allocate_system_memory().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 12d0cc2db971cc0888b7d465143c68dee381c88b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:02:06 2015 +0100

      net: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in HMP command handler
      hmp_host_net_add() and initial startup helpers net_init_client(),
      net_init_netdev().  Keep it in QMP command handler qmp_netdev_add().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 091e38b7dc3255d780f0603b5b93c25078c39856
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Feb 10 15:15:43 2015 +0100

      monitor: Avoid qerror_report_err() outside QMP command handlers

      qerror_report_err() is a transitional interface to help with
      converting existing monitor commands to QMP.  It should not be used
      elsewhere.  Replace by error_report_err() in HMP command handler
      hmp_trace_event().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 1677f4c66cf2228eb14f1b0571d0e3b38d0d6606
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Feb 9 14:03:19 2015 +0100

      monitor: Clean up around monitor_handle_fd_param()

      monitor_handle_fd_param() is a wrapper around
      monitor_handle_fd_param2() that feeds errors to qerror_report_err()
      instead of returning them.  qerror_report_err() is inappropriate in
      many contexts.  monitor_handle_fd_param() looks simpler than
      monitor_handle_fd_param2(), which tempts use.  Remove the temptation:
      drop the wrapper and open-code the (trivial) error handling instead.

      Replace the open-coded qerror_report_err() by error_report_err() in
      places that already use error_report().  Turns out that's everywhere.

      While there, rename monitor_handle_fd_param2() to monitor_fd_param().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 565f65d271984a32eed2c324ff6ef8be33f7f3d2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Feb 12 13:55:05 2015 +0100

      error: Use error_report_err() where appropriate

      Coccinelle semantic patch:

          @@
          expression E;
          @@
          -    error_report("%s", error_get_pretty(E));
          -    error_free(E);
          +    error_report_err(E);
          @@
          expression E, S;
          @@
          -    error_report("%s", error_get_pretty(E));
          +    error_report_err(E);
          (
               exit(S);
          |
               abort();
          )

      Trivial manual touch-ups in block/sheepdog.c.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 2ee2f1e41517efa7b5dd604a68ceca9b1377de2c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Fri Feb 6 15:27:19 2015 +0100

      error: New convenience function error_report_err()

      I've typed error_report("%s", error_get_pretty(ERR)) too many times
      already, and I've fixed too many instances of qerror_report_err(ERR)
      to error_report("%s", error_get_pretty(ERR)) as well.  Capture the
      pattern in a convenience function.

      Since it's almost invariably followed by error_free(), stuff that into
      the convenience function as well.

      The next patch will put it to use.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 248337e178fbcf1c20132d4f3d1033cb0dde7638
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Feb 9 11:49:08 2015 +0100

      vhost-scsi: Improve error reporting for invalid vhostfd

      We get two error messages: one from monitor_handle_fd_param2(), and
      another one from vhost_scsi_realize().  The second one gets suppressed
      in QMP context.

      That's because monitor_handle_fd_param() calls qerror_report_err().
      Calling qerror_report_err() is always inappropriate in realize
      methods, because it doesn't return the Error object.  It either
      reports the error to stderr or the human monitor, or it stores it in
      the QMP monitor, where it makes the QMP command fail even when the
      realize method ignores the error and succeeds.  Fortunately,
      vhost_scsi_realize() doesn't do that.

      Fix by switching to monitor_handle_fd_param2().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e95d24ff40c77fbfd71396834a2eb99375f8bcc4
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:42 2015 +0100

      s390x/helper: Remove s390_cpu_physical_memory_map

      The function is now not used anymore, so it can be removed safely.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 63ceef61ac6cc033d465a6a06d394bcc2854a7b2
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Thu Feb 12 18:09:41 2015 +0100

      s390x/pci: Rework memory access in zpci instruction

      Change zpci instructions to use the new logical memory access
      functions.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 7781a492fa5a2eff53d06b25b93f0186ad3226c9
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:40 2015 +0100

      s390x/ioinst: Rework memory access in TPI instruction

      Change the handler for TPI to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 166f1bb7968738490fafc058e4b6505eb78701b6
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:39 2015 +0100

      s390x/ioinst: Rework memory access in CHSC instruction

      Change the CHSC handler to correctly use logical addresses, too.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 7f74f0aa74a01698ef24459f7bc2a23f3880a2b8
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:38 2015 +0100

      s390x/ioinst: Rework memory access in STCRW instruction

      Change the handler for STCRW to use the new logical memory access
      functions. Since STCRW is suppressed on protection/access exceptions,
      we also have to make sure to re-queue the CRW in case it could not be
      written to the memory.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit b7b6348ab433519f16c1500e3ea04805428be91e
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:37 2015 +0100

      s390x/ioinst: Rework memory access in TSCH instruction

      Change the TSCH handler to use the new logical memory access functions.
      Since the channel should not be updated in case of a protection or access
      exception while writing to the guest memory, the css_do_tsch() has to be
      split up into two parts, one for retrieving the IRB and one for the update.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 653b080960578c25ed88f7e6c5b7ec65d4fe1648
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:36 2015 +0100

      s390x/ioinst: Set condition code in ioinst_handle_tsch() handler

      Move the setting of the condition code from kvm.c into the handler
      function in ioinst.c itself, just like it has been done with the other
      handlers already (TSCH has just not been changed yet since it is called
      from a different dispatcher in kvm.c).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 57b22fc7920ff1bc40ea7f800a8b83520a1aa244
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:35 2015 +0100

      s390x/ioinst: Rework memory access in STSCH instruction

      Change the handler for STSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 234d9b1d3c5a0c87b9f41f7350bcf8c07a992864
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:34 2015 +0100

      s390x/ioinst: Rework memory access in SSCH instruction

      Change the handler for SSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 14b4e13d4c74f52875d9e1456a126ae076fd2204
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:33 2015 +0100

      s390x/ioinst: Rework memory access in MSCH instruction

      Change the handler for MSCH to use the new logical memory
      access functions.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit bffd09cd76bc800f466b47d32b35470f9ccef88c
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:32 2015 +0100

      s390x/css: Make schib parameter of css_do_msch const

      The schib parameter of css_do_msch() can be declared as const to
      make it clear that it does not get modified by this function.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit c3edd62851098e6417786193ed9e9341781fcf57
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:31 2015 +0100

      s390x/mmu: Add function for accessing guest memory

      According to the POP specification, the parameter blocks of various
      functions like the IO instructions are accessed with logical addresses.
      Thus we need a function that can read or write a buffer from/to the
      guest's logical address space.

      This patch now provides a function that can be used to access virtual
      guest memory by using the mmu_translate function of QEMU to convert
      the virtual addresses to physical.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 801cdd355f8bc578f1d02462a91313959e55bee7
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:30 2015 +0100

      s390x/kvm: Add function for injecting pgm access exceptions

      Program access exceptions are defined to deliver a translation exception
      code in the low-core. Add a function trigger_access_exception() that
      generates the proper program interrupt on both KVM and non-KVM systems
      and switch the existing code to use it.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 9d77309c9fedca33525cae820b9eff6f35c795f4
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:29 2015 +0100

      s390x/mmu: Clean up mmu_translate_asc()

      We can get rid of the switch(asc) in mmu_translate_asc() by simply
      selecting the right control register ASCE in the mmu_translate()
      function already.
      This patch is based on an original patch/idea by Ralf Hoppe.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit b4ecbf8071022a2042624baaff78cab2bf7e94af
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:28 2015 +0100

      s390x/mmu: Check bit 52 in page table entry

      Bit 52 in a page table entry has always to be zero, or a translation
      specification exception is to be recognized.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit ede59855785f1980be76d9d3b3a727954bfbc461
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:27 2015 +0100

      s390x/mmu: Renaming related to the ASCE confusion

      An Address Space Control Element (ASCE) is only the very first unit of
      an s390 address translation (normally residing in one of the control
      registers). The entries in the page tables are called differently.
      So let's call the relevant variable pt_entry instead of asce in
      mmu_translate_pte() to avoid future confusion (thus there is no
      functional change in this patch, just renaming).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 43d49b0115aef2ead5125d4aa9719852d47ef6fc
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:26 2015 +0100

      s390x/mmu: Add support for read-only regions

      If the "DAT-protection" bit is set in the region table entry and EDAT is
      enabled, only read accesses are allowed in the corresponding memory area.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5a123b3c1a1d3540d4455772c42c466870d81061
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:25 2015 +0100

      s390x/mmu: Fix the exception codes for illegal table entries

      Each different level of region/segment table has a dedicated
      exception type for illegal entries.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit d267571be419d389184916b56f862a8f143e67c5
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:24 2015 +0100

      s390x/mmu: Fix exception types when checking the ASCEs

      If an ASCE has illegal bits set, an ASCE-type exception should be
      generated instead of a translation specification exception.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit bab58bf0921ef5da3c5c764920f152ac7c914c41
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:23 2015 +0100

      s390x/mmu: Fix translation exception code in lowcore

      The address space bits in the translation exception code were wrong.
      In fact, we can simply copy the bits from the PSW, so there's no need
      for the trans_bits() function anymore.
      Additionally, we now also set the fetch/store bits in the translation
      exception code, so a guest can determine whether the exception occured
      during a write or during a read.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e3e09d87c6e69c2da684d5aacabe3124ebcb6f8e
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:22 2015 +0100

      s390x/mmu: Skip exceptions properly when translating addresses for debug

      When a fault occurs during the MMU lookup in s390_cpu_get_phys_page_debug(),
      the trigger_page_fault() function writes the translation exception code
      into the lowcore - something you would not expect during a memory access
      by the debugger. Ease this problem by adding an additional parameter to
      mmu_translate() which can be used to specify whether a program check and
      the translation exception code should be injected or not.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 5d180439d07774c5a2477cf9901c9b51c9edd74b
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:21 2015 +0100

      s390x/mmu: Check table length and offset fields

      The ACSEs have a table length field and the region entries have
      table length and offset fields which must be checked during
      translation to see whether the given virtual address is really
      covered by the translation table.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f8f84e93ab6111848cfc83b3d6122573eb03bccf
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:20 2015 +0100

      s390x/mmu: Fix the handling of the table levels

      The current code used a wrong and very confusing way of dealing with
      the table levels by introducing a "fake level above current". However,
      the real problem was simply that the checks for the region/segment
      invalid bit and for the matching region/segment level was done at the
      wrong spot in the code - it has to be done after the first table entry
      has been looked up instead (e.g. there is also no "invalid" bit in the
      ASCE itself and the current "level" has to be the same as the level in
      the entry that we just looked up).
      Also the entries for the segment table are quite a bit different compared
      to the region table entries. So this patch moves the related code into the
      function mmu_translate_segment() to make it clear at which table level we
      currently are and to get rid of the ugly switch-statement in the function
      mmu_translate_region().

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 89a41e0a37f3c749f3038ac2544f74257bc7b94d
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:19 2015 +0100

      s390x/mmu: Fix the check for the real-space designation bit

      The real-space designation bits live in the ASCEs, not in the table entries,
      so the check must be done before we start walking the MMU table.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit dfebd7a7a9f8435fe5cd6c7d3901091db6322f99
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:09:18 2015 +0100

      s390x/mmu: Move mmu_translate() and friends to separate file

      helper.c is quite overcrowded already, so let's move the MMU
      translation to a separate file instead (like it has been done
      with the other targets already).

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit ee17cbdc3c21f5cb6144a434191ffcd08b7de5fe
  Author: Michal Privoznik <mprivozn@redhat.com>
  Date:   Wed Jan 21 12:09:50 2015 +0100

      qemu-ga-win: Fail loudly on bare 'set-time'

      The command is not implemented correctly yet. The documentation allows
      to not pass any value to set, in which case the time is re-read from
      RTC. However, reading CMOS on Windows is not trivial to implement. So
      instead of pretending we've set the correct time, fail explicitly.

      Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0dd38a03f5e1498aabf7d053a9fab792a5eeec5c
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:06 2015 +0800

      qga: add memory block command that unsupported

      For memory block command, we only support for linux with sysfs.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit ef82b60be13b18198b84a2157f59c50fd53f5408
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:05 2015 +0800

      qga: implement qmp_guest_get_memory_block_info() for Linux with sysfs

      This conveys general information about guest memory blocks. Currently,
      just the memory block size.

      The size of a memory block is architecture dependent, it represents the logical
      unit upon which memory online/offline operations are to be performed.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *generalized guest-get-memory-block-size to get-get-memory-block-info
       for future extensibility

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 32ca7927c7d66371abafb4cabfab9438a5905784
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:04 2015 +0800

      qga: implement qmp_guest_set_memory_blocks() for Linux with sysfs

      We can change guest's online/offline state of memory blocks, by using
      command 'guest-set-memory-blocks'.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit bd240fca42d5f072fb758a71720d9de9990ac553
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:03 2015 +0800

      qga: implement qmp_guest_get_memory_blocks() for Linux with sysfs

      We can get guest's memory block information by using command
      "guest-get-memory-blocks", the returned value contains a list of memory block
      info, such as phys-index, online state, can-offline info.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *replaced guest-triggerable assertion with an error msg

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit a065aaa9204ecd4a0d18f5eae49aa350a5f76b63
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Jan 22 10:40:02 2015 +0800

      qga: introduce three guest memory block commmands with stubs

      Introduce three new guest commands:
      guest-get-memory-blocks, guest-set-memory-blocks, guest-get-memory-block-size.

      With these three commands, we can support online/offline guest's memory block
      (logical memory hotplug/unplug) as required from host.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>

      *generalized guest-get-memory-block-size to get-get-memory-block-info
       for future extensibility

      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit fa193594fbc27fde7c9062b3bf5c232534887ec7
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Fri Feb 6 20:59:55 2015 +0300

      qga: implement file commands for Windows guest

      The following commands are implemented:
      - guest_file_open
      - guest_file_close
      - guest_file_write
      - guest_file_read
      - guest_file_seek
      - guest_file_flush

      Motivation is quite simple: Windows guests should be supported with the
      same set of features as Linux one. Also this patch is a prerequisite for
      Windows guest-exec command support.

      Signed-off-by: Olga Krishtal <okrishtal@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 85b6f6f53596fd29eee0a6d2475c6a4322eede6b
  Author: Simon Zolin <szolin@parallels.com>
  Date:   Fri Feb 6 20:59:54 2015 +0300

      guest agent: guest-file-open: refactoring

      Moved the code that sets non-blocking flag on fd into a separate function.

      Signed-off-by: Simon Zolin <szolin@parallels.com>
      Reviewed-by: Roman Kagan <rkagan@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      CC: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 459db780be10f7adac723a5d3a4ffeac8ae6e768
  Author: Olga Krishtal <okrishtal@parallels.com>
  Date:   Fri Feb 6 20:59:53 2015 +0300

      utils: drop strtok_r from envlist_parse

      The problem is that mingw 4.9.1 fails to compile the code with the
      following warning:

      /mingw/include/string.h:88:9: note: previous declaration of 'strtok_r'
      was here
         char *strtok_r(char * __restrict__ _Str,
                        const char * __restrict__ _Delim,
                        char ** __restrict__ __last);
      /include/sysemu/os-win32.h:83:7: warning: redundant redeclaration of
         'strtok_r' [-Wredundant-decls]
         char *strtok_r(char *str, const char *delim, char **saveptr);

      The problem is that compiles just fine on previous versions of mingw.
      Compiler version check here is not a good idea. Though fortunately
      strtok_r is used only once in the code and we could simply rewrite
      the code without it.

      Signed-off-by: Olga Krishtal <okrishtal@parallels.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Eric Blake <eblake@redhat.com>
      CC: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 215a2771a7b6b29037ee8deba484815d816b6fdd
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Feb 11 11:26:12 2015 +0000

      qga: add guest-set-user-password command

      Add a new 'guest-set-user-password' command for changing the password
      of guest OS user accounts. This command is needed to enable OpenStack
      to support its API for changing the admin password of guests running
      on KVM/QEMU. It is not practical to provide a command at the QEMU
      level explicitly targetting administrator account password change
      only, since different guest OS have different names for the admin
      account. While UNIX systems use 'root', Windows systems typically
      use 'Administrator' and even that can be renamed. Higher level apps
      like OpenStack have the ability to figure out the correct admin
      account name since they have info that QEMU/libvirt do not.

      The command accepts either the clear text password string, encoded
      in base64 to make it 8-bit safe in JSON:

      $ echo -n "123456" | base64
      MTIzNDU2
      $ virsh -c qemu:///system  qemu-agent-command f21x86_64 \
         '{ "execute": "guest-set-user-password",
            "arguments": { "crypted": false,
                           "username": "root",
                           "password": "MTIzNDU2" } }'
        {"return":{}}

      Or a password that has already been run though a crypt(3) like
      algorithm appropriate for the guest, again then base64 encoded:

      $ echo -n '$6$n01A2Tau$e...snip...DfMOP7of9AJ1I8q0' | base64
      JDYkb...snip...YT2Ey
      $ virsh -c qemu:///system  qemu-agent-command f21x86_64 \
         '{ "execute": "guest-set-user-password",
            "arguments": { "crypted": true,
                           "username": "root",
                           "password": "JDYkb...snip...YT2Ey" } }'

      NB windows support is desirable, but not implemented in this
      patch.

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

  commit 0dc3f44aca18b1be8b425f3f4feb4b3e8d68de2e
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu Sep 5 14:41:35 2013 -0400

      Convert ram_list to RCU

      Allow "unlocked" reads of the ram_list by using an RCU-enabled QLIST.

      The ramlist mutex is kept.  call_rcu callbacks are run with the iothread
      lock taken, but that may change in the future.  Writers still take the
      ramlist mutex, but they no longer need to assume that the iothread lock
      is taken.

      Readers of the list, instead, no longer require either the iothread
      or ramlist mutex, but they need to use rcu_read_lock() and
      rcu_read_unlock().

      One place in arch_init.c was downgrading from write side to read side
      like this:

          qemu_mutex_lock_iothread()
          qemu_mutex_lock_ramlist()
          ...
          qemu_mutex_unlock_iothread()
          ...
          qemu_mutex_unlock_ramlist()

      and the equivalent idiom is:

          qemu_mutex_lock_ramlist()
          rcu_read_lock()
          ...
          qemu_mutex_unlock_ramlist()
          ...
          rcu_read_unlock()

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0d53d9fe8a0dcb849bc7c9836e9e6a287f9aa787
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Wed Jan 21 13:45:24 2015 +0100

      exec: convert ram_list to QLIST

      QLIST has RCU-friendly primitives, so switch to it.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ae3a7047d00cfa7ed221beda08f98487b7e17501
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Thu Sep 5 14:41:35 2013 -0400

      cosmetic changes preparing for the following patches

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43771539d4666cba16298fc6b0ea63867425277c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Sep 9 17:58:40 2013 +0200

      exec: protect mru_block with RCU

      Hence, freeing a RAMBlock has to be switched to call_rcu.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 439c5e02d59659876e1a2cf019c55e419adab195
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:00:12 2015 +0100

      rcu: add g_free_rcu

      This simplifies calling g_free from an RCU callback.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 341774fe6ccdc0fe42fb79a4ed642e78237da428
  Author: Mike Day <ncmike@ncultra.org>
  Date:   Tue Aug 27 11:38:45 2013 -0400

      rcu: introduce RCU-enabled QLIST

      Add RCU-enabled variants on the existing bsd DQ facility. Each
      operation has the same interface as the existing (non-RCU)
      version. Also, each operation is implemented as macro.

      Using the RCU-enabled QLIST, existing QLIST users will be able to
      convert to RCU without using a different list interface.

      Signed-off-by: Mike Day <ncmike@ncultra.org>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 79e2b9aeccedbfde762b05da662132c7fda292be
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 21 12:09:14 2015 +0100

      exec: RCUify AddressSpaceDispatch

      Note that even after this patch, most callers of address_space_*
      functions must still be under the big QEMU lock, otherwise the memory
      region returned by address_space_translate can disappear as soon as
      address_space_translate returns.  This will be fixed in the next part
      of this series.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d82b5a792236db31a75b9db5c93af69ac07c7c5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Aug 16 08:26:30 2013 +0200

      exec: make iotlb RCU-friendly

      After the previous patch, TLBs will be flushed on every change to
      the memory mapping.  This patch augments that with synchronization
      of the MemoryRegionSections referred to in the iotlb array.

      With this change, it is guaranteed that iotlb_to_region will access
      the correct memory map, even once the TLB will be accessed outside
      the BQL.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 76e5c76f2e2e0d20bab2cd5c7a87452f711654fb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 15 12:46:47 2015 +0100

      exec: introduce cpu_reload_memory_map

      This for now is a simple TLB flush.  This can change later for two
      reasons:

      1) an AddressSpaceDispatch will be cached in the CPUState object

      2) it will not be possible to do tlb_flush once the TCG-generated code
      runs outside the BQL.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8b5c216025c312ab01542c4595393e0fdcbed015
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Feb 13 13:42:03 2015 +0100

      docs: clarify memory region lifecycle

      Now that objects actually obey the rules, document them.

      Reviewed-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5cd5e7015962d8d559afb5154888fd34a8526ddd
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Feb 12 21:39:20 2015 +0100

      pci: split shpc_cleanup and shpc_free

      object_unparent should not be called until the parent device is going to be
      destroyed.  Only remove the capability and do memory_region_del_subregion
      at unrealize time.  Freeing the data structures is left in shpc_free, to
      be called from the instance_finalize callback.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a8f2a9ce51036ab2d25bcc31114b5cbb72ab44b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 11:18:58 2015 +0100

      pcie: remove mmconfig memory leak and wrap mmconfig update with transaction

      This memory leak was introduced inadvertently by omitting object_unparent.
      A better fix is to use the new memory_region_set_size instead of destroying
      and recreating the MMIO region on the fly.

      Also, ensure that unmapping and remapping the region is done atomically.

      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c4bacafb717de55538311b80a185ce9166b8daa2
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 18:33:01 2015 +0100

      qdev: Improve qdev_init_nofail()'s error reporting

      We get two error messages: a specific one from qdev_init(), and a
      generic one from qdev_init_nofail().  The specific one gets suppressed
      in QMP context.  qdev_init_nofail() failing there is a bug, though.

      Cut out the qdev_init() middle-man: realize the device, and on error
      exit with a single error message.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit b9c649470ba0d4056b2d486105a0f8fb982654ae
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:25 2015 -0500

      block: Keep bdrv_check*_request()'s return value

      Do not throw away the value returned by bdrv_check_request() and
      bdrv_check_byte_request().

      Fix up some coding style issues in the proximity of the affected hunks.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-17-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c0191e763b2f77cc5311d3aa6e487f3fe8a4c96f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:24 2015 -0500

      block: Remove "growable" from BDS

      Now that request clamping is done in the BlockBackend, the "growable"
      field can be removed from the BlockDriverState. All BDSs are now treated
      as being "growable" (that is, they are allowed to grow; they are not
      necessarily actually able to).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-16-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e7f7d676c1397291ef7d2892f86045d79ee1a1ec
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:23 2015 -0500

      block: Clamp BlockBackend requests

      BlockBackend is used as the interface between the block layer and guest
      devices. It should therefore assure that all requests are clamped to the
      image size.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-15-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4c7b7e9b94b4e81aa85de7c13e209017fc7f61dc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:22 2015 -0500

      qemu-io: Use BlockBackend

      qemu-io should behave like a guest, therefore it should use BlockBackend
      to access the block layer.

      There are a couple of places where that is infeasible: First, the
      bdrv_debug_* functions could theoretically be mirrored in the
      BlockBackend, but since these are functions internal to the block layer,
      they should not be visible externally (qemu-io as a test tool is exempt
      from this).

      Second, bdrv_get_info() and bdrv_get_specific_info() work on a single
      BDS alone, therefore they should stay BDS-specific.

      Third, bdrv_is_allocated() mainly works on a single BDS as well. Some
      data may be passed through from the BDS's file (if sectors which are
      apparently allocated in the file are not really allocated there but just
      zero).

      [Fixed conflicts around block_acct_start() usage from Fam Zheng's
      "qemu-io: Account IO by aio_read and aio_write" commit.  Use
      BlockBackend and blk_get_stats() instead of BlockDriverState.
      --Stefan]

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-14-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 10d9d75ce4cfb568b4845d8c4d0e65968f740edf
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:21 2015 -0500

      qemu-io: Remove "growable" option

      Remove "growable" option from the "open" command and from the qemu-io
      command line. qemu-io is about to be converted to BlockBackend which
      will make sure that no request exceeds the image size, so the only way
      to keep "growable" would be to use BlockBackend if it is not given and
      to directly access the BDS if it is.

      qemu-io is a debugging tool, therefore removing a rarely used option
      will have only a very small impact, if any. There was only one
      qemu-iotest which used the option; since it is not critical, this patch
      just removes it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-13-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1b58b43802a0158d74f4ea7e52f852363e63fe2f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:20 2015 -0500

      qemu-io: Use blk_new_open() in openfile()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-12-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4fbec260aec4cda50f399377b18c844113751146
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:19 2015 -0500

      qemu-nbd: Use blk_new_open() in main()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-11-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f1d3cd792b93a7f4446517213b02c6f050a47e9d
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:18 2015 -0500

      qemu-img: Use BlockBackend as far as possible

      Although qemu-img already creates BlockBackends, it does not do accesses
      to the images through them. This patch converts all of the bdrv_* calls
      for which this is currently possible to blk_* calls. Most of the
      remaining calls will probably stay bdrv_* calls because they really do
      operate on the BDS level instead of the BB level.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-10-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 644483d97e6f7a740b5a82156fe32944573a0ed1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:17 2015 -0500

      qemu-img: Use blk_new_open() in img_rebase()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-9-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5bd313266bc5874dae9833be95e5dcfce787f1b7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:16 2015 -0500

      qemu-img: Use blk_new_open() in img_open()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-8-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a925356e3a109c412240721890c1e6c1a86d286
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:15 2015 -0500

      block/xen: Use blk_new_open() in blk_connect()

      As part of the required changes, this fixes a bug where specifying an
      invalid driver would result in the block layer probing the image format;
      now it will result in an error, unless "<unset>" is specified as the
      driver name. Fixing this would require further work on the xen_disk code
      which does not seem worth it (at this point and for this patch).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-7-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e4342ce5a2bc7742c7193d1a3291ae513ca4857a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:14 2015 -0500

      blockdev: Use blk_new_open() in blockdev_init()

      Due to different error propagation, this breaks tests 051 and 087; fix
      their output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-6-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 80495fdf44ff7e44bafe9f4d8367700a197f1106
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:13 2015 -0500

      iotests: Add test for driver=qcow2, format=qcow2

      While specifying a different driver and format is obviously invalid,
      specifying the same driver once through driver and once through format
      is invalid as well. Add a test for it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-5-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b65a5e12a4136b20f9d06675d597b52d64ac903c
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:12 2015 -0500

      block: Add Error parameter to bdrv_find_protocol()

      The argument given to bdrv_find_protocol() is just a file name, which
      makes it difficult for the caller to reconstruct what protocol
      bdrv_find_protocol() was hoping to find. This patch adds an Error
      parameter to that function to solve this issue.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ca49a4fdb39d7b00b20e8500cba11aedc87755bd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:11 2015 -0500

      block: Add blk_new_open()

      blk_new_with_bs() creates a BlockBackend with an empty BlockDriverState
      attached to it. Empty BDSs are not nice, therefore add an alternative
      function which combines blk_new_with_bs() with bdrv_open().

      Note: In contrast to bdrv_open() which takes a BlockDriver parameter,
      blk_new_open() does not take such a parameter. This is because
      bdrv_open() opens a BlockDriverState, therefore it is natural to be able
      to set the BlockDriver for that BDS. The fact that bdrv_open() can open
      more than a single BDS is merely some form of a byproduct.

      blk_new_open() on the other hand is intended to be used to create a
      whole tree of BlockDriverStates. Therefore, setting a single BlockDriver
      does not make much sense. Instead, the drivers to be used for each of
      the nodes must be configured through the "options" QDict; including the
      driver of the root BDS.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1423162705-32065-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1ef01253eb90d0c69129c817e85fa92f9d45602a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Thu Feb 5 13:58:10 2015 -0500

      block: Lift some BDS functions to the BlockBackend

      Create the blk_* counterparts for the following bdrv_* functions (which
      make sense to call on the BlockBackend level):
      - bdrv_co_write_zeroes()
      - bdrv_write_compressed()
      - bdrv_truncate()
      - bdrv_nb_sectors()
      - bdrv_discard()
      - bdrv_load_vmstate()
      - bdrv_save_vmstate()

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423162705-32065-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 723bfab5cb229436ab31498a19aed931723cd3be
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 11 09:58:47 2015 -0500

      iotests: Add test for qemu-img convert to NBD

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423666727-20777-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 2e024cde1f632d7098f5da742e54186156c6aca9
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Feb 11 09:58:46 2015 -0500

      qemu-img: Fix qemu-img convert -n

      If -n is specified, it does not matter whether the output format and
      protocol support image creation; building the creation options should
      simply be skipped.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423666727-20777-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fb13bbf2fd5292d0aab617709017a4032f328730
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:46 2015 +0800

      qemu-iotests: Add 093 for IO throttling

      This case utilizes qemu-io command "aio_{read,write} -q" to verify the
      effectiveness of IO throttling options.

      It's implemented by driving the vm timer from qtest protocol, so the
      throttling timers are signaled with determinied time duration. Then we
      verify the completed IO requests are within 10% error of bps and iops
      limits.

      "null" protocol is used as the disk backend so that no actual disk IO is
      performed on host, this will make the blockstats much more
      deterministic. Both "null-aio" and "null-co" are covered, which is also
      a simple cross validation test for the driver code.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-6-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit df89d112279779609d50db93b024ed71f0402854
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:45 2015 +0800

      qemu-iotests: Allow caller to disable underscore convertion for qmp

      QMP command "block_set_io_throttle" expects underscores in parameters
      instead of dashes: {iops,bps}_{rd,wr,max}.

      Add optional argument conv_keys (defaults to True, backward compatible),
      it will be used in IO throttling test case.

      Reviewed-by: Benoit Canet <benoit@irqsave.net>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-5-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ed338bb07504091dbf36d9cc741e8363f1962a74
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:44 2015 +0800

      qemu-iotests: Add VM method qtest() to iotests.py

      This will allow test cases to run command in qtest protocol. It's
      write-only for now.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-4-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a628daa42db50a3fc1203dd81bba5a2879b76656
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:43 2015 +0800

      qtest: Add scripts/qtest.py

      This adds scripts/qtest.py as a python library for qtest protocol.

      This is a skeleton with a basic "cmd" method to execute a command,
      reading and parsing of qtest output could be added later on demand.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a91f9584565901635295b08f98d5f3048981c2f5
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 30 10:49:42 2015 +0800

      qemu-io: Account IO by aio_read and aio_write

      This will enable accounting of aio requests issued from qemu-io aio
      read/write commands.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1422586186-9925-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit efef88b3d9ad4325172ed288032807fa88d683cc
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jan 19 17:51:43 2015 +0800

      qtest: Fix deadloop by running main loop AIO context's timers

      qemu_clock_run_timers() only takes care of main_loop_tlg, we shouldn't
      forget aio timer list groups.

      Currently, the qemu_clock_deadline_ns_all (a few lines above) counts all
      the timergroups of this clock type, including aio tlg, but we don't fire
      them, so they are never cleared, which makes a dead loop.

      For example, this function hangs when trying to drive throttled block
      request queue with qtest clock_step.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421661103-29153-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a7be17bee855f26c317e99aa6582e1dc9b8ebd71
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Feb 10 13:22:56 2015 -0500

      block: vmdk - fixed sizeof() error

      The size compared should be PATH_MAX, rather than sizeof(char *).

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 46d873261433f4527e88885582f96942d61758d6.1423592487.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5d80448c3fc566e505adfa2b566ec8074442c8e1
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Feb 10 14:25:02 2015 +0100

      savevm: Improve error message for blocked migration

      If an internal snapshot can't be saved because migration is blocked
      (most commonly probably because of AHCI), we had a really bad error
      message:

      $ echo -e "savevm foo\nquit" | qemu -M q35 /tmp/test.qcow2 -monitor stdio
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) savevm foo
      Error -22 while writing VM
      (qemu) quit

      This patch converts qemu_savevm_state() to the Error infrastructure so
      that a useful error pointing to the problematic device is produced now:

      $ echo -e "savevm foo\nquit" | qemu -M q35 /tmp/test.qcow2 -monitor stdio
      QEMU 2.2.50 monitor - type 'help' for more information
      (qemu) savevm foo
      State blocked by non-migratable device '0000:00:1f.2/ich9_ahci'
      (qemu) quit

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1423574702-23072-1-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 141cabe6f144a1acb128186caf686f8fbde0a7e4
  Author: Bin Wu <wu.wubin@huawei.com>
  Date:   Tue Feb 10 15:20:46 2015 +0800

      nbd: fix the co_queue multi-adding bug

      When we tested the VM migartion between different hosts with NBD
      devices, we found if we sent a cancel command after the drive_mirror
      was just started, a coroutine re-enter error would occur. The stack
      was as follow:

      (gdb) bt
      00)  0x00007fdfc744d885 in raise () from /lib64/libc.so.6
      01)  0x00007fdfc744ee61 in abort () from /lib64/libc.so.6
      02)  0x00007fdfca467cc5 in qemu_coroutine_enter (co=0x7fdfcaedb400, opaque=0x0)
      at qemu-coroutine.c:118
      03)  0x00007fdfca467f6c in qemu_co_queue_run_restart (co=0x7fdfcaedb400) at
      qemu-coroutine-lock.c:59
      04)  0x00007fdfca467be5 in coroutine_swap (from=0x7fdfcaf3c4e8,
      to=0x7fdfcaedb400) at qemu-coroutine.c:96
      05)  0x00007fdfca467cea in qemu_coroutine_enter (co=0x7fdfcaedb400, opaque=0x0)
      at qemu-coroutine.c:123
      06)  0x00007fdfca467f6c in qemu_co_queue_run_restart (co=0x7fdfcaedbdc0) at
      qemu-coroutine-lock.c:59
      07)  0x00007fdfca467be5 in coroutine_swap (from=0x7fdfcaf3c4e8,
      to=0x7fdfcaedbdc0) at qemu-coroutine.c:96
      08)  0x00007fdfca467cea in qemu_coroutine_enter (co=0x7fdfcaedbdc0, opaque=0x0)
      at qemu-coroutine.c:123
      09)  0x00007fdfca4a1fa4 in nbd_recv_coroutines_enter_all (s=0x7fdfcaef7dd0) at
      block/nbd-client.c:41
      10) 0x00007fdfca4a1ff9 in nbd_teardown_connection (client=0x7fdfcaef7dd0) at
      block/nbd-client.c:50
      11) 0x00007fdfca4a20f0 in nbd_reply_ready (opaque=0x7fdfcaef7dd0) at
      block/nbd-client.c:92
      12) 0x00007fdfca45ed80 in aio_dispatch (ctx=0x7fdfcae15e90) at aio-posix.c:144
      13) 0x00007fdfca45ef1b in aio_poll (ctx=0x7fdfcae15e90, blocking=false) at
      aio-posix.c:222
      14) 0x00007fdfca448c34 in aio_ctx_dispatch (source=0x7fdfcae15e90, callback=0x0,
      user_data=0x0) at async.c:212
      15) 0x00007fdfc8f2f69a in g_main_context_dispatch () from
      /usr/lib64/libglib-2.0.so.0
      16) 0x00007fdfca45c391 in glib_pollfds_poll () at main-loop.c:190
      17) 0x00007fdfca45c489 in os_host_main_loop_wait (timeout=1483677098) at
      main-loop.c:235
      18) 0x00007fdfca45c57b in main_loop_wait (nonblocking=0) at main-loop.c:484
      19) 0x00007fdfca25f403 in main_loop () at vl.c:2249
      20) 0x00007fdfca266fc2 in main (argc=42, argv=0x7ffff517d638,
      envp=0x7ffff517d790) at vl.c:4814

      We find the nbd_recv_coroutines_enter_all function (triggered by a cancel
      command or a network connection breaking down) will enter a coroutine which
      is waiting for the sending lock. If the lock is still held by another coroutine,
      the entering coroutine will be added into the co_queue again. Latter, when the
      lock is released, a coroutine re-enter error will occur.

      This bug can be fixed simply by delaying the setting of recv_coroutine as
      suggested by paolo. After applying this patch, we have tested the cancel
      operation in mirror phase looply for more than 5 hous and everything is fine.
      Without this patch, a coroutine re-enter error will occur in 5 minutes.

      Signed-off-by: Bn Wu <wu.wubin@huawei.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423552846-3896-1-git-send-email-wu.wubin@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 81705ee4850b55ef4879c941e4a7703efd3cb760
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:30 2015 -0500

      qtest/ahci: Adding simple dma read-write test

      Adds a test case for AHCI wherein we write a 4K
      block of a changing pattern to sector 0, then
      read back that 4K and compare the transmit and
      receive buffers.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-20-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 122482a398db9f02287efce9eec26e08dac82bcd
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:29 2015 -0500

      qtest/ahci: Assert sector size in identify test

      A minor sanity check to assert that the sector size is 512.
      The current block layer code deeply assumes that the IDE
      sector size will be 512 bytes, so we carry forward that assumption
      here.

      This is useful for the DMA tests, which currently assume that
      a sector will always be 512 bytes.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-19-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 259342d34dbdfb304374f569feec26317edd97c9
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:28 2015 -0500

      libqos/ahci: Add ahci_clean_mem

      Clean up guest memory being used in ahci_clean_mem, to be
      called during ahci_shutdown. With all guest memory leaks removed,
      add an option to the allocator to throw an assertion if a leak
      occurs.

      This test adds some sanity to both the AHCI library and the
      allocator.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-18-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ae029620173239f3643925299790ecc5e1d72db1
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:27 2015 -0500

      libqos/ahci: add ahci_io

      ahci_io is a wrapper around ahci_guest_io that takes a pointer to host
      memory instead, and will create a guest memory buffer and copy the data
      to/from as needed and as appropriate for a read/write command, such that
      after a read, the guest data will be in a host buffer, and for a write,
      the data will be transmitted to guest memory prior to the block operation.

      Now that we have all the syntactic sugar functions in place for AHCI,
      we can convert the identify test to be very, very short.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-17-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 113221956cb819837dda5350e3f9d52819183805
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:26 2015 -0500

      libqos/ahci: Add ahci_guest_io

      ahci_guest_io is a shorthand function that will, in one shot,
      execute a data command on the guest to the specified guest buffer
      location, in the requested amount.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit cbc97569dcce317f7bb32d766d4dfcbeb7fd3013
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:25 2015 -0500

      libqos/ahci: add ahci command size setters

      Adds setters for size, prd_size and both via set_sizes.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ea41deb6022c1468de094dac12610de74220e4b0
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:24 2015 -0500

      libqos/ahci: add ahci command verify

      Helps to verify that a command completed successfully.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 64a5a272e31c99cfb348f908d71c98d2eb83ba28
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:23 2015 -0500

      libqos/ahci: add ahci command functions

      This patch adds the AHCICommand structure, and a set of functions to
      operate on the structure.

      ahci_command_create - Initialize and create a new AHCICommand in memory
      ahci_command_free - Destroy this object.
      ahci_command_set_buffer - Set where the guest memory DMA buffer is.
      ahci_command_commit - Write this command to the AHCI HBA.
      ahci_command_issue - Issue the committed command synchronously.
      ahci_command_issue_async - Issue the committed command asynchronously.
      ahci_command_wait - Wait for an asynchronous command to finish.
      ahci_command_slot - Get the number of the command slot we committed to.

      Helpers:
      size_to_prdtl       - Calculate the required minimum PRDTL size from
                            a buffer size.
      ahci_command_find   - Given an ATA command mnemonic, look it up in the
                            properties table to obtain info about the command.
      command_header_init - Initialize the command header with sane values.
      command_table_init  - Initialize the command table with sane values.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      warning:

        tests/libqos/ahci.c:598:3: warning: redefinition
        of typedef 'AHCICommand' is a C11 feature
            [-Wtypedef-redefinition]
        } AHCICommand;

      I have replaced typedef struct ... AHCICommand; with struct ... ;
      --Stefan]

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 716b64079ceaa6fede724f8a24a24b0209fa5173
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:22 2015 -0500

      libqos/ahci: Add ide cmd properties

      Add a structure that defines some properties of various IDE commands.
      These will be used to simplify the interface to the libqos AHCI calls,
      lessening the redundancy of specifying and respecifying properties of
      commands to various helper functions.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 52515766f1e18b596a6dc31421ca14a63114c9eb
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:21 2015 -0500

      qtest/ahci: add ahci_write_fis

      Similar to ahci_set_command_header, add a helper that takes an
      in-memory representation of a command FIS and writes it to guest
      memory, handling endianness as-needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1423158090-25580-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 36e367261c15f0fa9acfbe9f4301c96e19be7f52
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:20 2015 -0500

      qtest/ahci: Demagic ahci tests.

      Add human-readable command names and other miscellaneous #defines
      to help make the code more readable.

      Some of these definitions are not yet used in this current series,
      but for convenience and sanity they have been lumped together here,
      as it's more trouble than it is worth in a test suite to hand-pick,
      one-by-one, which preprocessor definitions are useful per-each test.

      These definitions include:

      ATA Command Mnemonics
      Current expected AHCI sector size
      FIS magic bytes
      REG_H2D_FIS flags
      Command Header flags

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1ef883894f0661f9994bc937ba09077a32a8bee
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:19 2015 -0500

      libqos/ahci: Add cmd response sanity check helpers

      This patch adds a few helpers to help sanity-check the response of the
      AHCI device after a command.

      ahci_d2h_check_sanity inspects the D2H Register FIS,
      ahci_pio_check_sanity inspects the PIO Setup FIS, and
      ahci_cmd_check_sanity inspects the command header.

      To support the PIO sanity check, a new structure is added for the
      PIO Setup FIS type. Existing FIS types (H2D and D2H) have had their
      members renamed slightly to condense reserved members into fewer
      fields; and LBA fields are now represented by arrays of 8 byte chunks
      instead of independent variables.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 89a46723668a35db3eac5cb59b32ba67948dee0d
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:18 2015 -0500

      libqos/ahci: Add port_check_nonbusy helper

      A simple helper that asserts a given port is not busy processing any
      commands via the TFD, Command Issue and SACT registers.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5bf99aa1cf67a210dd441ae4edf1e26df05360d5
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:17 2015 -0500

      libqos/ahci: Add ahci_port_check_interrupts helper

      A helper that compares a given port's current interrupts and checks them
      against a supplied list of expected interrupt bits, and throws an error
      if they do not match.

      The helper then resets the requested interrupts on this port, and asserts
      that the interrupt register is now empty.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 85c34e9395a97e49def6697537417ead2077c096
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:16 2015 -0500

      libqos/ahci: Add ahci_port_check_error helper

      ahci_port_check_error checks a given port's error registers and asserts
      that everything from the port-level view is still OK.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6cae27a6af159ab44f7c265d7f22d9e95880db25
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:15 2015 -0500

      libqos/ahci: Add command header helpers

      Adds command header helper functions:
      -ahci_command_header_set
      -ahci_command_header_get,
      -ahci_command_destroy, and
      -ahci_cmd_pick

      These helpers help to quickly manage the command header information in
      the AHCI device.

      ahci_command_header_set and get will store or retrieve an AHCI command
      header, respectively.

      ahci_cmd_pick chooses the first available but least recently used
      command slot to allow us to cycle through the available command slots.

      ahci_command_destroy obliterates all information contained within a
      given slot's command header, and frees its associated command table,
      but not its DMA buffer!

      Lastly, the command table pointer fields (dba and dbau) are merged into
      a single 64bit value to make managing 64bit tests simpler.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1423158090-25580-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c7f9c570b908a844aee393d93d01c332aea2a5a5
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:14 2015 -0500

      qtest/ahci: rename 'Command' to 'CommandHeader'

      The structure name is a bit of a misnomer; the structure currently named
      command is actually the commandheader. A future patch in this series
      will add an actual "Command" structure, so we'll rename it now before the
      rest of the functions in this series try to use it.

      In addition, rename the "b1" and "b2" fields
      to be a unified uint16_t named "flags."

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: John Snow <jsnow@redhat.com>
      Message-id: 1423158090-25580-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e83fd96bfab90298beaa8c8a31e48a905564180e
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:13 2015 -0500

      libqos/ahci: Add ahci_port_clear helper

      Add a helper that assists in clearing out potentially old error and FIS
      information from an AHCI port's data structures. This ensures we always
      start with a blank slate for interrupt and FIS receipt information.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e77448a385dc72fa671752ec11c84c931f316d09
  Author: John Snow <jsnow@redhat.com>
  Date:   Thu Feb 5 12:41:12 2015 -0500

      libqos/ahci: Add ahci_port_select helper

      This helper identifies which port of the
      AHCI HBA has a device we may run tests on.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423158090-25580-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b0e5d90ebc3edb5cfc1d5d33dd3334482dee6d46
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Jan 26 17:26:42 2015 +0100

      dataplane: endianness-aware accesses

      The vring.c code currently assumes that guest and host endianness match,
      which is not true for a number of cases:

      - emulating targets with a different endianness than the host
      - bi-endian targets, where the correct endianness depends on the virtio
        device
      - upcoming support for the virtio-1 standard mandates little-endian
        accesses even for big-endian targets and hosts

      Make sure to use accessors that depend on the virtio device.

      Note that dataplane now needs to be built per-target.

      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Fam Zheng <famz@redhat.com>
      Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
      Tested-by: David Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1422289602-17874-2-git-send-email-cornelia.huck@de.ibm.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a75b0a037e3a8030992244353f17b62f6daf2ab
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:03 2015 -0500

      libqos/ahci: create libqos/ahci.c

      With global state removed, code responsible for booting up,
      verifying, and initializing the AHCI HBA is extracted and
      inserted into libqos/ahci.c, which would allow for other
      qtests in the future to quickly grab a meaningfully initialized
      reference to an AHCI HBA.

      Even without other users, functionalizing and isolating the code
      assists future AHCI tests that exercise Q35 migration.

      For now, libqos/ahci.o will be PC-only, but can be expanded into
      something arch-agnostic in the future, if needed.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-16-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f3dd2da4cc8c17921cb50920600adafb02959abf
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:02 2015 -0500

      qtest/ahci: Bookmark FB and CLB pointers

      Instead of re-querying the AHCI device for the FB and CLB buffers, save
      the pointer we gave to the device during initialization and reference
      these values instead.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      compiler warnings:

        tests/libqos/ahci.c:256:40: warning: format specifies type 'unsigned
            long' but the argument has type 'uint64_t'
            (aka 'unsigned long long') [-Wformat]
              g_test_message("CLB: 0x%08lx", ahci->port[i].clb);
        tests/libqos/ahci.c:264:39: warning: format specifies type 'unsigned
            long' but the argument has type 'uint64_t'
            (aka 'unsigned long long') [-Wformat]
              g_test_message("FB: 0x%08lx", ahci->port[i].fb);

      The commit moved from uint32_t to uint64_t, so PRIx64 should be used for
      the format specifier.
      --Stefan]

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-15-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1a8bba4ddce44cff33bfd3d4976fb33923c06a1b
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:01 2015 -0500

      qtest/ahci: remove getter/setter macros

      These macros were a bad idea: They relied upon certain arguments being
      present locally with a specific name.

      With the endgoal being to factor out AHCI helper functions outside of
      the test file itself, these have to be replaced by more explicit helper
      setter/getter functions.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-14-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4882f359493cd02d7a5caa7b85d2e1bc4b2f8177
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:16:00 2015 -0500

      libqos/ahci: Functional register helpers

      Introduce a set of "static inline" register helpers that are intended to
      replace the current set of macros with more functional versions that are
      better suited to inclusion in libqos than porcelain macros.

      As a stopgap measure before eliminating the porcelain macros, define them
      to use the new functions defined in the ahci.h header.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-13-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c12e8293b8ed29d98f9ef563e997c9de8ff10e23
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:59 2015 -0500

      qtest/ahci: remove guest_malloc global

      Make helper routines rely on the earmarked
      guest allocator object with AHCIQState/QOSSTate instead.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-12-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7f410456652463db7312bc839d45396bf48a849e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:58 2015 -0500

      qtest/ahci: remove pcibus global

      Rely on the PCI Device's bus pointer instead.
      One less global to worry about.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-11-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8d5eeceddcb6464c7db3b4504c14766453db091e
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:57 2015 -0500

      qtest/ahci: finalize AHCIQState consolidation

      Move barsize, ahci_fingerprint and capabilities registers into
      the AHCIQState object, removing global ahci-related state
      from the ahci-test.c file.

      More churn, less globals.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-10-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6100ddb0f9776555b581455be4707f2077eee42f
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:56 2015 -0500

      qtest/ahci: Store hba_base in AHCIQState

      Store the HBA memory base address in the new state object, to simplify
      function prototypes and encourage a more functional testing style.

      This causes a lot of churn, but this patch is as "simplified" as I could
      get it to be. This patch is therefore fairly mechanical and straightforward:
      Any case where we pass "hba_base" has been consolidated into the AHCIQState
      object and we pass the one unified parameter.

      Any case where we reference "ahci" and "hba_state" have been modified to use
      "ahci->dev" for the PCIDevice and "ahci->hba_state" to get at the base memory
      address, accordingly.

      Notes:

       - A needless return is removed from start_ahci_device.

       - For ease of reviewing, this patch can be reproduced (mostly) by:
         # Replace (ahci, hba_base) prototypes with unified parameter
         's/(QPCIDevice \*ahci, void \*\?\*hba_base/(AHCIQState *ahci/'

         # Replace (ahci->dev, hba_base) calls with unified parameter
         's/(ahci->dev, &\?hba_base)/(ahci)/'

         # Replace calls to PCI config space using "ahci" with "ahci->dev"
         's/qpci_config_\(read\|write\)\(.\)(ahci,/qpci_config_\1\2(ahci->dev,/'

         After these, the remaining differences are easy to review by hand.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-9-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 90e5add6f2fa0b0bd9a4c1d5a4de2304b5f3e466
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:55 2015 -0500

      libqos: add pc specific interface

      Create an operations structure so that the libqos interface can be
      architecture agnostic, and create a pc-specific interface to functions
      like qtest_boot.

      Move the libqos object in the Makefile from being ahci-test only to
      being linked with all tests that utilize the libqos features.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-8-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f6f363c1f4f962aee9f69c67ab2f3ff58c30f8c1
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:54 2015 -0500

      libqos: Update QGuestAllocator to be opaque

      To avoid the architecture-specific implementations of the generic qtest
      allocator having to know about fields within the allocator, add a
      page_size setter method for users or arch specializations to use.
      The allocator will assume a default page_size for general use, but it
      can always be overridden.

      Since this was the last instance of code directly using properties of the
      QGuestAllocator object directly, modify the type to be opaque and move
      the structure inside of malloc.c.

      mlist_new, which was previously exported, is made static local to malloc.c,
      as it has no external users.

      [Peter Maydell <peter.maydell@linaro.org> reported the following clang
      warning:
        tests/libqos/malloc.c:35:3: warning:
        redefinition of typedef 'QGuestAllocator' is a C11 feature
              [-Wtypedef-redefinition]
        } QGuestAllocator;

      I converted typedef struct ... QGuestAllocator; to struct ...;
      --Stefan]

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Message-id: 1421698563-6977-7-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit fa02e6084f727191e15fc6b2d1328c4fae874741
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:53 2015 -0500

      libqos: add alloc_init_flags

      Allow a generic interface to alloc_init_flags,
      not just through pc_alloc_init_flags.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-6-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f1518d1192a1a9387f881919897fbb0101ad3426
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:52 2015 -0500

      libqos: add qtest_vboot

      Add a va_list variant of the qtest_boot function.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-5-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit dd0029c0f44d5121c64a02d3aa0440283fb72fcd
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:51 2015 -0500

      libqos: create libqos.c

      The intent of this file is to serve as a misc. utilities file to be
      shared amongst tests that are utilizing libqos facilities.

      In a later patch, migration test helpers will be added to libqos.c that
      will allow simplified testing of migration cases where libqos is
      "Just Enough OS" for migrations testing.

      The addition of the AHCIQState structure will also allow us to eliminate
      global variables inside of qtests to manage allocators and test instances
      in a better, more functional way.

      libqos.c:
              - Add qtest_boot
              - Add qtest_shutdown

      libqos.h:
              - Create QOSState structure for allocator and QTestState.

      ahci-test.c:
              - Move qtest_boot and qtest_shutdown to libqos.c/h
              - Create AHCIQState to interface with new qtest_boot/shutdown prototypes
              - Modify tests slightly to use new types.

      For now, the new object file is only linked to ahci-test, because it still
      relies on pc architecture specific code in libqos. The next two patches will
      reorganize the code to be more general.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-4-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 90fc5e097534765f30b11e34cc00aa6c6629e3ea
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:50 2015 -0500

      qtest/ahci: Create ahci.h

      Extract defines and other information to ahci.h, to be shared with other
      tests if they so please.

      At the very least, reduce clutter in the test file itself.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-3-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit af77f2cd7af1fa65a414c86767366bae95892e69
  Author: John Snow <jsnow@redhat.com>
  Date:   Mon Jan 19 15:15:49 2015 -0500

      libqos: Split apart pc_alloc_init

      Move the list-specific initialization over into
      malloc.c, to keep all of the list implementation
      details within the same file.

      The allocation and freeing of these structures are
      now both back within the same layer.

      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421698563-6977-2-git-send-email-jsnow@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 21c7f3f74959f18c5feb9b44511cb1a965c25a36
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:18 2015 -0500

      iotests: Add test for drive-mirror with NBD target

      When the drive-mirror block job is completed, it will call bdrv_swap()
      on the source and the target BDS; this should obviously not result in a
      segmentation fault.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ea82aa42835e3f56b3649c92764ac40552aac789
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:17 2015 -0500

      iotests: Add "wait" functionality to _cleanup_qemu

      The qemu process does not always need to be killed, just waiting for it
      can be fine, too. This introduces a way to do so.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f53a829bb9ef14be800556cbc02d8b20fc1050a7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 16:06:16 2015 -0500

      nbd: Drop BDS backpointer

      Before this patch, the "opaque" pointer in an NBD BDS points to a
      BDRVNBDState, which contains an NbdClientSession object, which in turn
      contains a pointer to the BDS. This pointer may become invalid due to
      bdrv_swap(), so drop it, and instead pass the BDS directly to the
      nbd-client.c functions which then retrieve the NbdClientSession object
      from there.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1423256778-3340-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit f824e8ed03cfcda55531206b2ee6fce62a7206f3
  Author: Zhoujian <jianjay.zhou@huawei.com>
  Date:   Thu Feb 12 15:43:02 2015 +0800

      qom: Fix typo, 'my_class_init' -> 'derived_class_init'

      Signed-off-by: Zhoujian <jianjay.zhou@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 09d560177101d2ef1e333754a25cfa49b70583b3
  Author: Jun Li <junmuzi@gmail.com>
  Date:   Wed Nov 5 15:03:03 2014 +0800

      qdev: Avoid type assertion in qdev_build_hotpluggable_device_list()

      Currently when *obj is not a TYPE_DEVICE, QEMU will abort. This patch
      fixes it. When *obj is not a TYPE_DEVICE, just do not add it to hotpluggable
      device list.

      This patch also fixes the following issue:
      1. boot QEMU using cli:
      $ /opt/qemu-git-arm/bin/qemu-system-x86_64 -monitor stdio -enable-kvm \
      -device virtio-scsi-pci,id=scsi0

      2. device_del scsi0 via hmp using tab key(first input device_del, then press
      "Tab" key).
      (qemu) device_del

      After step 2, QEMU will abort.
      (qemu) device_del hw/core/qdev.c:930:qdev_build_hotpluggable_device_list:
      Object 0x5555563a2460 is not an instance of type device

      Signed-off-by: Jun Li <junmuzi@gmail.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Andreas Färber <afaerber@suse.de>

  commit 9e0ff75e5158c7dbb65ee447382bbdf4cafbef8b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Feb 11 17:33:33 2015 +0100

      vnc: fix coverity warning

      vnc_display_local_addr will not be called with an invalid display id.
      Add assert() to silence coverity warning about a null pointer dereference.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0e7d6f608339029404efd025ae9b8965ffe60087
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 16:25:34 2015 +0100

      ui/vnc: optimize full scanline updates

      in case we send and update for a complete scanline increment
      the y offset to avoid running to find_next_bit for that lines
      twice.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit f7801c5ce42250bf1e84d21bceb1802cfe4485e8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 5 17:43:35 2015 +0800

      vnc: auto assian an id when calling change vnc qmp interface

      Only in this way, change vnc qmp interface can take effect,
      because qemu_opts_find(&qemu_vnc_opts, id) will return NULL
      in vnc_display_open(), It can't connect successfully vnc
      server forever.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2779672fa3f0680e63ecfd3ee2d6ff360ce948a2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Feb 5 17:43:34 2015 +0800

      vnc: introduce an wrapper for auto assign vnc id

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a2c72de09619ed4d2f4498a65027114f9c035f7f
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:36 2015 +0800

      vnc: using bool type instead of int for QEMU_OPT_BOOL

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e2a11d9d5a7d8b8450cd644e73b829dcf4686528
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:35 2015 +0800

      vnc: correct missing property about vnc_display

      Missing three property for vnc socket connection,
      revalue display variable with correct way.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 88428b7a93347efc51be015cc12cb71fab3976a3
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Jan 30 10:14:34 2015 +0800

      vnc: fix qemu crash when not configure vnc option

      Add missing vnc options: to, ipv4, ipv6 and fix
      qemu crash.

      Reproducer:
      $ x86_64-softmmu/qemu-system-x86_64
      qemu-system-x86_64: Invalid parameter 'to'
      Segmentation fault (core dumped)

      BTW the patch fix the below bug:
      https://bugs.launchpad.net/qemu/+bug/1414222

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2e13fbe42d7aed77d1b1c62b342d080c2510af0e
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:16 2015 +0100

      s390x/ipl: make s390x ipl device aware of migration

      We have to migrate the reipl parameters, so a reboot on the migrated machine
      will behave just like on the origin. Otherwise, the reipl parameters configured
      by the guest would be lost.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit e91e972ccfbaeba1d1416202ad1b667810a33e1f
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:15 2015 +0100

      s390x/ipl: drop reipl parameters on resets

      Whenever a reboot initiated by the guest is done, the reipl parameters should
      remain valid. The disk configured by the guest is to be used for
      ipl'ing. External reboot/reset request (e.g. via virsh reset guest) should
      completely reset the guest to the initial state, and therefore also reset the
      reipl parameters, resulting in an ipl behaviour of the initially configured
      guest. This could be an external kernel or a disk.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit df75a4e2c607836eee044d7e6b0d94724d6ebf21
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:14 2015 +0100

      s390x/ipl: support diagnose 308 subcodes 5 and 6

      To support dynamically updating the IPL device from inside the KVM
      guest on the s390 platform, DIAG 308 instruction is intercepted
      in QEMU to handle the request.

      Subcode 5 allows to specify a new boot device, which is saved for
      later in the s390_ipl device. This also allows to switch from an
      external kernel to a boot device.

      Subcode 6 retrieves boot device configuration that has been previously
      set.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit f0180f913e3bcd04cb132f5f6036e823a78e0673
  Author: Fan Zhang <zhangfan@linux.vnet.ibm.com>
  Date:   Thu Feb 12 18:02:13 2015 +0100

      s390x/ipl: always load the bios for ccw machine

      We will need bios support in order to be able to support selecting a
      different boot device via diagnose 308 in the ccw machine, so let's
      make the bios mandatory for the ccw machine.

      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

  commit 1ab2aea2489f34a05dabfe5bd91a76d89dd8c922
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Jan 30 15:08:05 2015 +0000

      linux-user: correct stat structure in MIPS N32

      Simple "hello world" MIPS N32 userland program crashes with segfault due to
      incorrectly defined stat structure in QEMU.

      Correct "target_stat" definition to match kernel's "stat64" as in MIPS N32
      there are only plain "stat" syscalls using 64-bit structure.

      Reported-by: Daniel Sanders <daniel.sanders@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Tested-by: Daniel Sanders <daniel.sanders@imgtec.com>
      Reviewed-by: James Hogan <james.hogan@imgtec.com>

  commit 5e88759a52934a32502298f2c78c6dfaa144364b
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:58:57 2015 +0000

      target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction

      Using rs = -1 in gen_logic_imm() for microMIPS LUI instruction is dangerous
      and may bite us when implementing microMIPS R6 because in R6 AUI and LUI
      are distinguished by rs value. Therefore use 0 for safety.

      Reported-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b40a1530f294b5fa4479dc3ca9bf46c269d08d87
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:49:42 2015 +0000

      target-mips: fix broken snapshotting

      Recently added CP0.BadInstr and CP0.BadInstrP registers ended up in cpu_load()
      under different offset than in cpu_save(). These and all registers between were
      incorrectly restored.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d3b1979d7b37c7fa6b187442e0990afa6f88fe3b
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:17:39 2015 +0000

      target-mips: use CP0EnLo_XI instead of magic number

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>

  commit 6489dd250a4d6e86ecbb4badf82cc102afe26f33
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 16:06:43 2015 +0000

      target-mips: ll and lld cause AdEL exception for unaligned address

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>

  commit fe2372910a09034591fd2cfc2d70cca43fccaa95
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Mon Jan 26 15:53:16 2015 +0000

      target-mips: fix detection of the end of the page during translation

      The test is supposed to terminate TB if the end of the page is reached.
      However, with current implementation it may never succeed for microMIPS or
      mips16.

      Reported-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 196a7958c65778d05a491309377a65c58f643a1c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Sat Dec 20 23:00:25 2014 +0000

      target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit b19c1c08de4365df90207862f4f9f7c1cd512bd9
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:56 2015 +0100

      isa: remove isa_mem_base variable

      Now that isa_mem_base variable is always 0, we can remove its usage.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f720f20350cfdf7e9d267947238cd2e5acee53f3
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:55 2015 +0100

      gt64xxx: remove isa_mem_base usage

      Create a custom address space for PCI memory region and use it for the PCI bus.
      Dynamically handle PCI0 Mem0 and PCI0 Mem1 regions, as already done for PCI0 IO.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cdba1415c159975c33776c386b934d6cb772421b
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:54 2015 +0100

      piix4: use PCI address space instead of system memory

      piix4 is only used on MIPS Malta board, which gives get_system_memory()
      to pci_register_bus().

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 0c10962a033bfd4b6935389750e567eae18bd5e7
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:53 2015 +0100

      mips: remove isa_mem_base usage

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 5c63bcf7501527b844f61624957bdba254d75bfc
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:52 2015 +0100

      jazz: remove usage of isa_mem_base

      Do assorted changes in memory-mapped rtc interface.

      Also fix size of ISA I/O memory region, which should be 0x10000 bytes.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f33772c8510ffe31b29c4bd9fc949f32f02a3954
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:51 2015 +0100

      jazz: do not explode QEMUMachineInitArgs structure

      Also remove address_space and address_space_io parameters, which
      where always get_system_memory() and get_system_io().

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit bb2ed009e7e4b278c0234143f6b6c1126f68ba35
  Author: Hervé Poussineau <hpoussin@reactos.org>
  Date:   Sun Feb 1 09:12:50 2015 +0100

      isa: add memory space parameter to isa_bus_new

      Currently, keep current behaviour by always using get_system_memory().

      Also use QOM casts when possible.

      Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cd2d5541271f1934345d8ca42f5fafff1744eee7
  Merge: e344e7a 15fc7da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 11:44:49 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150212' into staging

      Convert to linked list.

      # gpg: Signature made Fri 13 Feb 2015 05:40:41 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tcg-20150212:
        tcg: Remove unused opcodes
        tcg: Implement insert_op_before
        tcg: Remove opcodes instead of noping them out
        tcg: Put opcodes in a linked list
        tcg: Introduce tcg_op_buf_count and tcg_op_buf_full
        tcg: Move emit of INDEX_op_end into gen_tb_end
        tcg: Reduce ifdefs in tcg-op.c
        tcg: Move some opcode generation functions out of line

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e344e7afc1a04ab11c843c069cef0cdcc1c7787e
  Merge: 449008f c2ebd86
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 11:19:22 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150213' into staging

      target-arm queue:
       * PCIe support in virt board
       * Support 32-bit guests on 64-bit KVM hosts in virt board
       * Fixes to avoid C undefined behaviour

      # gpg: Signature made Fri 13 Feb 2015 05:53:07 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150213:
        target-arm: A64: Avoid signed shifts in disas_ldst_pair()
        target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
        target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
        target-arm: A64: Fix shifts into sign bit
        target-arm: Add AArch32 guest support to KVM64
        target-arm: Add 32/64-bit register sync
        target-arm: Add feature parsing to virt
        target-arm: Add CPU property to disable AArch64
        pci: Move PCI VGA to pci.mak
        arm: Add PCIe host bridge in virt machine
        pci: Add generic PCIe host bridge
        pci: Allocate PCIe host bridge PCI ID

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c2ebd862a54b7e12175d65c03ba259926cb2237a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Avoid signed shifts in disas_ldst_pair()

      Avoid shifting potentially negative signed offset values in
      disas_ldst_pair() by keeping the offset in a uint64_t rather
      than an int64_t.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-5-git-send-email-peter.maydell@linaro.org

  commit 037e1d009e2fcb80784d37f0e12aa999787d46d4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr

      Shifting a negative integer left is undefined behaviour in C.
      Avoid it by assembling and shifting the offset fields as
      unsigned values and then sign extending as the final action.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-4-git-send-email-peter.maydell@linaro.org

  commit e167adc9d9f5df4f8109aecd4552c407fdce094a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:09 2015 +0000

      target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask

      The code in logic_imm_decode_wmask attempts to rotate a mask
      value within the bottom 'e' bits of the value with
          mask = (mask >> r) | (mask << (e - r));
      This has two issues:
       * if the element size is 64 then a rotate by zero results
         in a shift left by 64, which is undefined behaviour
       * if the element size is smaller than 64 then this will
         leave junk in the value at bit 'e' and above, which is
         not valid input to bitfield_replicate(). As it happens,
         the bits at bit 'e' to '2e - r' are exactly the ones
         which bitfield_replicate is going to copy in there,
         so this isn't a "wrong code generated" bug, but it's
         confusing and if we ever put an assert in
         bitfield_replicate it would fire on valid guest code.

      Fix the former by not doing anything if r is zero, and
      the latter by masking with bitmask64(e).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-3-git-send-email-peter.maydell@linaro.org

  commit 1743d55c8b38bcee632cf6eb2de81131635bb3d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: A64: Fix shifts into sign bit

      Fix attempts to shift into the sign bit of an int, which is undefined
      behaviour in C and warned about by the clang sanitizer.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423233250-15853-2-git-send-email-peter.maydell@linaro.org

  commit 560739702764d4882662f0e70b584fa5dff7241a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add AArch32 guest support to KVM64

      Add 32-bit to/from 64-bit register synchronization on register gets and puts.
      Set EL1_32BIT feature flag passed to KVM

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1423736974-14254-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ce02049dbf1828b4bc77d921b108a9d84246e5aa
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add 32/64-bit register sync

      Add AArch32 to AArch64 register sychronization functions.
      Replace manual register synchronization with new functions in
      aarch64_cpu_do_interrupt() and HELPER(exception_return)().

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f313369fdb78f849ecbbd8e5d88f01ddf38786c8
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add feature parsing to virt

      Added machvirt parsing of feature keywords added to the -cpu command line
      option.  Parsing occurs during machine initialization.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb8d6c24b095c426151b9bba8c8b0e58b03d6503
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      target-arm: Add CPU property to disable AArch64

      Adds registration and get/set functions for enabling/disabling the AArch64
      execution state on AArch64 CPUs.  By default AArch64 execution state is enabled
      on AArch64 CPUs, setting the property to off, will disable the execution state.
      The below QEMU invocation would have AArch64 execution state disabled.

          $ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off

      Also adds stripping of features from CPU model string in acquiring the ARM CPU
      by name.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1423736974-14254-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 332261de2b979610aacde22eb15ef6e59f3c2da9
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      pci: Move PCI VGA to pci.mak

      Every platform that supports PCI can also spawn the Bochs VGA PCI adapter. Move
      it to pci.mak to enable it for everyone.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4ab29b8214cc4b54e0c1a8270b610a340311470e
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:08 2015 +0000

      arm: Add PCIe host bridge in virt machine

      Now that we have a working "generic" PCIe host bridge driver, we can plug
      it into ARM's virt machine to always have PCIe available to normal ARM VMs.

      I've successfully managed to expose a Bochs VGA device, XHCI and an e1000
      into an AArch64 VM with this and they all lived happily ever after.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      [PMM: Squashed in fix for off-by-one error in bus-range DT property
       from Laszlo Ersek <lersek@redhat.com>]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4d8fde1126419c5a858926a457a9b320a27a921a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:07 2015 +0000

      pci: Add generic PCIe host bridge

      With simple exposure of MMFG, ioport window, mmio window and an IRQ line we
      can successfully create a workable PCIe host bridge that can be mapped anywhere
      and only needs to get described to the OS using whatever means it likes.

      This patch implements such a "generic" host bridge. It handles 4 legacy IRQ
      lines. MSIs need to be handled external to the host bridge.

      This device is particularly useful for the "pci-host-ecam-generic" driver in
      Linux.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Tested-by: Claudio Fontana <claudio.fontana@huawei.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bf439db4993b02033d4fba8460ca4dc45b15071a
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Feb 13 05:46:07 2015 +0000

      pci: Allocate PCIe host bridge PCI ID

      We are going to introduce a PCIe host controller that doesn't exist that
      way in real hardware, but still needs to expose some PCIe root device which
      has PCI IDs.

      Allocate a PCI ID in the Red Hat space that we use for other devices of this
      kind.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 15fc7daa770764cc795158cbb525569f156f3659
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 20:40:35 2014 -0700

      tcg: Remove unused opcodes

      We no longer need INDEX_op_end to terminate the list, nor do we
      need 5 forms of nop, since we just remove the TCGOp instead.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit a4ce099a7a4b4734c372f6bf28f3362e370f23c1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 17:14:02 2014 -0700

      tcg: Implement insert_op_before

      Rather reserving space in the op stream for optimization,
      let the optimizer add ops as necessary.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0c627cdca20155753a536c51385abb73941a59a0
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 16:51:54 2014 -0700

      tcg: Remove opcodes instead of noping them out

      With the linked list scheme we need not leave nops in the stream
      that we need to process later.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit c45cb8bb89fc798489869982c4c463b26ce43d7b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 13:49:15 2014 -0700

      tcg: Put opcodes in a linked list

      The previous setup required ops and args to be completely sequential,
      and was error prone when it came to both iteration and optimization.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit fe700adb3db5b028b504423b946d4ee5200a8f2f
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 15:36:56 2014 -0700

      tcg: Introduce tcg_op_buf_count and tcg_op_buf_full

      The method by which we count the number of ops emitted
      is going to change.  Abstract that away into some inlines.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0a7df5da986bd7ee0789f2d7b8611f2e8eee5046
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Sun Mar 30 14:50:30 2014 -0700

      tcg: Move emit of INDEX_op_end into gen_tb_end

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 3a13c3f34ce2058e0c2decc3b0f9f56be24c9400
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 11:41:05 2014 -0700

      tcg: Reduce ifdefs in tcg-op.c

      Almost completely eliminates the ifdefs in this file, improving
      confidence in the lesser used 32-bit builds.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 951c6300f74ace35d87c079affc57cfc513a6a35
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 19 11:39:20 2014 -0700

      tcg: Move some opcode generation functions out of line

      Some of these functions are really quite large.  We have a number of
      things that ought to be circularly dependent, but we duplicated code
      to break that chain for the inlines.

      This saved 25% of the code size of one of the translators I examined.

      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ac95190ea92f7625bb0065c2864321607b95c26b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:21:04 2015 +0100

      memory: keep the owner of the AddressSpace alive until do_address_space_destroy

      This fixes a use-after-free if do_address_space_destroy is executed
      too late.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a464982499b2f637f6699e3d03e0a9d2e0b5288b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 17:15:18 2015 +0100

      rcu: run RCU callbacks under the BQL

      This needs to go away sooner or later, but one complication is the
      complex VFIO data structures that are modified in instance_finalize.
      Take a shortcut for now.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a7d1d636797ec1b30ca4dae02f9e1eb2d6b2c439
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Feb 11 15:51:54 2015 +0100

      rcu: do not let RCU callbacks pile up indefinitely

      Always process them within a short time.  Even though waiting a little
      is useful, it is not okay to delay e.g. qemu_opts_del forever.

      Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 444c7e0d92b5eb35fb85dc654f4bd991b0d3a0f2
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:55 2015 +0800

      vhost-scsi: set the bootable value of channel/target/lun

      At present, the target is valued boot_tpgt, In addition,
      channel and lun both are 0 for bootable vhost-scsi device.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Bo Su <subo7@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9143d5f0f14c1eef92a362b3b976606ad2874daa
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:54 2015 +0800

      vhost-scsi: add a property for booting

      Because Qemu only accept an wwpn argument for vhost-scsi, we
      cannot assign a tpgt. That's say tpg is transparent for Qemu, Qemu
      doesn't know which tpg can boot, but vhost-scsi driver module
      doesn't know too for one assigned wwpn.

      At present, we assume that the first tpg can boot only, and add
      a boot_tpgt property that defaults to 0. Of course, people can
      pass a valid value by qemu command line.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1956cf6fa1039647327ef333dc09b43775907305
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:53 2015 +0800

      vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface

      In the way, we can make the bootindex property take effect.
      At the meanwhile, the firmware path name of vhost-scsi is
      "channel@channel/vhost-scsi@target,lun".

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d4433f32116dc597f895e62cde3572b400c3ee96
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:52 2015 +0800

      vhost-scsi: add bootindex property

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0be63901d2a33a6ed25caa5df3f530df75338f6a
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Jan 29 15:08:51 2015 +0800

      qdev: support to get a device firmware path directly

      commit 6b1566c (qdev: Introduce FWPathProvider interface) did a
      good job for supproting to get firmware path on some different
      architectures.

      Moreover further more, we can use the interface to get firmware
      path name for a device which isn't attached a specific bus,
      such as virtio-bus, scsi-bus etc.

      When the device (such as vhost-scsi) realize the TYPE_FW_PATH_PROVIDER
      interface, we should introduce a new function to get the correct firmware
      path name for it.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit edecf5eced082cb45e213cb4e791b2fcf9f867c1
  Author: Wei Huang <wei@redhat.com>
  Date:   Fri Jan 30 13:17:08 2015 -0500

      kvm_stat: Add kvm_exit reasons for aarch64

      This patch defines the list of kvm_exit reasons for aarch64. This list is
      based on the Exception Class (EC) field of HSR register. With this patch
      users can trace the execution of guest VMs better. A sample output from
      command "kvm_stat -1 -t" is shown as the following:
      <...>
      kvm_exit(WATCHPT_HYP)          0         0
      kvm_exit(WFI)               9422      9361

      NOTE: This patch requires TRACE_EVENT(kvm_exit) to include exit_reason
      field in TP_ARGS. A patch to upstream kernel has been submitted.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 449008f86418583a1f0fb946cf91ee7b4797317d
  Merge: 5c697ae bc5baff
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Feb 11 05:14:41 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging

      RCU fixes and cleanup (Paolo Bonzini)
      Switch to v2 IOMMU interface (Alex Williamson)
      DEBUG build fix (Alexey Kardashevskiy)

      # gpg: Signature made Tue 10 Feb 2015 17:37:06 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150210.0:
        vfio: Fix debug message compile error
        vfio: Use vfio type1 v2 IOMMU interface
        vfio: unmap and free BAR data in instance_finalize
        vfio: free dynamically-allocated data in instance_finalize
        vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback
        memory: unregister AddressSpace MemoryListener within BQL

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc5baffa3554e4c0d20c1dbe879aec931866bd69
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: Fix debug message compile error

      This fixes a compiler error which occurs if DEBUG_VFIO is defined.

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 2e6e697e166568fdd09ceaa8c7c8c8c53a5e345b
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: Use vfio type1 v2 IOMMU interface

      The difference between v1 and v2 is fairly subtle, simply more
      deterministic behavior for unmaps.  The v1 interface allows the user
      to attempt to unmap sub-regions of previous mappings, returning
      success with zero size if unable to comply.  This was a reflection of
      the underlying IOMMU API.  The v2 interface requires that the user
      may only unmap fully contained mappings, ie. an unmap cannot intersect
      or bisect a previous mapping, but may cover multiple mappings.  QEMU
      never made use of the sub-region v1 support anyway, so we can support
      either v1 or v2.  We'll favor v2 since it's newer.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ba5e6bfa1aee29a8f72c5538c565dfb9889cf273
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: unmap and free BAR data in instance_finalize

      In the case of VFIO, the unrealize callback is too early to munmap the
      BARs.  The munmap must be delayed until memory accesses are complete.
      To do this, split vfio_unmap_bars in two.  The removal step, now called
      vfio_unregister_bars, remains in vfio_exitfn.  The reclamation step
      is vfio_unmap_bars and is moved to the instance_finalize callback.

      Similarly, quirk MemoryRegions have to be removed during
      vfio_unregister_bars, but freeing the data structure must be delayed
      to vfio_unmap_bars.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 77a10d04d033484a913a5ee76eed31a9acc57bae
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: free dynamically-allocated data in instance_finalize

      In order to enable out-of-BQL address space lookup, destruction of
      devices needs to be split in two phases.

      Unrealize is the first phase; once it complete no new accesses will
      be started, but there may still be pending memory accesses can still
      be completed.

      The second part is freeing the device, which only happens once all memory
      accesses are complete.  At this point the reference count has dropped to
      zero, an RCU grace period must have completed (because the RCU-protected
      FlatViews hold a reference to the device via memory_region_ref).  This is
      when instance_finalize is called.

      Freeing data belongs in an instance_finalize callback, because the
      dynamically allocated memory can still be used after unrealize by the
      pending memory accesses.

      This starts the process by creating an instance_finalize callback and
      freeing most of the dynamically-allocated data in instance_finalize.
      Because instance_finalize is also called on error paths or also when
      the device is actually not realized, the common code needs some changes
      to be ready for this.  The error path in vfio_initfn can be simplified too.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 217e9fdcadb1dc7462f4d92866314f626426fa82
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback

      Now that vfio_put_base_device is called unconditionally at instance_finalize
      time, it can be called twice if vfio_populate_device fails.  This works
      but it is slightly harder to follow.

      Change vfio_get_device to not touch the vbasedev struct until it will
      definitely succeed, moving the vfio_populate_device call back to vfio-pci.
      This way, vfio_put_base_device will only be called once.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 6e48e8f9e0f5b6b15c41f6f8a68c9bf330147d45
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Feb 10 10:25:44 2015 -0700

      memory: unregister AddressSpace MemoryListener within BQL

      address_space_destroy_dispatch is called from an RCU callback and hence
      outside the iothread mutex (BQL).  However, after address_space_destroy
      no new accesses can hit the destroyed AddressSpace so it is not necessary
      to observe changes to the memory map.  Move the memory_listener_unregister
      call earlier, to make it thread-safe again.

      Reported-by: Alex Williamson <alex.williamson@redhat.com>
      Fixes: 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 5c697ae74170d43928cb185f5ac1a9058adcae0b
  Merge: 89db217 43d7355
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 10 09:51:46 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-02-10' into staging

      trivial patches for 2015-02-10

      # gpg: Signature made Tue 10 Feb 2015 07:27:11 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-02-10: (45 commits)
        virtio: Fix warning caused by missing 'static' attribute
        vga: Fix warning caused by missing 'static' attribute
        stubs: Fix warning caused by missing include statement
        spice: Add missing 'static' attribute
        serial: Fix warnings caused by missing 'static' attribute
        moxie: Fix warning caused by missing include statement
        migration: Fix warnings caused by missing 'static' attribute
        migration: Fix warning caused by missing declaration of vmstate_dummy
        disas/sh4: Fix warning caused by missing 'static' attribute
        translate-all: Use g_try_malloc() for dynamic translator buffer
        vnc: g_realloc() can't fail, bury dead error handling
        rdma: g_malloc0() can't fail, bury dead error handling
        kvm: g_malloc() can't fail, bury dead error handling
        rtl8139: g_malloc() can't fail, bury dead error handling
        onenand: g_malloc() can't fail, bury dead error handling
        Fix name error in migration stream analyzation script
        QJSON: fix typo in author's email address
        util/uri: URI member path can be null, compare more carfully
        util/uri: realloc2n() can't fail, drop dead error handling
        util/uri: uri_new() can't fail, drop dead error handling
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 43d735547b2a29cafd7d9529ac38734950b235f7
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:17 2015 +0100

      virtio: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      hw/char/virtio-serial-bus.c:31:3:
       warning: symbol 'vserdevices' was not declared. Should it be static?

      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Anthony Liguori <aliguori@amazon.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 73d22cafcaea7cb7b5f3ebbff2df5458d3f3c570
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:16 2015 +0100

      vga: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      hw/display/vga.c:2012:26: warning:
       symbol 'vmstate_vga_endian' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2822c1b65b54341dee33a85c96d419512f2b2da2
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:15 2015 +0100

      stubs: Fix warning caused by missing include statement

      Warning from the Sparse static analysis tool:

      stubs/qtest.c:14:6:
       warning: symbol 'qtest_allowed' was not declared. Should it be static?

      Add the missing include statement which declares qtest_allowed.

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 51575c3fca79b90953502dd1fa574711155a167e
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:14 2015 +0100

      spice: Add missing 'static' attribute

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 92013cf8ca10adafec9a92deb5df993e7df22cb9
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:13 2015 +0100

      serial: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      hw/char/serial.c:630:26: warning: symbol
       'vmstate_serial_thr_ipending' was not declared. Should it be static?
      hw/char/serial.c:646:26: warning: symbol
       'vmstate_serial_tsr' was not declared. Should it be static?
      hw/char/serial.c:665:26: warning: symbol
       'vmstate_serial_recv_fifo' was not declared. Should it be static?
      hw/char/serial.c:681:26: warning: symbol
       'vmstate_serial_xmit_fifo' was not declared. Should it be static?
      hw/char/serial.c:697:26: warning: symbol
       'vmstate_serial_fifo_timeout_timer' was not declared. Should it be static?
      hw/char/serial.c:713:26: warning: symbol
       'vmstate_serial_timeout_ipending' was not declared. Should it be static?
      hw/char/serial.c:729:26: warning: symbol
       'vmstate_serial_poll' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 302fe1235cf61df432cb3e5ff7e4fb7cc8561679
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:12 2015 +0100

      moxie: Fix warning caused by missing include statement

      Warning from the Sparse static analysis tool:

      target-moxie/machine.c:4:26:
       warning: symbol 'vmstate_moxie_cpu' was not declared. Should it be static?

      machine.h includes the missing declaration.

      Cc: Anthony Green <green@moxielogic.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2ae31aea21853c121968560138a817f103aafb92
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:11 2015 +0100

      migration: Fix warnings caused by missing 'static' attribute

      Warnings from the Sparse static analysis tool:

      migration-rdma.c:151:12: warning:
       symbol 'wrid_desc' was not declared. Should it be static?
      migration-rdma.c:190:12: warning:
       symbol 'control_desc' was not declared. Should it be static?
      migration-rdma.c:3301:19: warning:
       symbol 'rdma_read_ops' was not declared. Should it be static?
      migration-rdma.c:3308:19: warning:
       symbol 'rdma_write_ops' was not declared. Should it be static?

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6afc14e92ac81b29c25f097468f7751d5df1b5bc
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:10 2015 +0100

      migration: Fix warning caused by missing declaration of vmstate_dummy

      Warning from the Sparse static analysis tool:

      stubs/vmstate.c:4:26: warning:
       symbol 'vmstate_dummy' was not declared. Should it be static?

      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 084cc83996d1414d4713a84291a0fadf4199b9d2
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Fri Feb 6 22:43:09 2015 +0100

      disas/sh4: Fix warning caused by missing 'static' attribute

      Warning from the Sparse static analysis tool:

      disas/sh4.c:335:22: warning:
       symbol 'sh_table' was not declared. Should it be static?

      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b98ade31ed7994d6bcbb0600ad0ea3f3d881088
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:07 2015 +0100

      translate-all: Use g_try_malloc() for dynamic translator buffer

      The USE_MMAP code can fail, and the caller handles the failure
      already.  Let the !USE_MMAP code fail as well, for consistency.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4b3be73006d5d65d44bd482cc6e3cf2f4ab12c34
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:06 2015 +0100

      vnc: g_realloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e75bef035a80a1bd406375f22e32e37010bbdcd7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:05 2015 +0100

      rdma: g_malloc0() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9834fe02b00552648d498ca561b51f8ff1d7df31
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:04 2015 +0100

      kvm: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 66c5f3e596398a84949fb39e3d7b5f2c0ce3ea0f
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:03 2015 +0100

      rtl8139: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 6b0126f94099db15fb0110218b17eeccefa077d1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Feb 4 11:26:02 2015 +0100

      onenand: g_malloc() can't fail, bury dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit be7433efbf8b4134ab9763abdecaf2e6a35e1ed1
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Sat Feb 7 11:25:14 2015 +0100

      Fix name error in migration stream analyzation script

      It fixes the following error:

      Traceback (most recent call last):
        File "./scripts/analyze-migration.py", line 584, in <module>
          dump.read(dump_memory = args.memory)
        File "./scripts/analyze-migration.py", line 528, in read
          self.sections[section_id].read()
        File "./scripts/analyze-migration.py", line 250, in read
          self.file.readvar(n_valid * HASH_PTE_SIZE_64)
      NameError: global name 'HASH_PTE_SIZE_64' is not defined

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 559782cc94581481cb7748eb17c4790e418bf86e
  Author: Greg Kurz <gkurz@linux.vnet.ibm.com>
  Date:   Sat Feb 7 11:25:50 2015 +0100

      QJSON: fix typo in author's email address

      Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit afb30dde3ad71349fc65726946d58e5d3c61f8af
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:52 2015 +0100

      util/uri: URI member path can be null, compare more carfully

      uri_resolve_relative() calls strcmp(bas->path, ref->path).  However,
      either argument could be null!  Evidence: the code checks for null
      after the comparison.  Spotted by Coverity.

      I suspect this was screwed up when we stole the code from libxml2.
      There the conditional reads

          xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)

      with

          int
          xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
      	if (str1 == str2) return(1);
      	if (str1 == NULL) return(0);
      	if (str2 == NULL) return(0);
      	do {
      	    if (*str1++ != *str2) return(0);
      	} while (*str2++);
      	return(1);
          }

      Fix by replicating libxml2's logic faithfully.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit afd5ea3671f936f511015a71af9cd0ed23788515
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:51 2015 +0100

      util/uri: realloc2n() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c89c6e80a66aac16d7b14ff21e0aaeb99ebfe165
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 27 17:13:50 2015 +0100

      util/uri: uri_new() can't fail, drop dead error handling

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 0c6f807f4a98e7e258765dcf22619a582995fce0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:04 2015 +0100

      usb: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5f1d1fc5928a6f8f63089b3d0768e0dc42c05fbb
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:03 2015 +0100

      spapr_vio: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit c0462f6d75fa481f7660c15a5ca3a60205aa4eca
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:02 2015 +0100

      qemu-option: Pair g_malloc() with g_free(), not free()

      Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
      and my "coverity: Model g_free() isn't necessarily free()" model patch
      applied.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 96c044afdf600e9418b3e509e60ef51a841eed20
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 15:54:01 2015 +0100

      qemu-option: Replace pointless use of g_malloc0() by g_malloc()

      get_opt_value() takes a write-only buffer, so zeroing it is pointless.
      We don't do it elsewhere, either.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b41112c46b93f781669c0eb89e51d3a87af6bb49
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Tue Feb 3 11:31:30 2015 +0000

      libcacard: stop linking against every single 3rd party library

      Building QEMU results in a libcacard.so that links against
      practically the entire world

      	linux-vdso.so.1 =>  (0x00007fff71e99000)
      	libssl3.so => /usr/lib64/libssl3.so (0x00007f49f94b6000)
      	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f49f928e000)
      	libnss3.so => /usr/lib64/libnss3.so (0x00007f49f8f67000)
      	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f49f8d3b000)
      	libplds4.so => /usr/lib64/libplds4.so (0x00007f49f8b36000)
      	libplc4.so => /usr/lib64/libplc4.so (0x00007f49f8931000)
      	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f49f86f2000)
      	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f49f84ed000)
      	libm.so.6 => /usr/lib64/libm.so.6 (0x00007f49f81e5000)
      	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f49f7fe3000)
      	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f49f7dda000)
      	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f49f7bc4000)
      	libcap-ng.so.0 => /usr/lib64/libcap-ng.so.0 (0x00007f49f79be000)
      	libuuid.so.1 => /usr/lib64/libuuid.so.1 (0x00007f49f77b8000)
      	libgnutls.so.28 => /usr/lib64/libgnutls.so.28 (0x00007f49f749a000)
      	libSDL-1.2.so.0 => /usr/lib64/libSDL-1.2.so.0 (0x00007f49f71fd000)
      	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f49f6fe0000)
      	libvte.so.9 => /usr/lib64/libvte.so.9 (0x00007f49f6d3f000)
      	libXext.so.6 => /usr/lib64/libXext.so.6 (0x00007f49f6b2d000)
      	libgtk-x11-2.0.so.0 => /usr/lib64/libgtk-x11-2.0.so.0 (0x00007f49f64a0000)
      	libgdk-x11-2.0.so.0 => /usr/lib64/libgdk-x11-2.0.so.0 (0x00007f49f61de000)
      	libpangocairo-1.0.so.0 => /usr/lib64/libpangocairo-1.0.so.0 (0x00007f49f5fd1000)
      	libatk-1.0.so.0 => /usr/lib64/libatk-1.0.so.0 (0x00007f49f5daa000)
      	libcairo.so.2 => /usr/lib64/libcairo.so.2 (0x00007f49f5a9d000)
      	libgdk_pixbuf-2.0.so.0 => /usr/lib64/libgdk_pixbuf-2.0.so.0 (0x00007f49f5878000)
      	libgio-2.0.so.0 => /usr/lib64/libgio-2.0.so.0 (0x00007f49f5500000)
      	libpangoft2-1.0.so.0 => /usr/lib64/libpangoft2-1.0.so.0 (0x00007f49f52eb000)
      	libpango-1.0.so.0 => /usr/lib64/libpango-1.0.so.0 (0x00007f49f50a0000)
      	libgobject-2.0.so.0 => /usr/lib64/libgobject-2.0.so.0 (0x00007f49f4e4e000)
      	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f49f4b15000)
      	libfontconfig.so.1 => /usr/lib64/libfontconfig.so.1 (0x00007f49f48d6000)
      	libfreetype.so.6 => /usr/lib64/libfreetype.so.6 (0x00007f49f462b000)
      	libX11.so.6 => /usr/lib64/libX11.so.6 (0x00007f49f42e8000)
      	libxenstore.so.3.0 => /usr/lib64/libxenstore.so.3.0 (0x00007f49f40de000)
      	libxenctrl.so.4.4 => /usr/lib64/libxenctrl.so.4.4 (0x00007f49f3eb6000)
      	libxenguest.so.4.4 => /usr/lib64/libxenguest.so.4.4 (0x00007f49f3c8b000)
      	libseccomp.so.2 => /usr/lib64/libseccomp.so.2 (0x00007f49f3a74000)
      	librdmacm.so.1 => /usr/lib64/librdmacm.so.1 (0x00007f49f385d000)
      	libibverbs.so.1 => /usr/lib64/libibverbs.so.1 (0x00007f49f364a000)
      	libutil.so.1 => /usr/lib64/libutil.so.1 (0x00007f49f3447000)
      	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f49f3089000)
      	/lib64/ld-linux-x86-64.so.2 (0x00007f49f9902000)
      	libp11-kit.so.0 => /usr/lib64/libp11-kit.so.0 (0x00007f49f2e23000)
      	libtspi.so.1 => /usr/lib64/libtspi.so.1 (0x00007f49f2bb2000)
      	libtasn1.so.6 => /usr/lib64/libtasn1.so.6 (0x00007f49f299f000)
      	libnettle.so.4 => /usr/lib64/libnettle.so.4 (0x00007f49f276d000)
      	libhogweed.so.2 => /usr/lib64/libhogweed.so.2 (0x00007f49f2545000)
      	libgmp.so.10 => /usr/lib64/libgmp.so.10 (0x00007f49f22cd000)
      	libncurses.so.5 => /usr/lib64/libncurses.so.5 (0x00007f49f20a5000)
      	libtinfo.so.5 => /usr/lib64/libtinfo.so.5 (0x00007f49f1e7a000)
      	libgmodule-2.0.so.0 => /usr/lib64/libgmodule-2.0.so.0 (0x00007f49f1c76000)
      	libXfixes.so.3 => /usr/lib64/libXfixes.so.3 (0x00007f49f1a6f000)
      	libXrender.so.1 => /usr/lib64/libXrender.so.1 (0x00007f49f1865000)
      	libXinerama.so.1 => /usr/lib64/libXinerama.so.1 (0x00007f49f1662000)
      	libXi.so.6 => /usr/lib64/libXi.so.6 (0x00007f49f1452000)
      	libXrandr.so.2 => /usr/lib64/libXrandr.so.2 (0x00007f49f1247000)
      	libXcursor.so.1 => /usr/lib64/libXcursor.so.1 (0x00007f49f103c000)
      	libXcomposite.so.1 => /usr/lib64/libXcomposite.so.1 (0x00007f49f0e39000)
      	libXdamage.so.1 => /usr/lib64/libXdamage.so.1 (0x00007f49f0c35000)
      	libharfbuzz.so.0 => /usr/lib64/libharfbuzz.so.0 (0x00007f49f09dd000)
      	libpixman-1.so.0 => /usr/lib64/libpixman-1.so.0 (0x00007f49f072f000)
      	libEGL.so.1 => /usr/lib64/libEGL.so.1 (0x00007f49f0505000)
      	libpng16.so.16 => /usr/lib64/libpng16.so.16 (0x00007f49f02d2000)
      	libxcb-shm.so.0 => /usr/lib64/libxcb-shm.so.0 (0x00007f49f00cd000)
      	libxcb-render.so.0 => /usr/lib64/libxcb-render.so.0 (0x00007f49efec3000)
      	libxcb.so.1 => /usr/lib64/libxcb.so.1 (0x00007f49efca1000)
      	libGL.so.1 => /usr/lib64/libGL.so.1 (0x00007f49efa06000)
      	libffi.so.6 => /usr/lib64/libffi.so.6 (0x00007f49ef7fe000)
      	libselinux.so.1 => /usr/lib64/libselinux.so.1 (0x00007f49ef5d8000)
      	libresolv.so.2 => /usr/lib64/libresolv.so.2 (0x00007f49ef3be000)
      	libexpat.so.1 => /usr/lib64/libexpat.so.1 (0x00007f49ef193000)
      	libbz2.so.1 => /usr/lib64/libbz2.so.1 (0x00007f49eef83000)
      	libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007f49eed6c000)
      	liblzma.so.5 => /usr/lib64/liblzma.so.5 (0x00007f49eeb46000)
      	libnl-route-3.so.200 => /usr/lib64/libnl-route-3.so.200 (0x00007f49ee8e2000)
      	libnl-3.so.200 => /usr/lib64/libnl-3.so.200 (0x00007f49ee6c4000)
      	libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f49ee2d6000)
      	libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f49ee067000)
      	libgraphite2.so.3 => /usr/lib64/libgraphite2.so.3 (0x00007f49ede48000)
      	libX11-xcb.so.1 => /usr/lib64/libX11-xcb.so.1 (0x00007f49edc46000)
      	libxcb-dri2.so.0 => /usr/lib64/libxcb-dri2.so.0 (0x00007f49eda41000)
      	libxcb-xfixes.so.0 => /usr/lib64/libxcb-xfixes.so.0 (0x00007f49ed838000)
      	libxcb-shape.so.0 => /usr/lib64/libxcb-shape.so.0 (0x00007f49ed634000)
      	libgbm.so.1 => /usr/lib64/libgbm.so.1 (0x00007f49ed426000)
      	libwayland-client.so.0 => /usr/lib64/libwayland-client.so.0 (0x00007f49ed217000)
      	libwayland-server.so.0 => /usr/lib64/libwayland-server.so.0 (0x00007f49ed005000)
      	libglapi.so.0 => /usr/lib64/libglapi.so.0 (0x00007f49ecddb000)
      	libdrm.so.2 => /usr/lib64/libdrm.so.2 (0x00007f49ecbce000)
      	libXau.so.6 => /usr/lib64/libXau.so.6 (0x00007f49ec9ca000)
      	libxcb-glx.so.0 => /usr/lib64/libxcb-glx.so.0 (0x00007f49ec7b0000)
      	libxcb-dri3.so.0 => /usr/lib64/libxcb-dri3.so.0 (0x00007f49ec5ad000)
      	libxcb-present.so.0 => /usr/lib64/libxcb-present.so.0 (0x00007f49ec3aa000)
      	libxcb-randr.so.0 => /usr/lib64/libxcb-randr.so.0 (0x00007f49ec19b000)
      	libxcb-sync.so.1 => /usr/lib64/libxcb-sync.so.1 (0x00007f49ebf94000)
      	libxshmfence.so.1 => /usr/lib64/libxshmfence.so.1 (0x00007f49ebd91000)
      	libXxf86vm.so.1 => /usr/lib64/libXxf86vm.so.1 (0x00007f49ebb8a000)
      	libpcre.so.1 => /usr/lib64/libpcre.so.1 (0x00007f49eb91d000)
      	libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00007f49eb6cf000)
      	libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00007f49eb3ec000)
      	libcom_err.so.2 => /usr/lib64/libcom_err.so.2 (0x00007f49eb1e8000)
      	libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00007f49eafb4000)
      	libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00007f49eada5000)
      	libkeyutils.so.1 => /usr/lib64/libkeyutils.so.1 (0x00007f49eaba0000)

      All libcacard actually needs are the NSS libs. Linking against the entire
      world is a regression caused by

        commit 9d171bd9375e4d08feff9adda15163e0811f5f42
        Author: Michael Tokarev <mjt@tls.msk.ru>
        Date:   Thu May 8 16:48:27 2014 +0400

          libcacard: remove libcacard-specific CFLAGS and LIBS from global vars

      Which removed the setting of the LIBS variable in libcacard/Makefile.

      Adding it back as an empty assignment brings the linked libs back to a more
      reasonable set

      	linux-vdso.so.1 =>  (0x00007fff575c1000)
      	libssl3.so => /usr/lib64/libssl3.so (0x00007f7f753b1000)
      	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f7f75189000)
      	libnss3.so => /usr/lib64/libnss3.so (0x00007f7f74e62000)
      	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f7f74c36000)
      	libplds4.so => /usr/lib64/libplds4.so (0x00007f7f74a31000)
      	libplc4.so => /usr/lib64/libplc4.so (0x00007f7f7482c000)
      	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f7f745ed000)
      	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f7f743d0000)
      	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f7f741cc000)
      	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f7f73fca000)
      	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f7f73c90000)
      	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f7f738d3000)
      	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f7f736bd000)
      	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f7f734b4000)
      	/lib64/ld-linux-x86-64.so.2 (0x00007f7f757fd000)

      Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
      Cc: <qemu-stable@nongnu.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit aa5e03d2aa4ed19bfb7f4ce80092758018c6a71c
  Author: Maxim Ostapenko <m.ostapenko@partner.samsung.com>
  Date:   Mon Feb 2 18:18:29 2015 +0400

      linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

      Fix TARGET_SI_PAD_SIZE calculation to match the way the kernel does it.
      Use different TARGET_SI_PREAMBLE_SIZE for 32-bit and 64-bit targets.

      Signed-off-by: Maxim Ostapenko <m.ostapenko@partner.samsung.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 55a10996034cb2e633f0437cedd97f345183c0ec
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jan 30 20:37:55 2015 +0100

      qemu-sockets: Fix buffer overflow in inet_parse()

      The size of the stack allocated host[] array didn't account for the
      terminating '\0' byte that sscanf() writes. Fix the array size.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 02f292d9051f616511f482275b571c6153e3a48b
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Wed Jan 28 16:07:17 2015 +0100

      vl.c: fix memory leak spotted by valgrind

      valgrind complains about:
      ==42062== 16 bytes in 1 blocks are definitely lost in loss record 387 of 1,048
      ==42062==    at 0x402DCB2: malloc (vg_replace_malloc.c:299)
      ==42062==    by 0x40C1BE3: g_malloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x40DA133: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x40DB2E5: g_slist_prepend (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x801637FF: object_class_get_list_tramp (object.c:690)
      ==42062==    by 0x40A96C9: g_hash_table_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
      ==42062==    by 0x80164885: object_class_foreach (object.c:665)
      ==42062==    by 0x80164975: object_class_get_list (object.c:698)
      ==42062==    by 0x800100A5: machine_parse (vl.c:2447)
      ==42062==    by 0x800100A5: main (vl.c:3756)

      Lets free machines in case of mc.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a50c7c869a4fa1c78b4c38d3419566dd25d32e90
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:26 2015 +0100

      aes: remove a dead return statement

      bits is checked to be 128, 192 or 256 at the beginning of the function.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b658c53d2b87c1e9e0ade887a70ecb0de1474a7b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:24 2015 +0100

      qemu-sockets: improve error reporting in unix_listen_opts

      Coverity complains about not checking the returned value of mkstemp.  While
      at it, also improve error checking for snprintf, and refine error messages
      in general.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 52851b7e3d816502b8ae4e8353f31fd9ee801509
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:22 2015 +0100

      cpu-exec: simplify icount code

      Use MIN instead of an "if" statement.  Move "tb" assignment where
      the value is actually used.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a7fa2e9783ee957635d23ddab151a8be97df5b2a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 26 12:12:21 2015 +0100

      cpu-exec: drop dead assignment

      All uses of TB inside cpu_exec are dominated by "tb = tb_find_fast(env)",
      and there are no uses after the switch statement.  So the assignment
      is dead, as reported by Coverity.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dbfe1b6aef1751bced58cbd4a7a3868721ace2ba
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Jan 27 13:11:26 2015 +0100

      qemu-log: Correct help text of 'log cpu_reset'

      The logging of the CPU state during reset is done for all architectures
      nowadays (see cpu_common_reset() in qom/cpu.c), so the "x86 only" text
      does not apply here anymore.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit dec0473dc683ac0ddd7946acdebd285728966a02
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 08:00:42 2015 +0800

      linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

      In abi_long do_ioctl_dm(), after lock_user() call, the code does
      not call unlock_user() before going to failure return in default case.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit a86b3c64d45f2bf306fd4bf879abb4ac21d761f9
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Sun Jan 25 19:35:58 2015 +0800

      linux-user/main.c: Use TARGET_SIG* instead of SIG*

      In main.c, all SIG* should be TARGET_SIG*, since the relevant functions
      (queue_signal() and gdb_handlesig()) expect TARGET_SIG*.

      The corresponding vi command is "1,$ s/\<SIG/TARGET_SIG/g".

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 71ec7cef01b0f855cb9f774300f80d1ddcb91fc9
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Fri Jan 23 18:07:50 2015 +0800

      linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base

      It is only a typo issue, need use tswapal(target_vec[i].iov_len) for the
      len.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7eff518b6c91bdd62710dd9868ec7a17bd6f1434
  Author: Chen Gang S <gang.chen@sunrus.com.cn>
  Date:   Fri Jan 23 18:01:09 2015 +0800

      linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block

      When failure occurs during locking of vec[i], we also need to unlock all
      already locked vec[i] in failure processing code block before return.

      Code in unlock_user() checks vec[i].iov_base for NULL, so there's no
      need not check it .

      If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just
      skip it, so can still use "while (--i >= 0)" loop condition.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 88ea8ed74cb6956f43199a098ca4963ae73bba57
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 20:17:06 2014 +0800

      virtfs-proxy-helper: Fix possible socket leak.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 46ede58bb461c1171251988e7fb1db6590350975
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 14:19:13 2015 +0100

      vl: Fix bogus error message for implied mon ID clashing

      monitor_parse() desugars --monitor, --qmp and -qmp-pretty to --mon.
      The ID it picks can clash with a user-specified ID.  When it happens,
      the error message is misleading.

      Reproducer:

          $ qemu --mon id=compat_monitor0 --monitor stdio

      Message before the patch:

          duplicate chardev: compat_monitor0

      There's no "duplicate chardev" here.  The problem is a duplicate
      monitor ID.  Moreover, the message provides no clue which option
      caused the problem.  The patch changes the message to:

          qemu: --monitor stdio: Duplicate ID 'compat_monitor0' for mon

      monitor_parse() is also used for creating a default monitor, but
      that's not done when the user specifies a monitor, so an ID clash is
      impossible then.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 15cae340094402bfe77565d7c6d09e2bb9d6601b
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:39 2015 -0500

      Convert some debugging printfs to trace calls in pcnet.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 32c952498b6ab740894fe83513bf43e872bf56a2
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:38 2015 -0500

      Add/convert trace calls in pcnet-pci.c.

      Add trace calls. Convert some #ifdef DEBUG printfs to trace.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 5edab03d40408564212887f7674591230784a1a8
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:37 2015 -0500

      Add trace to ps2.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 91043dadc47cfb939e34eb9e02ee595b16100808
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:21:36 2015 -0500

      Add tracing to xenfb.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 627b84f4060c6d39f347dd3d4f9d60612615091c
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Jan 19 11:45:12 2015 +0800

      fw_cfg: fix typos in comments: patch -> path

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b6f3b233eabb4df5d65ae9fbfb3d3c8befea0de7
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:59:23 2015 +0100

      target-mips: Clean up switch fall through after commit fecd264

      Commit fecd264 added a number of fall-throughs, but neglected to
      properly document them as intentional.  Commit d922445 cleaned that up
      for many, but not all cases.  Take care of the remaining ones.

      Spotted by Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 89db21771782fd6050335e73542064f1187c9ced
  Author: Leon Yu <chianglungyu@gmail.com>
  Date:   Mon Feb 2 05:08:51 2015 +0000

      qmp: unbreak build for non-vnc configuration

      Signed-off-by: Leon Yu <chianglungyu@gmail.com>
      Message-id: 1422853731-5282-1-git-send-email-chianglungyu@gmail.com
      Fixes: df887684603a ("monitor: add query-vnc-servers command")
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3d815ac82b0a3e816fd7a6d2561a73e780c3b685
  Merge: a2f2d28 728dacb
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 18:06:07 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Fri 06 Feb 2015 17:14:10 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (47 commits)
        block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices
        block: Eliminate silly QERR_ macros used for encryption keys
        block: New bdrv_add_key(), convert monitor to use it
        blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
        blockdev: Give find_block_job() an Error ** parameter
        qcow2: Rewrite qcow2_alloc_bytes()
        block: Give always priority to unused entries in the qcow2 L2 cache
        nbd: fix max_discard/max_transfer_length
        block: introduce BDRV_REQUEST_MAX_SECTORS
        nbd: Improve error messages
        iotests: Fix 104 for NBD
        iotests: Fix 100 for nbd
        iotests: Fix 083
        block: fix off-by-one error in qcow and qcow2
        qemu-iotests: add 116 invalid QED input file tests
        qed: check for header size overflow
        block/dmg: improve zeroes handling
        block/dmg: support bzip2 block entry types
        block/dmg: factor out block type check
        block/dmg: use SectorNumber from BLKX header
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 728dacbda817b2ca259e9d337fab06bcf14e94a6
  Author: Programmingkid <programmingkidx@gmail.com>
  Date:   Mon Jan 19 17:12:55 2015 -0500

      block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices

      This patch replaces the dummy code in raw_getlength() for block devices
      on OS X, which always returned LLONG_MAX, with a real implementation
      that returns the actual block device size.

      Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Tested-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8333c0dff14a8a16c8ad3a95c6ea09f9d6f395b3
  Merge: 8c44dfb b1ca639
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Feb 6 18:00:14 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        block: Eliminate silly QERR_ macros used for encryption keys
        block: New bdrv_add_key(), convert monitor to use it
        blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
        blockdev: Give find_block_job() an Error ** parameter

  commit b1ca639184d93984551b423d8e538ad4add5eb15
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:37:01 2015 +0100

      block: Eliminate silly QERR_ macros used for encryption keys

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      up QERR_DEVICE_ENCRYPTED and QERR_DEVICE_NOT_ENCRYPTED.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-5-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 4d2855a348c5e90f56584ab9777fc877965ca2e0
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:37:00 2015 +0100

      block: New bdrv_add_key(), convert monitor to use it

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-4-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 2e3a0266bd84a9be9f5e23c1568db6eb7f3e9e94
  Author: Markus Armbruster <armbru@pond.sub.org>
  Date:   Thu Jan 29 10:36:59 2015 +0100

      blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      this one up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-3-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 24d6bffe8ab523b1dcd8b8a2be678775f3e26b1c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 29 10:36:58 2015 +0100

      blockdev: Give find_block_job() an Error ** parameter

      When find_block_job() fails, all its callers build the same Error
      object.  Build it in find_block_job() instead.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1422524221-8566-2-git-send-email-armbru@redhat.com
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 8c44dfbc62a50a8bc4113f199b8662861f757591
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Feb 6 09:39:16 2015 -0500

      qcow2: Rewrite qcow2_alloc_bytes()

      qcow2_alloc_bytes() is a function with insufficient error handling and
      an unnecessary goto. This patch rewrites it.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8e8cb375e0964b4ed099cb8563029028db26a834
  Author: Alberto Garcia <berto@igalia.com>
  Date:   Thu Feb 5 14:55:31 2015 +0200

      block: Give always priority to unused entries in the qcow2 L2 cache

      The current algorithm to replace entries from the L2 cache gives
      priority to newer hits by dividing the hit count of all existing
      entries by two everytime there is a cache miss.

      However, if there are several cache misses the hit count of the
      existing entries can easily go down to 0. This will result in those
      entries being replaced even when there are others that have never been
      used.

      This problem is more noticeable with larger disk images and cache
      sizes, since the chances of having several misses before the cache is
      full are higher.

      If we make sure that the hit count can never go down to 0 again,
      unused entries will always have priority.

      Signed-off-by: Alberto Garcia <berto@igalia.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fa21e6faa6f1d7de49fd030ebdb0722b59cf9a41
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Feb 6 14:24:43 2015 +0300

      nbd: fix max_discard/max_transfer_length

      nbd_co_discard calls nbd_client_session_co_discard which uses uint32_t
      as the length in bytes of the data to discard due to the following
      definition:

      struct nbd_request {
          uint32_t magic;
          uint32_t type;
          uint64_t handle;
          uint64_t from;
          uint32_t len; <-- the length of data to be discarded, in bytes
      } QEMU_PACKED;

      Thus we should limit bl_max_discard to UINT32_MAX >> BDRV_SECTOR_BITS to
      avoid overflow.

      NBD read/write code uses the same structure for transfers. Fix
      max_transfer_length accordingly.

      Signed-off-by: Denis V. Lunev <den@openvz.org>
      CC: Peter Lieven <pl@kamp.de>
      CC: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 75af1f34cd5b07c3c7fcf86dfc99a42de48a600d
  Author: Peter Lieven <pl@kamp.de>
  Date:   Fri Feb 6 11:54:11 2015 +0100

      block: introduce BDRV_REQUEST_MAX_SECTORS

      we check and adjust request sizes at several places with
      sometimes inconsistent checks or default values:
       INT_MAX
       INT_MAX >> BDRV_SECTOR_BITS
       UINT_MAX >> BDRV_SECTOR_BITS
       SIZE_MAX >> BDRV_SECTOR_BITS

      This patches introdocues a macro for the maximal allowed sectors
      per request and uses it at several places.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1ce52846d3ce0e4b58caebcae84719bef6401fbb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:59 2015 -0500

      nbd: Improve error messages

      This patch makes use of the Error object for nbd_receive_negotiate() so
      that errors during negotiation look nicer.

      Furthermore, this patch adds an additional error message if the received
      magic was wrong, but would be correct for the other protocol version,
      respectively: So if an export name was specified, but the NBD server
      magic corresponds to an old handshake, this condition is explicitly
      signaled to the user, and vice versa.

      As these messages are now part of the "Could not open image" error
      message, additional filtering has to be employed in iotest 083, which
      this patch does as well.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a231cb272611c758d45135f6a35a4dd1beaf5585
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:58 2015 -0500

      iotests: Fix 104 for NBD

      _make_test_img sets up an NBD server, _cleanup_test_img shuts it down;
      thus, _cleanup_test_img has to be called before _make_test_img is
      invoked another time.

      Furthermore, the pipe through _filter_test_img was unnecessary;
      _make_test_img already takes care of that.

      And finally, a filter is added to _filter_img_info to replace
      "nbd://127.0.0.1:10810" by "TEST_DIR/t.IMGFMT", since the former is the
      way to express the full image path (normally the latter) for NBD tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 23ab6953f4675b8663888ce6cfe40f4191be3e48
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:57 2015 -0500

      iotests: Fix 100 for nbd

      In case of NBD, _make_test_img starts a new NBD server. Therefore,
      _cleanup_test_img (which shuts that server down) has to be invoked
      before the next _make_test_img call in order to make 100 work for NBD.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 53f9e77f4ed898a4ea4ad2bc118c06c336ba30dd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 26 21:02:56 2015 -0500

      iotests: Fix 083

      As of 8f9e835fd2e687d2bfe936819c3494af4343614d, probing should be
      disabled in the qemu-iotests (at least when using qemu-io). This broke
      083's reference output (which consisted mostly of "Could not read image
      for determining its format").

      This patch fixes it.

      Note that one case which failed before is now successful: Disconnect
      after data. This is due to qemu having read twice before (once for
      probing, once for the qemu-io read command), but only once now (the
      qemu-io read command). Therefore, reading is successful (which is
      correct).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e729fa6afed3aa917287b63034244f548b79ec60
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Jan 27 08:33:55 2015 -0500

      block: fix off-by-one error in qcow and qcow2

      This fixes an off-by-one error introduced in 9a29e18.  Both qcow and
      qcow2 need to make sure to leave room for string terminator '\0' for
      the backing file, so the max length of the non-terminated string is
      either 1023 or PATH_MAX - 1.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 319fc53e344d5cead970c74f088ae5c607d426b3
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jan 12 12:31:33 2015 +0000

      qemu-iotests: add 116 invalid QED input file tests

      These tests exercise error code paths in the QED image format.  The
      tests are very simple, they just prove that the error path exits
      cleanly.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1421065893-18875-3-git-send-email-stefanha@redhat.com
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0adfa1ed655904d5bf17fe047635a563f0229789
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Mon Jan 12 12:31:32 2015 +0000

      qed: check for header size overflow

      Header size is denoted in clusters.  The maximum cluster size is 64 MB
      but there is no limit on header size.  Check for uint32_t overflow in
      case the header size field has a whacky value.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1421065893-18875-2-git-send-email-stefanha@redhat.com
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 177b75104da3e3a9af84975c32a44782d903c41f
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:15 2015 +0100

      block/dmg: improve zeroes handling

      Disk images may contain large all-zeroes gaps (1.66k sectors or 812 MiB
      is seen in the real world). These blocks (type 2) do not need to be
      extracted into a temporary buffer, there is no need to allocate memory
      for these blocks nor to check its length.

      (For the test image, the maximum uncompressed size is 1054371 bytes,
      probably for a bzip2-compressed block.)

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-13-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6b383c08c46468ecee98ecf71ffd8362e9bd7f42
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:14 2015 +0100

      block/dmg: support bzip2 block entry types

      This patch adds support for bzip2-compressed block entries as introduced
      with OS X 10.4 (source: https://en.wikipedia.org/wiki/Apple_Disk_Image).

      It was tested against a 5.2G "OS X Yosemite" installation image which
      stores the BLXX block in the XML property list (instead of resource
      forks) and has over 5k chunks.

      New configure entries are added (--enable-bzip2 / --disable-bzip2) to
      control inclusion of bzip2 functionality (which requires linking against
      libbz2). The help message suggests that this option is needed for DMG
      files, but the tests are generic enough that other parts of QEMU can use
      bzip2 if needed.

      The identifiers are based on http://newosxbook.com/DMG.html.

      The decompression routines are based on the zlib case, but as there is
      no way to reset the decompression state (unlike zlib), memory is
      allocated and deallocated for every decompression. This should not be
      problematic as the decompression takes most of the time and as blocks
      are typically about/over 1 MiB in size, only one allocation is done
      every 2000 sectors.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1420566495-13284-12-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a8b10c6ead7f62e8eadbdaf944f371889c3c4c29
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:13 2015 +0100

      block/dmg: factor out block type check

      In preparation for adding bzip2 support, split the type check into a
      separate function. Make all offsets relative to the begin of a chunk
      such that it is easier to recognize the position without having to
      add up all offsets. Some comments are added to describe the fields.

      There is no functional change.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-11-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 66ec3bba972b6d4433698397d25d039c230949dc
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:12 2015 +0100

      block/dmg: use SectorNumber from BLKX header

      Previously the sector table parsing relied on the previous offset of
      the DMG file. Now it uses the sector number from the BLKX header
      (see http://newosxbook.com/DMG.html).

      The implementation of dmg2img (from vu1tur) does not base the output
      sector on the location of the terminator (0xffffffff) either so it
      should be safe to drop this dependency on the previous state.

      (It makes somehow makes sense, a terminator should halt further
      processing of a block and is perhaps used to preallocate some space.)

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-10-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6d34865fa02463cf34634f45369ebcc725b101b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:11 2015 +0100

      block/dmg: fix sector data offset calculation

      This patch addresses two issues:

       - The data fork offset was not taken into account, resulting in failure
         to read an InstallESD.dmg file (5164763151 bytes) which had a
         non-zero DataForkOffset field.
       - The offset of the previous block ("partition") was unconditionally
         added to the current block because older files would start the input
         offset of a new block at zero. Newer files (including vlc-2.1.5.dmg,
         tuxpaint-0.9.15-macosx.dmg and OS X Yosemite [MAS].dmg) failed in
         reads because these files have chunk offsets, relative to the begin
         of a data fork.

      Now the data offset of the mish is taken into account. While we could
      check that the data_offset is within the data fork, let's not do that
      here as it would only result in parse failures on invalid files (rather
      than gracefully handling such bad files). dmg_read will error out if
      the offset is incorrect.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-9-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8daf425794ed624083de98caab04b9fedb873420
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:10 2015 +0100

      block/dmg: set virtual size to a non-zero value

      Right now the virtual size is always reported as zero which makes it
      impossible to convert between formats.

      After this patch, the number of sectors will be read from the trailer
      ("koly" block).

      To verify the behavior, the output of `dmg2img foo.dmg foo.img` was
      compared against `qemu-img convert -f dmg -O raw foo.dmg foo.raw`. The
      tests showed that the file contents are exactly the same, except that
      QEMU creates a slightly larger file (it matches the total sectors
      count).

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-8-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0599e56ed468d245148530eb194be4a5056a0583
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:09 2015 +0100

      block/dmg: process XML plists

      The format is simple enough to avoid using a full-blown XML parser. It
      assumes that all BLKX items begin with the "mish" magic word, therefore
      it is not a problem if other values get matched which are not a BLKX
      block.

      The offsets are based on the description at
      http://newosxbook.com/DMG.html

      For compatibility with glib 2.12, use g_base64_decode (which
      additionally requires an extra buffer allocation) instead of
      g_base64_decode_inplace (which is only available since glib 2.20).

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-7-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f6e6652d7c9251236fc1ecc6cece36104c7af15b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:08 2015 +0100

      block/dmg: validate chunk size to avoid overflow

      Previously the chunk size was not checked, allowing for a large memory
      allocation. This patch checks whether the chunks size is within the
      resource fork length, and whether the resource fork is below the
      trailer of the dmg file.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-6-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7aee37b93a4f694cdd670807f30b8efd33d0c721
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:07 2015 +0100

      block/dmg: process a buffer instead of reading ints

      As the decoded plist XML is not a pointer in the file,
      dmg_read_mish_block must be able to process a buffer instead of a file
      pointer. Since the full buffer must be processed, let's change the
      return value again to just a success flag.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-5-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b0e8dc5d54225d2e7012bd306e62ac90ba6fc1ea
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:06 2015 +0100

      block/dmg: extract processing of resource forks

      Besides the offset, also read the resource length. This length is now
      used in the extracted function to verify the end of the resource fork
      against "count" from the resource fork.

      Instead of relying on the value of offset to conclude whether the
      resource fork is available or not (info_begin==0), check the
      rsrc_fork_length instead. This would allow a dmg file to begin with a
      resource fork. This seemingly unnecessary restriction was found while
      trying to craft a DMG file by hand.

      Other changes:

       - Do not require resource data offset to be 0x100 (but check that it
         is within bounds though).
       - Further improve boundary checking (resource data must be within
         the resource fork).
       - Use correct value for resource data length (spotted by John Snow)
       - Consider the resource data offset when determining info_end.
         This fixes an EINVAL on the tuxpaint dmg example.

      The resource fork format is documented at
      https://developer.apple.com/legacy/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf#page=151

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1420566495-13284-4-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 65a1c7c96a64cd69269c9ba854fa347dd0bbda0b
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:05 2015 +0100

      block/dmg: extract mish block decoding functionality

      Extract the mish block decoder such that this can be used for other
      formats in the future. A new DmgHeaderState struct is introduced to
      share state while decoding.

      The code is kept unchanged as much as possible, a "fail" label is added
      for example where a simple return would probably do. In dmg_open, the
      variable "tmp" is renamed to "rsrc_data_offset" for clarity and comments
      have been added explaining various data.

      Note that this patch has one subtle difference with the previous
      version which should not affect functionality. In the previous code,
      the end of a resource was inferred from the mish block (the offsets
      would be increased by the fields). In this patch, the resource length
      is used instead to avoid the need to rely on the previous offsets.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1420566495-13284-3-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fa8354bd226617e2afcc45c27a74959c15291cc0
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Jan 6 18:48:04 2015 +0100

      block/dmg: properly detect the UDIF trailer

      DMG files have a variable length with a UDIF trailer at the end of a
      file. This UDIF trailer is essential as it describes the contents of
      the image. At the moment however, the start of this trailer is almost
      always incorrect as bdrv_getlength() returns a multiple of the block
      size (rounded up). This results in a failure to recognize DMG files,
      resulting in Invalid argument (EINVAL) errors.

      As there is no API to retrieve the real file size, look for the magic
      header in the last two sectors to find the start of this 512-byte UDIF
      trailer (the "koly" block).

      The resource fork offset ("info_begin") has its offset adjusted as the
      initial value of offset does not mean "end of file" anymore, but "begin
      of UDIF trailer".

      [Replaced error_set(errp, ERROR_CLASS_GENERIC_ERROR, ...) with
      error_setg(errp, ...) as discussed with Peter.
      --Stefan]

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1420566495-13284-2-git-send-email-peter@lekensteyn.nl
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e2462113b2003085ad16f15e1442ded64e2d9a29
  Author: Francesco Romani <fromani@redhat.com>
  Date:   Mon Jan 12 14:11:13 2015 +0100

      block: add event when disk usage exceeds threshold

      Managing applications, like oVirt (http://www.ovirt.org), make extensive
      use of thin-provisioned disk images.
      To let the guest run smoothly and be not unnecessarily paused, oVirt sets
      a disk usage threshold (so called 'high water mark') based on the occupation
      of the device,  and automatically extends the image once the threshold
      is reached or exceeded.

      In order to detect the crossing of the threshold, oVirt has no choice but
      aggressively polling the QEMU monitor using the query-blockstats command.
      This lead to unnecessary system load, and is made even worse under scale:
      deployments with hundreds of VMs are no longer rare.

      To fix this, this patch adds:
      * A new monitor command `block-set-write-threshold', to set a mark for
        a given block device.
      * A new event `BLOCK_WRITE_THRESHOLD', to report if a block device
        usage exceeds the threshold.
      * A new `write_threshold' field into the `BlockDeviceInfo' structure,
        to report the configured threshold.

      This will allow the managing application to use smarter and more
      efficient monitoring, greatly reducing the need of polling.

      [Updated qemu-iotests 067 output to add the new 'write_threshold'
      property. --Stefan]
      [Changed g_assert_false() to !g_assert() to fix the build on older glib
      versions. --Kevin]

      Signed-off-by: Francesco Romani <fromani@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1421068273-692-1-git-send-email-fromani@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6440d44cea84451ee9facb1237a4e7251631df80
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Jan 23 14:28:34 2015 -0500

      iotests: Specify format for qemu-nbd

      This patch is necessary to suppress the "probed raw" warning when
      running raw over nbd tests.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 79e7a01954d5b171186ef1e946e9159417befc1e
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Jan 16 09:38:42 2015 +0800

      qemu-iotests: Fix supported_oses check

      There is a bug in the recently added sys.platform test, and we no longer
      run python tests, because "linux2" is the value to compare here. So do a
      prefix match. According to python doc [1], the way to use sys.platform
      is "unless you want to test for a specific system version, it is
      therefore recommended to use the following idiom":

      if sys.platform.startswith('freebsd'):
          # FreeBSD-specific code here...
      elif sys.platform.startswith('linux'):
          # Linux-specific code here...

      [1]: https://docs.python.org/2.7/library/sys.html#sys.platform

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c99495ac1b4a27cb57bf04ed1a169177aeea2649
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:22 2015 +0100

      virtio-blk: add a knob to disable request merging

      this adds a knob to disable request merging for debugging or benchmarks if dedired.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 95f7142abc86a916682bd735aecd90172ffa0d30
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:21 2015 +0100

      virtio-blk: introduce multiread

      this patch finally introduces multiread support to virtio-blk. While
      multiwrite support was there for a long time, read support was missing.

      The complete merge logic is moved into virtio-blk.c which has
      been the only user of request merging ever since. This is required
      to be able to merge chunks of requests and immediately invoke callbacks
      for those requests. Secondly, this is required to switch to
      direct invocation of coroutines which is planned at a later stage.

      The following benchmarks show the performance of running fio with
      4 worker threads on a local ram disk. The numbers show the average
      of 10 test runs after 1 run as warmup phase.

                    |        4k        |       64k        |        4k
      MB/s          | rd seq | rd rand | rd seq | rd rand | wr seq | wr rand
      --------------+--------+---------+--------+---------+--------+--------
      master        | 1221   | 1187    | 4178   | 4114    | 1745   | 1213
      multiread     | 1829   | 1189    | 4639   | 4110    | 1894   | 1216

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 454057b7d9b9ad141bd5df8c4075745e56b4870f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:20 2015 +0100

      block-backend: expose bs->bl.max_transfer_length

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d901f3c457ade0b4934427c0e8608dea31610720
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:19 2015 +0100

      hw/virtio-blk: add a constant for max number of merged requests

      As it was not obvious (at least for me) where the 32 comes from;
      add a constant for it.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f4564d53c6952c61fb3ed8ee17a6e0f2f6bf0857
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 14:52:18 2015 +0100

      block: add accounting for merged requests

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 35f5a49374098733247c640cbdcbafcfc792c11f
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Jan 28 09:51:13 2015 +0800

      qed: Really remove unused field QEDAIOCB.finished

      The commit 533ffb17a that removed qed_aiocb_info.cancel said to remove
      this but didn't do it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 61979a6adfc1c4590f31ca295998e160226785c4
  Author: Don Slutz <dslutz@verizon.com>
  Date:   Fri Jan 9 10:17:35 2015 -0500

      qemu-img: Add QEMU_PKGVERSION to QEMU_IMG_VERSION

      This is the same way vl.c handles this.

      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 98764152ad8ec9fa4e7bb6d8e10f8a7a7ce273d7
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Feb 2 15:48:34 2015 +0100

      block: change default for discard and write zeroes to INT_MAX

      do not trim requests if the driver does not supply a limit
      through BlockLimits. For write zeroes we still keep a limit
      for the unsupported path to avoid allocating a big bounce buffer.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Suggested-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1cdc3239f1bb8c8f18954defe3cb813edc9df4a0
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:16 2015 +0300

      block: use fallocate(FALLOC_FL_PUNCH_HOLE) & fallocate(0) to write zeroes

      This sequence works efficiently if FALLOC_FL_ZERO_RANGE is not supported.
      Unfortunately, FALLOC_FL_ZERO_RANGE is supported on really modern systems
      and only for a couple of filesystems. FALLOC_FL_PUNCH_HOLE is much more
      mature.

      The sequence of 2 operations FALLOC_FL_PUNCH_HOLE and 0 is necessary due
      to the following reasons:
      - FALLOC_FL_PUNCH_HOLE creates a hole in the file, the file becomes
        sparse. In order to retain original functionality we must allocate
        disk space afterwards. This is done using fallocate(0) call
      - fallocate(0) without preceeding FALLOC_FL_PUNCH_HOLE will do nothing
        if called above already allocated areas of the file, i.e. the content
        will not be zeroed

      This should increase the performance a bit for not-so-modern kernels.

      CC: Max Reitz <mreitz@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d50d82221934696633296975aa433fe8aeeac714
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:15 2015 +0300

      block/raw-posix: call plain fallocate in handle_aiocb_write_zeroes

      There is a possibility that we are extending our image and thus writing
      zeroes beyond the end of the file. In this case we do not need to care
      about the hole to make sure that there is no data in the file under
      this offset (pre-condition to fallocate(0) to work). We could simply call
      fallocate(0).

      This improves the performance of writing zeroes even on really old
      platforms which do not have even FALLOC_FL_PUNCH_HOLE.

      Before the patch do_fallocate was used when either
      CONFIG_FALLOCATE_PUNCH_HOLE or CONFIG_FALLOCATE_ZERO_RANGE are defined.
      Now the story is different. CONFIG_FALLOCATE is defined when Linux
      fallocate is defined, posix_fallocate is completely different story
      (CONFIG_POSIX_FALLOCATE). CONFIG_FALLOCATE is mandatory prerequite
      for both CONFIG_FALLOCATE_PUNCH_HOLE and CONFIG_FALLOCATE_ZERO_RANGE
      thus we are on the safe side.

      CC: Max Reitz <mreitz@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b953f075007a7860adce9fa410b2e116a3d5e29c
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:14 2015 +0300

      block: use fallocate(FALLOC_FL_ZERO_RANGE) in handle_aiocb_write_zeroes

      This efficiently writes zeroes on Linux if the kernel is capable enough.
      FALLOC_FL_ZERO_RANGE correctly handles all cases, including and not
      including file expansion.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 37cc9f7f684ed035da63274daca1594c7ee16213
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:13 2015 +0300

      block/raw-posix: refactor handle_aiocb_write_zeroes a bit

      move code dealing with a block device to a separate function. This will
      allow to implement additional processing for ordinary files.

      Please note, that xfs_code has been moved before checking for
      s->has_write_zeroes as xfs_write_zeroes does not touch this flag inside.
      This makes code a bit more consistent.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b99171230bcdfe49956f283fc2e51a37efc7bfc
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:12 2015 +0300

      block/raw-posix: create do_fallocate helper

      The pattern
          do {
              if (fallocate(s->fd, mode, offset, len) == 0) {
                  return 0;
              }
          } while (errno == EINTR);
          ret = translate_err(-errno);
      will be commonly useful in next patches. Create helper for it.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1486df0e312613c6f235ee08488c90cc6b987094
  Author: Denis V. Lunev <den@openvz.org>
  Date:   Fri Jan 30 11:42:11 2015 +0300

      block/raw-posix: create translate_err helper to merge errno values

      actually the code
          if (ret == -ENODEV || ret == -ENOSYS || ret == -EOPNOTSUPP ||
              ret == -ENOTTY) {
              ret = -ENOTSUP;
          }
      is present twice and will be added a couple more times. Create helper
      for this.

      CC: Kevin Wolf <kwolf@redhat.com>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Peter Lieven <pl@kamp.de>
      CC: Fam Zheng <famz@redhat.com>
      Signed-off-by: Denis V. Lunev <den@openvz.org>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a71754e5b03fd3b8b8c6d3bc2a39f75bead729de
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Dec 9 18:15:09 2014 +0000

      atapi migration: Throw recoverable error to avoid recovery

      (With the previous atapi_dma flag recovery)
      If migration happens between the ATAPI command being written and the
      bmdma being started, the DMA is dropped.  Eventually the guest times
      out and recovers, but that can take many seconds.
      (This is rare, on a pingpong reading the CD continuously I hit
      this about ~1/30-1/50 migrates)

      I don't think we've got enough state to be able to recover safely
      at this point, so I throw a 'medium error, no seek complete'
      that I'm assuming guests will try and recover from an apparently
      dirty CD.

      OK, it's a hack, the real solution is probably to push a lot of
      ATAPI state into the migration stream, but this is a fix that
      works with no stream changes. Tested only on Linux (both RHEL5
      (pre-libata) and RHEL7).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 819fa276311ce328a8e38ad9306c1093961b3f4b
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Dec 9 18:15:08 2014 +0000

      Restore atapi_dma flag across migration

      If a migration happens just after the guest has kicked
      off an ATAPI command and kicked off DMA, we lose the atapi_dma
      flag, and the destination tries to complete the command as PIO
      rather than DMA.  This upsets Linux; modern libata based kernels
      stumble and recover OK, older kernels end up passing bad data
      to userspace.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a2f2d288b5a06e6c680c387c9980d91363f59c61
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 18:57:35 2015 +0000

      softfloat: expand out STATUS macro

      Expand out and remove the STATUS macro.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ff32e16e865c78fb54187723f3fd09650cd9b962
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 18:47:16 2015 +0000

      softfloat: expand out STATUS_VAR

      Expand out and remove the STATUS_VAR macro.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e5a41ffa870ad096eb2f084447fea5dd00a51b31
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 30 12:04:16 2015 +0000

      softfloat: Expand out the STATUS_PARAM macro

      Expand out STATUS_PARAM wherever it is used and delete the definition.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit cebbae86b4f7ee3d3dd9df906b97d269e70d9cc7
  Merge: b93acb9 2c4681f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 14:35:52 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri 06 Feb 2015 14:10:40 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        monitor: more accurate completion for host_net_remove()
        net: del hub port when peer is deleted
        net: remove the wrong comment in net_init_hubport()
        monitor: print hub port name during info network
        rtl8139: simplify timer logic
        MAINTAINERS: add Jason Wang as net subsystem maintainer

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2c4681f512822b4aa35371683e164d4818f21dce
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:38 2015 +0800

      monitor: more accurate completion for host_net_remove()

      Current completion for host_net_remove will show hub ports and clients
      that were not peered with hub ports. Fix this.

      Cc: Luiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-4-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 64a55d60665245174acf6445e0e3f1ec7a53cfe0
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:37 2015 +0800

      net: del hub port when peer is deleted

      We should del hub port when peer is deleted since it will not be reused
      and will only be freed during exit.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-3-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 07636d53999092daa9e3d281ea137be0795d7078
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:36 2015 +0800

      net: remove the wrong comment in net_init_hubport()

      Not only nic could be the one to peer.

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-2-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a6efd6ae7b8696bfeb0336826b01bfe0e1840154
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Feb 2 15:06:35 2015 +0800

      monitor: print hub port name during info network

      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 1422860798-17495-1-git-send-email-jasowang@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 237c255c6cefefda9c5dd077860cfa20a77d9a6a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 15:44:59 2015 +0100

      rtl8139: simplify timer logic

      Pavel Dovgalyuk reports that TimerExpire and the timer are not restored
      correctly on the receiving end of migration.

      It is not clear to me whether this is really the case, but we can take
      the occasion to get rid of the complicated code that computes PCSTimeout
      on the fly upon changes to IntrStatus/IntrMask.  Just always keep a
      timer running, it will fire every ~130 seconds at most if the interrupt
      is masked with TimerInt != 0.

      This makes rtl8139_set_next_tctr_time idempotent (when the virtual clock
      is stopped between two calls, as is the case during migration).

      Tested with Frediano's qtest.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421765099-26190-1-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b93acb92cad1f38737e481fc85cb5c41a559d855
  Merge: b3cd91e dd9fe29
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Feb 6 13:46:12 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

      # gpg: Signature made Fri 06 Feb 2015 13:45:06 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/tracing-pull-request:
        trace: Print PID and time in stderr traces

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit dd9fe29c80b8a35f12d98928a97be3aded80cf69
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Tue Jan 20 09:41:15 2015 +0000

      trace: Print PID and time in stderr traces

      When debugging migration it's useful to know the PID of
      each trace message so you can figure out if it came from the source
      or the destination.

      Printing the time makes it easy to do latency measurements or timings
      between trace points.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Message-id: 1421746875-9962-1-git-send-email-dgilbert@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b3cd91e0eaf5c962cf139ce6ca59392c8b00f177
  Merge: 651621b bb42631
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 17:11:50 2015 +0000

      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150205' into staging

      migration/next for 20150205

      # gpg: Signature made Thu 05 Feb 2015 16:17:08 GMT using RSA key ID 5872D723
      # gpg: Can't check signature: public key not found

      * remotes/juanquintela/tags/migration/20150205:
        fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail
        Tracify migration/rdma.c
        Add migration stream analyzation script
        migration: Append JSON description of migration stream
        qemu-file: Add fast ftell code path
        QJSON: Add JSON writer
        Print errors in some of the early migration failure cases.
        Migration: Add lots of trace events
        savevm: Convert fprintf to error_report
        vmstate-static-checker: update whitelist

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 651621b780515f35711c5d7305310ab1d241c7e2
  Merge: cd07b19 8c413e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 16:40:00 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-cov-model-2015-02-05' into staging

      coverity: Improve and extend model

      # gpg: Signature made Thu 05 Feb 2015 16:20:49 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-cov-model-2015-02-05:
        MAINTAINERS: Add myself as Coverity model maintainer
        coverity: Model g_free() isn't necessarily free()
        coverity: Model GLib string allocation partially
        coverity: Improve model for GLib memory allocation

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bb426311901776b95b021cece831b69dce4ef5ee
  Author: Zhang Haoyu <zhanghy@sangfor.com.cn>
  Date:   Thu Feb 5 19:33:11 2015 +0800

      fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail

      fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail
      during incoming migration or loadvm.

      Signed-off-by: Zhang Haoyu <zhanghy@sangfor.com.cn>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8c413e7902ef0c19ced516f575db989ccc3785f8
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Jan 28 11:29:57 2015 +0100

      MAINTAINERS: Add myself as Coverity model maintainer

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 733252deb8b7d37beacda5976c2769e18642b2fa
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Mon Feb 2 19:53:33 2015 +0000

      Tracify migration/rdma.c

      Turn all the D/DD/DDDPRINTFs into trace events
      Turn most of the fprintf(stderr, into error_report

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit b17425701d66e4fd380fc492a1da9fc4152ba909
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:40 2015 +0100

      Add migration stream analyzation script

      This patch adds a python tool to the scripts directory that can read
      a dumped migration stream if it contains the JSON description of the
      device states. I constructs a human readable JSON stream out of it.

      It's very simple to use:

        $ qemu-system-x86_64
          (qemu) migrate "exec:cat > mig"
        $ ./scripts/analyze_migration.py -f mig

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 8118f0950fc77cce7873002a5021172dd6e040b5
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:39 2015 +0100

      migration: Append JSON description of migration stream

      One of the annoyances of the current migration format is the fact that
      it's not self-describing. In fact, it's not properly describing at all.
      Some code randomly scattered throughout QEMU elaborates roughly how to
      read and write a stream of bytes.

      We discussed an idea during KVM Forum 2013 to add a JSON description of
      the migration protocol itself to the migration stream. This patch
      adds a section after the VM_END migration end marker that contains
      description data on what the device sections of the stream are composed of.

      This approach is backwards compatible with any QEMU version reading the
      stream, because QEMU just stops reading after the VM_END marker and ignores
      any data following it.

      With an additional external program this allows us to decipher the
      contents of any migration stream and hopefully make migration bugs easier
      to track down.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 972214001120e4cf2f4ac35b6ccbd1777b11e060
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:38 2015 +0100

      qemu-file: Add fast ftell code path

      For ftell we flush the output buffer to ensure that we don't have anything
      lingering in our internal buffers. This is a very safe thing to do.

      However, with the dynamic size measurement that the dynamic vmstate
      description will bring this would turn out quite slow.

      Instead, we can fast path this specific measurement and just take the
      internal buffers into account when telling the kernel our position.

      I'm sure I overlooked some corner cases where this doesn't work, so
      instead of tuning the safe, existing version, this patch adds a fast
      variant of ftell that gets used by the dynamic vmstate description code
      which isn't critical when it fails.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 190c882ce219ed89ac7d0633cfd11ad75fb0b46e
  Author: Alexander Graf <agraf@suse.de>
  Date:   Thu Jan 22 15:01:37 2015 +0100

      QJSON: Add JSON writer

      To support programmatic JSON assembly while keeping the code that generates it
      readable, this patch introduces a simple JSON writer. It emits JSON serially
      into a buffer in memory.

      The nice thing about this writer is its simplicity and low memory overhead.
      Unlike the QMP JSON writer, this one does not need to spawn QObjects for every
      element it wants to represent.

      This is a prerequisite for the migration stream format description generator.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 0457d07342b175e3d2f0835bef1a67cf75dbc9d6
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:49 2015 +0000

      Print errors in some of the early migration failure cases.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit a5df2a0222f424d86d0fd0b50e909af892da7eea
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:48 2015 +0000

      Migration: Add lots of trace events

      Mostly on the load side, so that when we get a complaint about
      a migration failure we can figure out what it didn't like.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 6a64b644ac593aca3762644b9585033d7cac0a29
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Wed Jan 21 10:14:47 2015 +0000

      savevm: Convert fprintf to error_report

      Convert a bunch of fprintfs to error_reports

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 027f15696d145803fbafbfcce691444fbf0488fc
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Wed Jan 21 18:35:33 2015 +0530

      vmstate-static-checker: update whitelist

      Commit 22382bb96c8bd88370c1ff0cb28c3ee6bee79ed3 renamed the
      'hw_cursor_x' and 'hw_cursor_y' fields in cirrus_vga.  Update the static
      checker's whitelist to allow matching against the old and new names.

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Juan Quintela <quintela@redhat.com>

  commit 7ad4c7200111d20eb97eed4f46b6026e3f0b0eef
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 26 21:37:15 2015 +0100

      coverity: Model g_free() isn't necessarily free()

      Memory allocated with GLib needs to be freed with GLib.  Freeing it
      with free() instead of g_free() is a common error.  Harmless when
      g_free() is a trivial wrapper around free(), which is commonly the
      case.  But model the difference anyway.

      In a local scan, this flags four ALLOC_FREE_MISMATCH.  Requires
      --enable ALLOC_FREE_MISMATCH, because the checker is still preview.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e4b77daa5724a9dd41aaa44d2dea4b8e92351081
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Mon Jan 26 15:05:11 2015 +0100

      coverity: Model GLib string allocation partially

      Without a model, Coverity can't know that the result of g_strdup()
      needs to be fed to g_free().

      One way to get such a model is to scan GLib, build a derived model
      file with cov-collect-models, and use that when scanning QEMU.
      Unfortunately, the Coverity Scan service we use doesn't support that.

      Thus, we're stuck with the other way: write a user model.  Doing that
      for all of GLib is hardly practical.  I'm doing it for the "String
      Utility Functions" we actually use that return dynamically allocated
      strings.

      In a local scan, this flags 20 additional RESOURCE_LEAKs.  The ones I
      checked look genuine.

      It also loses a NULL_RETURNS about ppce500_init() using
      qemu_find_file() without error checking.  I don't understand why.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9d7a4c6690ef9962a3b20034f65008f1ea15c1d6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Jan 22 11:21:37 2015 +0100

      coverity: Improve model for GLib memory allocation

      In current versions of GLib, g_new() may expand into g_malloc_n().
      When it does, Coverity can't see the memory allocation, because we
      don't model g_malloc_n().  Similarly for g_new0(), g_renew(),
      g_try_new(), g_try_new0(), g_try_renew().

      Model g_malloc_n(), g_malloc0_n(), g_realloc_n().  Model
      g_try_malloc_n(), g_try_malloc0_n(), g_try_realloc_n() by adding
      indeterminate out of memory conditions on top.

      To avoid undue duplication, replace the existing models for g_malloc()
      & friends by trivial wrappers around g_malloc_n() & friends.

      In a local scan, this flags four additional RESOURCE_LEAKs and one
      NULL_RETURNS.

      The NULL_RETURNS is a false positive: Coverity can now see that
      g_try_malloc(l1_sz * sizeof(uint64_t)) in
      qcow2_check_metadata_overlap() may return NULL, but is too stupid to
      recognize that a loop executing l1_sz times won't be entered then.

      Three out of the four RESOURCE_LEAKs appear genuine.  The false
      positive is in ppce500_prep_device_tree(): the pointer dies, but a
      pointer to a struct member escapes, and we get the pointer back for
      freeing with container_of().  Too funky for Coverity.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd07b19307bd185dccfd39052ac66d2730b32857
  Merge: 2c918a2 fc1792e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 14:22:51 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150205' into staging

      target-arm queue:
       * refactor/clean up armv7m_init()
       * some initial cleanup in the direction of supporting 64-bit EL3
       * fix broken synchronization of registers between QEMU and KVM
         for 32-bit ARM hosts (which among other things broke memory
         access via gdbstub)
       * fix flush-to-zero handling in FMULX, FRECPS, FRSQRTS and FRECPE
       * don't crash QEMU for UNPREDICTABLE BFI insns in A32 encoding
       * explain why virt board's device-to-transport mapping code is
         the way it is
       * implement mmu_idx values which match the architectural
         distinctions, and introduce the concept of a translation
         regime to get_phys_addr() rather than incorrectly looking
         at the current CPU state
       * update to upstream VIXL 1.7 (gives us correct code addresses
         when dissassembling pc-relative references)
       * sync system register state between KVM and QEMU for 64-bit ARM
       * support virtio on big-endian guests by implementing the
         "which endian is the guest now?" CPU method

      # gpg: Signature made Thu 05 Feb 2015 14:02:16 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150205: (28 commits)
        target-arm: fix for exponent comparison in recpe_f64
        target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64
        target-arm: KVM64: Get and Sync up guest register state like kvm32.
        disas/arm-a64.cc: Tell libvixl correct code addresses
        disas/libvixl: Update to upstream VIXL 1.7
        target-arm: Fix brace style in reindented code
        target-arm: Reindent ancient page-table-walk code
        target-arm: Use mmu_idx in get_phys_addr()
        target-arm: Pass mmu_idx to get_phys_addr()
        target-arm: Split AArch64 cases out of ats_write()
        target-arm: Don't define any MMU_MODE*_SUFFIXes
        target-arm: Use correct mmu_idx for unprivileged loads and stores
        target-arm: Define correct mmu_idx values and pass them in TB flags
        target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT
        target-arm: Make arm_current_el() return sensible values for M profile
        cpu_ldst.h: Allow NB_MMU_MODES to be 7
        hw/arm/virt: explain device-to-transport mapping in create_virtio_devices()
        target-arm: check that LSB <= MSB in BFI instruction
        target-arm: Squash input denormals in FRECPS and FRSQRTS
        Fix FMULX not squashing denormalized inputs when FZ is set.
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc1792e9aa36227ee9994757974f9397684e1a48
  Author: Ildar Isaev <ild@inbox.ru>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: fix for exponent comparison in recpe_f64

      f64 exponent in HELPER(recpe_f64) should be compared to 2045 rather than 1023
      (FPRecipEstimate in ARMV8 spec). This fixes incorrect underflow handling when
      flushing denormals to zero in the FRECPE instructions operating on 64-bit
      values.

      Signed-off-by: Ildar Isaev <ild@inbox.ru>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 84f2bed3cf505f90b7918e2de32e11da27160563
  Author: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64

      This patch implements a fucntion pointer "virtio_is_big_endian"
      from "CPUClass" structure for arm/arm64.
      Function arm_cpu_is_big_endian() is added to determine and
      return the guest cpu endianness to virtio.
      This is required for running cross endian guests with virtio on ARM/ARM64.

      Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
      Message-id: 1423130382-18640-3-git-send-email-pranavkumar@linaro.org
      [PMM: check CPSR_E in env->cpsr_uncached, not env->pstate.]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 568bab1fb8cb2237f0134c4c5ffbc2a8ea26df69
  Author: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      target-arm: KVM64: Get and Sync up guest register state like kvm32.

      This patch adds:
      1. Call write_kvmstate_to_list() and write_list_to_cpustate()
         in kvm_arch_get_registers() to sync guest register state.
      2. Call write_list_to_kvmstate() in kvm_arch_put_registers()
         to sync guest register state.

      These changes are already there for kvm32 in target-arm/kvm32.c.

      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
      Message-id: 1423130382-18640-2-git-send-email-pranavkumar@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8d298bee09f0cb8997c87006c0ff3a49a419837b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      disas/arm-a64.cc: Tell libvixl correct code addresses

      disassembling relative branches in code which doesn't reside at
      what the guest CPU would think its execution address is. Use
      the new MapCodeAddress() API to tell libvixl where the code is
      from the guest CPU's point of view so it can get the target
      addresses right.

      Previous disassembly:

      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x7f6cb7020434)
      0x0000000040000004:  aa1f03e1      mov x1, xzr
      0x0000000040000008:  aa1f03e2      mov x2, xzr
      0x000000004000000c:  aa1f03e3      mov x3, xzr
      0x0000000040000010:  58000084      ldr x4, pc+16 (addr 0x7f6cb702042c)
      0x0000000040000014:  d61f0080      br x4

      Fixed disassembly:
      0x0000000040000000:  580000c0      ldr x0, pc+24 (addr 0x40000018)
      0x0000000040000004:  aa1f03e1      mov x1, xzr
      0x0000000040000008:  aa1f03e2      mov x2, xzr
      0x000000004000000c:  aa1f03e3      mov x3, xzr
      0x0000000040000010:  58000084      ldr x4, pc+16 (addr 0x40000020)
      0x0000000040000014:  d61f0080      br x4

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422274779-13359-3-git-send-email-peter.maydell@linaro.org

  commit d4eba98df4cca016c3cc88f519164b5c0e434e69
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:25 2015 +0000

      disas/libvixl: Update to upstream VIXL 1.7

      Update our copy of libvixl to upstream's 1.7 release.
      This includes upstream's fix for the issue we had a local
      patch for in commit 94cc44a9e.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422274779-13359-2-git-send-email-peter.maydell@linaro.org

  commit 87c3d486150917c8e286d29166c98a2035377b52
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Fix brace style in reindented code

      This patch fixes the brace style in the code reindented in the
      previous commit.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 554b0b09aec4579c8164f363b18a263150e91a2c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Reindent ancient page-table-walk code

      A few of the oldest parts of the page-table-walk code have broken indent
      (either hardcoded tabs or two-spaces). Reindent these sections.

      For ease of review, this patch does not touch the brace style and
      so is a whitespace-only change.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 0480f69abf849ca0d48928cc6c669c1c7264239b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Use mmu_idx in get_phys_addr()

      Now we have the mmu_idx in get_phys_addr(), use it correctly to
      determine the behaviour of virtual to physical address translations,
      rather than using just an is_user flag and the current CPU state.

      Some TODO comments have been added to indicate where changes will
      need to be made to add EL2 and 64-bit EL3 support.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit d364970287c0ba68979711928c15e5d37414f87f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Pass mmu_idx to get_phys_addr()

      Make all the callers of get_phys_addr() pass it the correct
      mmu_idx rather than just a simple "is_user" flag. This includes
      properly decoding the AT/ATS system instructions; we include the
      logic for handling all the opc1/opc2 cases because we'll need
      them later for supporting EL2/EL3, even if we don't have the
      regdef stanzas yet.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 060e8a48cb84d41d4ac36e4bb29d9c14ed7168b6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Split AArch64 cases out of ats_write()

      Instead of simply reusing ats_write() as the handler for both AArch32
      and AArch64 address translation operations, use a different function
      for each with the common code in a third function. This is necessary
      because the semantics for selecting the right translation regime are
      different; we are only getting away with sharing currently because
      we don't support EL2 and only support EL3 in AArch32.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 0dfef7b58f0c24b463e36630f08a45e93012b33a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:24 2015 +0000

      target-arm: Don't define any MMU_MODE*_SUFFIXes

      target-arm doesn't use any of the MMU-mode specific cpu ldst
      accessor functions. Suppress their generation by not defining
      any of the MMU_MODE*_SUFFIX macros. ("user" and "kernel" are
      too simplistic as descriptions of indexes 0 and 1 anyway.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

  commit 579d21cce63f3dd2f6ee49c0b02a14e92cb4a836
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Use correct mmu_idx for unprivileged loads and stores

      The MMU index to use for unprivileged loads and stores is more
      complicated than we currently implement:
       * for A64, it should be "if at EL1, access as if EL0; otherwise
         access at current EL"
       * for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise
         access as if at EL0".

      In both cases, if we want to make the access for Secure EL0
      this is not the same mmu_idx as for Non-Secure EL0.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit c1e3781090b9d36c60e1a254ba297cb34011d3d4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Define correct mmu_idx values and pass them in TB flags

      We currently claim that for ARM the mmu_idx should simply be the current
      exception level. However this isn't actually correct -- secure EL0 and EL1
      should have separate indexes from non-secure EL0 and EL1 since their
      VA->PA mappings may differ. We also will want an index for stage 2
      translations when we properly support EL2.

      Define and document all seven mmu index values that we require, and
      pass the mmu index in the TB flags rather than exception level or
      priv/user bit.

      This change doesn't update the get_phys_addr() code, so our page
      table walking still assumes a simplistic "user or priv?" model for
      the moment.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      ---
      This leaves some odd gaps in the TB flags usage. I will circle
      back and clean this up later (including moving the other common
      flags like the singlestep ones to the top of the flags word),
      but I didn't want to bloat this patchseries further.

  commit 949013ce111eb64f8bc81cf9a9f1cefd6a1678c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT

      The LDT/STT (load/store unprivileged) instruction decode was using
      the wrong MMU index value. This meant that instead of these insns
      being "always access as if user-mode regardless of current privilege"
      they were "always access as if kernel-mode regardless of current
      privilege". This went unnoticed because AArch64 Linux doesn't use
      these instructions.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
      ---
      I'm not counting this as a security issue because I'm assuming
      nobody treats TCG guests as a security boundary (certainly I
      would not recommend doing so...)

  commit 6d54ed3c93f1e05a483201b087142998381c9be8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      target-arm: Make arm_current_el() return sensible values for M profile

      Although M profile doesn't have the same concept of exception level
      as A profile, it does have a notion of privileged versus not, which
      we currently track in the privmode TB flag. Support returning this
      information if arm_current_el() is called on an M profile core, so
      that we can identify the correct MMU index to use (and put the MMU
      index in the TB flags) without having to special-case M profile.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit 8f3ae2ae2d02727f6d56610c09d7535e43650dd4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      cpu_ldst.h: Allow NB_MMU_MODES to be 7

      Support guest CPUs which need 7 MMU index values.
      Add a comment about what would be required to raise the limit
      further (trivial for 8, TCG backend rework for 9 or more).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 587078f0ed6371f83a54228faed70867d3137954
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Thu Feb 5 13:37:23 2015 +0000

      hw/arm/virt: explain device-to-transport mapping in create_virtio_devices()

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1422592273-4432-1-git-send-email-lersek@redhat.com
      [PMM: added note recommending UUIDs]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 45140a57675ecb4b0daee71bf145c24dbdf9429c
  Author: Kirill Batuzov <batuzovk@ispras.ru>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: check that LSB <= MSB in BFI instruction

      The documentation states that if LSB > MSB in BFI instruction behaviour
      is unpredictable. Currently QEMU crashes because of assertion failure in
      this case:

      tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

      While assertion failure may meet the "unpredictable" definition this
      behaviour is undesirable because it allows an unprivileged guest program
      to crash the emulator with the OS and other programs.

      This patch addresses the issue by throwing illegal instruction exception
      if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
      has this check in place.

      To reproduce issue run the following program

      int main(void) {
          asm volatile (".long 0x07c00c12" :: );
          return 0;
      }

      compiled with
        gcc -marm -static badop_arm.c -o badop_arm

      Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a8eb6e19991d1a7a6a7b04ac447548d30d75eb4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Squash input denormals in FRECPS and FRSQRTS

      The helper functions for FRECPS and FRSQRTS have special case
      handling that includes checks for zero inputs, so squash input
      denormals if necessary before those checks. This fixes incorrect
      output when the FPCR DZ bit is set to enable squashing of input
      denormals.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

  commit dabf005808f0830313f313c76a492294ef3bce6a
  Author: Xiangyu Hu <libhu.so@gmail.com>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      Fix FMULX not squashing denormalized inputs when FZ is set.

      While FMULX returns a 2.0f float when two operators are infinity and
      zero, those operators should be unpacked from raw inputs first. Inconsistent
      cases would occur when operators are denormalized floats in flush-to-zero
      mode. A wrong codepath will be entered and 2.0f will not be returned
      without this patch.
      Fix by checking whether inputs need to be flushed before running into
      different codepaths.

      Signed-off-by: Xiangyu Hu <libhu.so@gmail.com>
      Message-id: 1422459650-12490-1-git-send-email-libhu.so@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 375421ccaeebae8212eb8f9a36835ad4d9dc60a8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add checks that cpreg raw accesses are handled

      Add assertion checking when cpreg structures are registered that they
      either forbid raw-access attempts or at least make an attempt at
      handling them. Also add an assert in the raw-accessor-of-last-resort,
      to avoid silently doing a read or write from offset zero, which is
      actually AArch32 CPU register r0.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422282372-13735-3-git-send-email-peter.maydell@linaro.org
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>

  commit 7a0e58fa648736a75f2a6943afd2ab08ea15b8e0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Split NO_MIGRATE into ALIAS and NO_RAW

      We currently mark ARM coprocessor/system register definitions with
      the flag ARM_CP_NO_MIGRATE for two different reasons:
      1) register is an alias on to state that's also visible via
         some other register, and that other register is the one
         responsible for migrating the state
      2) register is not actually state at all (for instance the TLB
         or cache maintenance operation "registers") and it makes no
         sense to attempt to migrate it or otherwise access the raw state

      This works fine for identifying which registers should be ignored
      when performing migration, but we also use the same functions for
      synchronizing system register state between QEMU and the kernel
      when using KVM. In this case we don't want to try to sync state
      into registers in category 2, but we do want to sync into registers
      in category 1, because the kernel might have picked a different
      one of the aliases as its choice for which one to expose for
      migration. (In particular, on 32 bit hosts the kernel will
      expose the state in the AArch32 version of the register, but
      TCG's convention is to mark the AArch64 version as the version
      to migrate, even if the CPU being emulated happens to be 32 bit,
      so almost all system registers will hit this issue now that we've
      added AArch64 system emulation.)

      Fix this by splitting the NO_MIGRATE flag in two (ALIAS and NO_RAW)
      corresponding to the two different reasons we might not want to
      migrate a register. When setting up the TCG list of registers to
      migrate we honour both flags; when populating the list from KVM,
      only ignore registers which are NO_RAW.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1422282372-13735-2-git-send-email-peter.maydell@linaro.org
      [PMM: changed ARM_CP_NO_MIGRATE to ARM_CP_ALIAS on new SP_EL1 and
       SP_EL2 reginfo stanzas since there was a (semantic) merge conflict
       with the patchset that added those]

  commit 884b4deeeb8b158ed3db5792161902bc8b41b62d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add missing SP_ELx register definition

      Added CP register definitions for SP_EL1 and SP_EL2.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5097227c15aa89baec1123aac25dd9500a62684d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Change reset to highest available EL

      Update to arm_cpu_reset() to reset into the highest available exception level
      based on the set ARM features.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be8e8128595b41b9f609c1507e67d121e65e7173
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:22 2015 +0000

      target-arm: Add extended RVBAR support

      Added RVBAR_EL2 and RVBAR_EL3 CP register support.  All RVBAR_EL# registers
      point to the same location and only the highest EL version exists at any one
      time.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 569b49f864e7593a14182acae5a7f5981f6ec24f
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target-arm: Fix RVBAR_EL1 register encoding

      Fix the RVBAR_EL1 CP register opc2 encoding from 2 to 1

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1422029835-4696-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8b47b7da29121ecddb173dd4afb82d6fb0eece37
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target_arm: Parameterise the irq lines for armv7m_init

      This patch allows the board to specifiy the number of NVIC interrupt
      lines when using armv7m_init.

      Signed-off-by: Alistair Francis <alistair23@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 5a0b0fcc778df0340899f488053acc9493679e03.1422077994.git.alistair23@gmail.com
      [PMM: removed stale FIXME comment]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fe6ac447add80978c1bf988c3ef4a7ce8aab2fa0
  Author: Alistair Francis <alistair23@gmail.com>
  Date:   Thu Feb 5 13:37:21 2015 +0000

      target_arm: Remove memory region init from armv7m_init

      This patch moves the memory region init code from the
      armv7m_init function to the stellaris_init function

      Signed-off-by: Alistair Francis <alistair23@gmail.com>
      Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
      Message-id: 4836be7e1d708554d6eb0bc639dc2fbf7dac0458.1422077994.git.alistair23@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2c918a245ca2a0b3339b8ded926b3f887d6d409e
  Merge: 32193cb 2ad28a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 11:11:56 2015 +0000

      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-05' into staging

      qmp hmp balloon: Cleanups around error reporting

      # gpg: Signature made Thu 05 Feb 2015 07:15:11 GMT using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

      * remotes/armbru/tags/pull-error-2015-02-05:
        balloon: Eliminate silly QERR_ macros
        balloon: Factor out common "is balloon active" test
        balloon: Inline qemu_balloon(), qemu_balloon_status()
        qmp: Eliminate silly QERR_COMMAND_NOT_FOUND macro
        qmp: Simplify recognition of capability negotiation command
        qmp: Clean up qmp_query_spice() #ifndef !CONFIG_SPICE dummy
        hmp: Compile hmp_info_spice() only with CONFIG_SPICE
        qmp hmp: Improve error messages when SPICE is not in use
        qmp hmp: Factor out common "using spice" test

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 442469e61d276440d485b80514c0df89266fdc13
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Tue Jan 20 15:40:38 2015 +0000

      MAINTAINERS: add Jason Wang as net subsystem maintainer

      Jason Wang will be co-maintaining the QEMU net subsystem with me.  He
      has contributed improvements and reviewed patches over the past years as
      part of working on virtio-net and virtualized networking.

      Jason has already been backing me up with patch reviews.  For the time
      being I will continue to submit pull requests.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Acked-by: Jason Wang <jasowang@redhat.com>

  commit 32193cb421cecb98b48715e0740b2d948cda0779
  Merge: ec6f25e 3a4dbe6
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Feb 5 10:19:38 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150204.0' into staging

      VFIO fixes:
      - Fix wrong initializer (Chen Fan)
      - Add missing object_unparent (Alex Williamson)

      # gpg: Signature made Wed 04 Feb 2015 18:49:24 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150204.0:
        vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion
        vfio: fix wrong initialize vfio_group_list

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3a4dbe6aa934370a92372528c1255ee1504965ee
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Wed Feb 4 11:45:32 2015 -0700

      vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion

      Commit d8d95814609e added explicit object_unparent() calls for
      dynamically allocated MemoryRegions.  The VFIOMSIXInfo structure also
      contains such a MemoryRegion, covering the mmap'd region of a PCI BAR
      above the MSI-X table.  This structure is freed as part of the class
      exit function and therefore also needs an explicit object_unparent().
      Failing to do this results in random segfaults due to fields within
      the structure, often the class pointer, being reclaimed and corrupted
      by the time object_finalize_child_property() is called for the object.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Cc: qemu-stable@nongnu.org # 2.2

  commit 39cb514f02c7daf6378117e28be7a659a69e48b7
  Author: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
  Date:   Wed Feb 4 11:45:32 2015 -0700

      vfio: fix wrong initialize vfio_group_list

      Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit ec6f25e788ef57ce1e9f734984ef8885172fd9e2
  Merge: 007c99f 9ef1473
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 3 21:37:16 2015 +0000

      Merge remote-tracking branch 'remotes/rth/tags/pull-tg-s390-20150203' into staging

      s390 translator bug fixes

      # gpg: Signature made Tue 03 Feb 2015 20:39:15 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/pull-tg-s390-20150203:
        target-s390x: fix and optimize slb* and slbg* computation of carry/borrow flag
        target-s390x: support OC and NC in the EX instruction
        disas/s390.c: Remove unused variables
        target-s390x: Mark check_privileged() as !CONFIG_USER_ONLY
        target-s390: Implement ECAG
        target-s390: Implement LURA, LURAG, STURG
        target-s390: Fix STURA
        target-s390: Fix STIDP
        target-s390: Implement EPSW
        target-s390: Implement SAM specification exception

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9ef1473693a1400a903567489d3122fc9511765d
  Author: Torbjorn Granlund <torbjorng@google.com>
  Date:   Thu Jan 8 18:01:09 2015 +0100

      target-s390x: fix and optimize slb* and slbg* computation of carry/borrow flag

      This patch fixes the bug with borrow_in being set incorrectly, but it
      also simplifies the logic to be much more plain, improving speed.  It
      fixes both the 32-bit SLB* and 64-bit SLBG*.

      The SLBG* change has been well-tested.  I haven't tested the SLB* change
      explicitly, but the code was copy-pasted from the tested code.

      The error of these functions' current implementations would not likely
      be triggered by compiler-generated code, since the only error was in the
      state of the carry/borrow flag.  Compilers rarely generate an
      instruction sequence such as carry-set -> carry-set-and-use ->
      carry-use.

      (With Paolo's fix and mine, there are still a couple of failures from
      GMP's testsuite, but they are almost surely due to incorrect code
      generation from gcc 4.9.  But since this gcc is running under qemu, it
      might be qemu bugs.  I intend to investigate this.)

      Signed-off-by: Torbjorn Granlund <torbjorng@google.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8cf02f93dc37bc3de30dfb74eb0e904d1700dbf6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 8 18:01:08 2015 +0100

      target-s390x: support OC and NC in the EX instruction

      This is needed to run the GMP testsuite.

      Reported-by: Torbjorn Granlund <torbjorng@google.com>
      Tested-by: Torbjorn Granlund <torbjorng@google.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 5b279407704613dbee8bc0866817bf7006b487a5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 16:28:31 2015 +0000

      disas/s390.c: Remove unused variables

      The variables s390_opformats and s390_num_opformats are unused and
      provoke clang warnings:

      disas/s390.c:849:33: warning: variable 's390_opformats' is not needed and will not be emitted [-Wunneeded-internal-declaration]
      static const struct s390_opcode s390_opformats[] =
                                      ^
      disas/s390.c:875:18: warning: unused variable 's390_num_opformats' [-Wunused-const-variable]
      static const int s390_num_opformats =
                       ^

      Delete them, since QEMU doesn't use them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1419373100-17690-3-git-send-email-peter.maydell@linaro.org
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8841d9dfc7f871cec7c3401a8a2d31ad34e881f7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 16:28:30 2015 +0000

      target-s390x: Mark check_privileged() as !CONFIG_USER_ONLY

      The function check_privileged() is only used in the softmmu configs;
      wrap it in an #ifndef CONFIG_USER_ONLY to avoid clang warnings on the
      linux-user builds.

      [rth: Remove inline marker too; it was only there to prevent exactly
      this warning in GCC.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 1419373100-17690-2-git-send-email-peter.maydell@linaro.org
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 0774710f1bd052b05cc68ca3af06d8fc1a65664b
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 15:34:34 2013 -0700

      target-s390: Implement ECAG

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 9c3fd85b142f244ac1900b9da02f2d733d03c1b1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 13:04:28 2013 -0700

      target-s390: Implement LURA, LURAG, STURG

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 81822c2f42e0c3d7bf36f6eec92941de33ed92b8
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 12:46:49 2013 -0700

      target-s390: Fix STURA

      We were storing 16 bits instead of 32.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 7f745b31b39cb9be8b3c3dfaf3173390ae07353e
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 20 11:33:41 2013 -0700

      target-s390: Fix STIDP

      The implementation had been incomplete, as we did not store the
      machine type.  Note that the machine_type member is still unset
      during initialization, so this has no effect yet.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit e30a9d3fea58c356000ce328421fe65e03143bb1
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 6 09:48:08 2013 -0700

      target-s390: Implement EPSW

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 8612c935831647c193281992738f96292428b9e6
  Author: Richard Henderson <rth@twiddle.net>
  Date:   Fri Sep 6 09:31:37 2013 -0700

      target-s390: Implement SAM specification exception

      Also, these are user-mode instructions; allow their use
      in CONFIG_USER_ONLY.

      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 007c99fd0fb4e0f0579872bb71f5de99b5943dc2
  Merge: d5fbb4c 553ce81
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Feb 3 13:19:52 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150203' into staging

      Some bugfixes and cleanups for s390x, both in the new pci code and
      in old code.

      # gpg: Signature made Tue 03 Feb 2015 13:01:04 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150203:
        pc-bios/s390-ccw: update binary
        pc-bios/s390-ccw: fix sparse warnings
        s390x/ipl: Improved code indentation in s390_ipl_init()
        s390x/kvm: unknown DIAGNOSE code should give a specification exception
        s390x/kvm: Fix diag-308 register decoding
        s390x/pci: fix dma notifications in rpcit instruction
        s390x/pci: check for invalid function handle
        s390x/pci: avoid sign extension in stpcifc
        s390: Plug memory leak on s390_pci_generate_event() error path

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 553ce81c31e49d834b1bf635ab486695a4694333
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Mon Jan 26 15:51:37 2015 +0100

      pc-bios/s390-ccw: update binary

      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit f17a84300f3f3b5de45c8706a44d69d41d1727cb
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jan 22 13:44:26 2015 +0100

      pc-bios/s390-ccw: fix sparse warnings

      Fix some sparse warnings in the s390-ccw bios.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 7691993c2b290dfedfb08a8eaa8cf7d5c6573fcb
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Tue Feb 11 09:12:27 2014 +0100

      s390x/ipl: Improved code indentation in s390_ipl_init()

      The indentation of the code in s390_ipl_init() can be simplified
      a little bit by removing superfluous else-statements.

      Suggested-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 68540b1a1b505d9578699b03fe0b5da716a21dcc
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Dec 18 10:04:17 2014 +0100

      s390x/kvm: unknown DIAGNOSE code should give a specification exception

      As described in CP programming services an unimplemented DIAGNOSE
      function should return a specification exception. Today we give the
      guest an operation exception.
      As both exception types are suppressing and Linux as a guest does not
      care about the type of program check in its exception table handler
      as long as both types have the same kind of error handling (nullifying,
      terminating, suppressing etc.) this was unnoticed.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 20dd25bb67a51a4a57092b6381a6d4b0e64e2153
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Dec 8 14:19:13 2014 +0100

      s390x/kvm: Fix diag-308 register decoding

      Fix the decoding of the r1 register number in the diagnose 308 handler.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 4e99a0f7ae2a8392fd306c357148763ac4f820f9
  Author: Yi Min Zhao <zyimin@cn.ibm.com>
  Date:   Mon Jan 19 15:15:56 2015 +0800

      s390x/pci: fix dma notifications in rpcit instruction

      The virtual I/O address range passed to rpcit instruction might not
      map to consecutive physical guest pages. For this we have to translate
      and create mapping notifications for each vioa page separately.

      Signed-off-by: Yi Min Zhao <zyimin@cn.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 5b324bbafc4fe367bd9c5bfa6cff071081fb8b0e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Fri Jan 16 14:55:21 2015 +0100

      s390x/pci: check for invalid function handle

      broken guest may provide 0 (invalid) function handle to zpci
      instructions. Since we use function handle 0 to indicate an empty
      slot in the PHB we have to add an additional check to spot this
      kind of error.

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit c0eb33ab5428edf85a29a4f91f64d6802b6cefaa
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Wed Jan 21 16:50:29 2015 +0100

      s390x/pci: avoid sign extension in stpcifc

      This patch avoids sign extension and fixes a data conversion
      bug in stpcifc. Both issues where found by Coverity.

      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit b7022d9ac61311f92aef0994e2ab801b76d55f14
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 20 10:56:37 2015 +0100

      s390: Plug memory leak on s390_pci_generate_event() error path

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit d5fbb4c9ed52d97aebe5994d8a857c74c0d95a92
  Merge: 16017c4 2aeba9d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Feb 2 19:36:02 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      The important bits here are the first part of RCU.

      v1->v2 changes are the new qemu-thread patch to fix Mac OS X,
      and cleaning up warnings.

      v2->v3 removed the patch to enable modules by default.

      # gpg: Signature made Mon 02 Feb 2015 19:28:03 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        scsi: Fix scsi_req_cancel_async for no aiocb req
        cpu-exec: simplify init_delay_params
        cpu-exec: simplify align_clocks
        memory: avoid ref/unref in memory_region_find
        memory: protect current_map by RCU
        memory: remove assertion on memory_region_destroy
        rcu: add call_rcu
        rcu: allow nesting of rcu_read_lock/rcu_read_unlock
        rcu: add rcutorture
        rcu: add rcu library
        qemu-thread: fix qemu_event without futexes

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2aeba9d8a1b6121b98948fcd42fd2aa32f68b750
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 27 17:16:59 2015 +0800

      scsi: Fix scsi_req_cancel_async for no aiocb req

      scsi_req_cancel_complete is responsible for releasing the request, so we
      shouldn't skip it in any case. This doesn't affect the only existing
      caller, virtio-scsi, but is useful for other devices once they use it.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2e91cc62f29a7359d00576a250a10892e00c95b4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 10:16:37 2015 +0100

      cpu-exec: simplify init_delay_params

      With the introduction of QEMU_CLOCK_VIRTUAL_RT, the computation of
      sc->diff_clk can be simplified nicely:

              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              qemu_clock_get_ns(QEMU_CLOCK_REALTIME) +
              cpu_get_clock_offset()

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - cpu_get_clock_offset())

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + timers_state.cpu_clock_offset)

           =  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) -
              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT)

      Cc: Sebastian Tanase <sebastian.tanase@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a498d0ef37cf23e1776240af61f558d113afdf4f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 28 10:09:55 2015 +0100

      cpu-exec: simplify align_clocks

      sc->diff_clk is already equal to sleep_delay (split in a second and a
      nanosecond part).  If you subtract sleep_delay - rem_delay, the result
      is exactly rem_delay.

      Cc: Sebastian Tanase <sebastian.tanase@openwide.fr>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2b647668c9092dbc26e36a2ece9647cc2f00e05b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri May 17 12:40:44 2013 +0200

      memory: avoid ref/unref in memory_region_find

      Do the entire lookup under RCU, which avoids atomic operations
      in flatview_ref and flatview_unref.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri May 17 12:37:03 2013 +0200

      memory: protect current_map by RCU

      Replace the flat_view_mutex with RCU, avoiding futex contention for
      dataplane on large systems and many iothreads.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b476c99d01519277e3494a10dc0329d07157ae02
  Author: Jan Kiszka <jan.kiszka@siemens.com>
  Date:   Tue Jul 2 16:51:15 2013 +0200

      memory: remove assertion on memory_region_destroy

      Now that memory_region_destroy can be called from an RCU callback,
      checking the BQL-protected global memory_region_transaction_depth
      does not make much sense.

      Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 26387f86c9d6ac3a7a93b76108c502646afb6c25
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 13 17:49:24 2013 +0200

      rcu: add call_rcu

      Asynchronous callbacks provided by call_rcu are particularly important
      for QEMU, because the BQL makes it hard to use synchronize_rcu.

      In addition, the current RCU implementation is not particularly friendly
      to multiple concurrent synchronize_rcu callers, making call_rcu even
      more important.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d62cb4f2fdc0977f9ca9f41d297c3d2c44874171
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 13 17:34:15 2015 +0100

      rcu: allow nesting of rcu_read_lock/rcu_read_unlock

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 8fda74a52bf3fa63cb80c877b6946cb9143f96cc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jun 21 09:09:34 2013 +0200

      rcu: add rcutorture

      rcutorture is the unit test for rcu.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7911747bd46123ef8d8eef2ee49422bb8a4b274f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon May 13 13:29:47 2013 +0200

      rcu: add rcu library

      This includes a (mangled) copy of the liburcu code.  The main changes
      are: 1) removing dependencies on many other header files in liburcu; 2)
      removing for simplicity the tentative busy waiting in synchronize_rcu,
      which has limited performance effects; 3) replacing futexes in
      synchronize_rcu with QemuEvents for Win32 portability.  The API is
      the same as liburcu, so it should be possible in the future to require
      liburcu on POSIX systems for example and use our copy only on Windows.

      Among the various versions available I chose urcu-mb, which is the
      least invasive implementation even though it does not have the
      fastest rcu_read_{lock,unlock} implementation.  The urcu flavor can
      be changed later, after benchmarking.

      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 158ef8cbb7e0fe8bb430310924b8bebe5f186e6e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Feb 2 16:36:51 2015 +0100

      qemu-thread: fix qemu_event without futexes

      This had a possible deadlock that was visible with rcutorture.

          qemu_event_set                    qemu_event_wait
          ----------------------------------------------------------------
                                            cmpxchg reads FREE, writes BUSY
                                            futex_wait: pthread_mutex_lock
                                            futex_wait: value == BUSY
          xchg reads BUSY, writes SET
          futex_wake: pthread_cond_broadcast
                                            futex_wait: pthread_cond_wait
                                            <deadlock>

      The fix is simply to avoid condvar tricks and do the obvious locking
      around pthread_cond_broadcast:

          qemu_event_set        qemu_event_wait
          ----------------------------------------------------------------
                                            cmpxchg reads FREE, writes BUSY
                                            futex_wait: pthread_mutex_lock
                                            futex_wait: value == BUSY
          xchg reads BUSY, writes SET
          futex_wake: pthread_mutex_lock
          (blocks)
                                            futex_wait: pthread_cond_wait
          (mutex unlocked)
          futex_wake: pthread_cond_broadcast
          futex_wake: pthread_mutex_unlock
                                            futex_wait: pthread_mutex_unlock

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 16017c48547960539fcadb1f91d252124f442482
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:28 2015 +0000

      softfloat: Clarify license status

      The code in the softfloat source files is under a mixture of
      licenses: the original code and many changes from QEMU contributors
      are under the base SoftFloat-2a license; changes from Stefan Weil
      and RedHat employees are GPLv2-or-later; changes from Fabrice Bellard
      are under the BSD license. Clarify this in the comments at the
      top of each affected source file, including a statement about
      the assumed licensing for future contributions, so we don't need
      to remember to ask patch submitters explicitly to pick a license.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Andreas Färber <afaerber@suse.de>
      Acked-by: Aurelien Jarno <aurelien@aurel32.net>
      Acked-by: Avi Kivity <avi.kivity@gmail.com>
      Acked-by: Ben Taylor <bentaylor.solx86@gmail.com>
      Acked-by: Blue Swirl <blauwirbel@gmail.com>
      Acked-by: Christophe Lyon <christophe.lyon@st.com>
      Acked-by: Fabrice Bellard <fabrice@bellard.org>
      Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Acked-by: Juan Quintela <quintela@redhat.com>
      Acked-by: Max Filippov <jcmvbkbc@gmail.com>
      Acked-by: Paul Brook <paul@codesourcery.com>
      Acked-by: Paolo Bonzini <pbonzini@redhat.com>
      Acked-by: Peter Maydell <peter.maydell@linaro.org>
      Acked-by: Richard Henderson <rth@twiddle.net>
      Acked-by: Richard Sandiford <rdsandiford@googlemail.com>
      Acked-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-5-git-send-email-peter.maydell@linaro.org

  commit 332d5849708d11b835e0b36f4e26e8b36bfb3f5a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:27 2015 +0000

      softfloat: Revert and reimplement remaining parts of b645bb4885 and 5a6932d51d

      Revert the parts of commits b645bb4885 and 5a6932d51d which are still
      in the codebase and under a SoftFloat-2b license.

      Reimplement support for architectures where the most significant bit
      in the mantissa is 1 for a signaling NaN rather than a quiet NaN,
      by adding handling for SNAN_BIT_IS_ONE being set to the functions
      which test values for NaN-ness.

      This includes restoring the bugfixes lost in the reversion where
      some of the float*_is_quiet_nan() functions were returning true
      for both signaling and quiet NaNs.

      [This is a mechanical squashing together of two separate "revert"
      and "reimplement" patches.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-4-git-send-email-peter.maydell@linaro.org

  commit 6bb8e0f130bd4aecfe835a0caa94390fa2235fde
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:26 2015 +0000

      softfloat: Revert and reimplement remaining portions of 75d62a5856 and 3430b0be36f

      Revert the remaining portions of commits 75d62a5856 and 3430b0be36f
      which are under a SoftFloat-2b license, ie the functions
      uint64_to_float32() and uint64_to_float64(). (The float64_to_uint64()
      and float64_to_uint64_round_to_zero() functions were completely
      rewritten in commits fb3ea83aa and 0a87a3107d so can stay.)

      Reimplement from scratch the uint64_to_float64() and uint64_to_float32()
      conversion functions.

      [This is a mechanical squashing together of two separate "revert"
      and "reimplement" patches.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-3-git-send-email-peter.maydell@linaro.org

  commit a7d1ac78e0f1101df2ff84502029a4b0da6024ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 14:38:25 2015 +0000

      softfloat: Apply patch corresponding to rebasing to softfloat-2a

      This commit applies the changes to master which correspond to
      replacing commit 158142c2c2df with a set of changes made by:
       * taking the SoftFloat-2a release
       * mechanically transforming the block comment style
       * reapplying Fabrice's original changes from 158142c2c2df

      This commit was created by:
       diff -u 158142c2c2df import-sf-2a
       patch  -p1 --fuzz 10 <../relicense-patch.txt
      (where import-sf-2a is the branch resulting from the changes above).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421073508-23909-2-git-send-email-peter.maydell@linaro.org

  commit 2ad28a088d2cc8fd404dfa58fa1b80f9225425ff
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:50:23 2015 +0100

      balloon: Eliminate silly QERR_ macros

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      up the balloon ones.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Markus Armbruster <armbru@redhat.com>

  commit 422e0501a842fb4b3f42494f341707e809c3c6ad
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:44:14 2015 +0100

      balloon: Factor out common "is balloon active" test

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 6502a14734e71b2f6dd079b0a1e546e6aa2d2f8d
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:43:25 2015 +0100

      balloon: Inline qemu_balloon(), qemu_balloon_status()

      ... and simplify a bit.  Permits factoring out common error checks in
      the next commit.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit a6c90cbccdc07d51d4bbff71d2680f1a2c287370
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 16:16:35 2015 +0100

      qmp: Eliminate silly QERR_COMMAND_NOT_FOUND macro

      The QERR_ macros are leftovers from the days of "rich" error objects.
      They're used with error_set() and qerror_report(), and expand into the
      first *two* arguments.  This trickiness has become pointless.  Clean
      this one up.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit bb5224edfb1e6f94aabaa8070d11c8f95f8ae277
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 16:14:04 2015 +0100

      qmp: Simplify recognition of capability negotiation command

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit ad0ec14bad645d9c0402047e858ea323151c8e9b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 15:56:11 2015 +0100

      qmp: Clean up qmp_query_spice() #ifndef !CONFIG_SPICE dummy

      QMP command query-spice exists only #ifdef CONFIG_SPICE.  Due to QAPI
      limitations, we need a dummy function anyway, but it's unreachable.

      Our current dummy function goes out of its way to produce the exact
      same error as the QMP core does for unknown commands.  Cute, but both
      unclean and unnecessary.  Replace by straight abort().

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 206addd58f251666f5b64d43957ddcba465c0ef1
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 15:46:39 2015 +0100

      hmp: Compile hmp_info_spice() only with CONFIG_SPICE

      It's dead code when CONFIG_SPICE is off.  If it wasn't, it would crash
      dereferencing the null pointer returned by the qmp_query_spice()
      dummy in qmp.c.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cfa9bb236911eaa30ac58072105881a65cbbb612
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:21:45 2015 +0100

      qmp hmp: Improve error messages when SPICE is not in use

      Commit 7572150 adopted QERR_DEVICE_NOT_ACTIVE for the purpose,
      probably because adding another error seemed cumbersome overkill.
      Produces "No spice device has been activated", which is awkward.

      We've since abandoned our quest for "rich" error objects.  Time to
      undo the damage to this error message.  Replace it by "SPICE is not in
      use".

      Keep the stupid DeviceNotActive ErrorClass for compatibility, even
      though Libvirt doesn't use it.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b25d81ba332dc06757d40ffe64944ba27082de0a
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Tue Jan 13 17:07:15 2015 +0100

      qmp hmp: Factor out common "using spice" test

      Into qemu_using_spice().  For want of a better place, put it next the
      existing monitor command handler dummies in qemu-spice.h.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 83761b9244ad2ed39d3cfabe8a0e901ab906f7bf
  Merge: b00c92e 30b8b68
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 22:25:56 2015 +0000

      Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20150127' into staging

      linux-user updates since last pull request

      # gpg: Signature made Tue 27 Jan 2015 20:52:54 GMT using RSA key ID DE3C9BC0
      # gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
      # gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

      * remotes/riku/tags/pull-linux-user-20150127:
        linux-user: support target-to-host SCM_CREDENTIALS
        linux-user: Fix broken m68k signal handling on 64 bit hosts
        mips64-linux-user: Fix definition of struct sigaltstack
        linux-user: Fix ioctl cmd type mismatch on 64-bit targets
        linux-user: translate resource also for prlimit64
        linux-user/signal.c: Remove unnecessary wrapper copy_siginfo_to_user
        linux-user/main.c: Mark end_exclusive() as possibly unused
        linux-user/main.c: Call cpu_exec_start/end on all target archs
        linux-user/arm/nwfpe: Delete unused aCC array
        linux-user/alpha: Add define for NR_shmat to enable shmat syscall
        linux-user/signal.c: Remove current_exec_domain_sig()

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 30b8b68eb574fd68060eebcc4da790fdfe18d668
  Author: Alex Suykov <alex.suykov@gmail.com>
  Date:   Tue Dec 23 07:52:58 2014 +0200

      linux-user: support target-to-host SCM_CREDENTIALS

      When passing ancillary data through a unix socket, handle
      credentials properly instead of doing a simple copy and
      issuing a warning.

      Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1669add752d9f29283f8ebf6a863d7b1e2d0f146
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 17:47:00 2014 +0000

      linux-user: Fix broken m68k signal handling on 64 bit hosts

      The m68k signal frame setup code which writes the signal return
      trampoline code to the stack was assuming that a 'long' was 32 bits;
      on 64 bit systems this meant we would end up writing the 32 bit
      (2 insn) trampoline sequence to retaddr+4,retaddr+6 instead of
      the intended retaddr+0,retaddr+2, resulting in a guest crash when
      it tried to execute the invalid zero-bytes at retaddr+0.
      Fix by using uint32_t instead; also use uint16_t rather than short
      for consistency. This fixes bug LP:1404690.

      Reported-by: Michel Boaventura
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit ec355f15476fe91b95c4326836d3fe572d8075e1
  Author: Ed Swierk <eswierk@skyportsystems.com>
  Date:   Tue Dec 16 12:55:18 2014 -0800

      mips64-linux-user: Fix definition of struct sigaltstack

      Without this fix, qemu segfaults when emulating the sigaltstack syscall,
      because it incorrectly treats the ss_flags field as 64 bits rather than 32
      bits.

      Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 9c6bf9c7d71d7da18a024182b69569969449d6f9
  Author: Ed Swierk <eswierk@skyportsystems.com>
  Date:   Tue Dec 16 12:55:31 2014 -0800

      linux-user: Fix ioctl cmd type mismatch on 64-bit targets

      linux-user passes the cmd argument of the ioctl syscall as a signed long,
      but compares it to an unsigned int when iterating through the ioctl_entries
      list.  When the cmd is a large value like 0x80047476 (TARGET_TIOCSWINSZ on
      mips64) it gets sign-extended to 0xffffffff80047476, causing the comparison
      to fail and resulting in lots of spurious "Unsupported ioctl" errors.
      Changing the target_cmd field in the ioctl_entries list to a signed int
      causes those values to be sign-extended as well during the comparison.

      Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 95018018caeea209f58695645fd1d50a9d0ba6df
  Author: Felix Janda <felix.janda@posteo.de>
  Date:   Tue Dec 2 22:11:17 2014 +0100

      linux-user: translate resource also for prlimit64

      The resource argument is translated from host to target for
      [gs]etprlimit but not for prlimit64. Fix this.

      Signed-off-by: Felix Janda <felix.janda@posteo.de>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit f6c7a05b8985df7eaf9942ca78e19890204eee4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:48 2015 +0000

      linux-user/signal.c: Remove unnecessary wrapper copy_siginfo_to_user

      The function copy_siginfo_to_user() just calls tswap_siginfo(), so
      call the latter function directly and delete the wrapper function.
      The wrapper is actually misleading since it implies that the
      semantics are like the kernel function with the same name which
      copies the data to a guest user-space address. In fact tswap_siginfo()
      just does data-structure conversion between two structures whose
      addresses are host addresses (the copy to userspace is handled
      in QEMU by the lock_user/unlock_user calls).

      This also fixes clang complaints about the wrapper being unused
      in some configs.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit f7e61b222b2796ee43c976ec44c61a15d55ff662
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:47 2015 +0000

      linux-user/main.c: Mark end_exclusive() as possibly unused

      The function end_exclusive() isn't used on all targets; mark it as
      such to avoid a clang warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b040bc9c0360106fab57bb1abe2d242bd17c4c32
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:46 2015 +0000

      linux-user/main.c: Call cpu_exec_start/end on all target archs

      The start_exclusive() infrastructure is used on all target
      architectures, even if only to do the "stop all CPUs before
      dumping core" in force_sig(), so be consistent and call
      cpu_exec_start/end in the main loop of every target.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit 1af2ee08f9b2f70d31676be14b26026223c9f660
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:45 2015 +0000

      linux-user/arm/nwfpe: Delete unused aCC array

      The aCC array in fpopcode.c is completely unused in QEMU; delete
      it (silencing a clang warning).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit ea2b5fb19d50c1cbdea9a40504e31e54d37b8bab
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:44 2015 +0000

      linux-user/alpha: Add define for NR_shmat to enable shmat syscall

      For historical reasons, the define for the shmat() syscall on Alpha is
      NR_osf_shmat; however it has the same semantics as this syscall does
      on all other architectures, so define TARGET_NR_shmat as well so that
      QEMU's code for the syscall is enabled.

      This patch brings our behaviour on the LTP shmat tests into line
      with that for ARM (still not a perfect pass rate but not "this syscall
      is completely broken" as we had before).

      (Problem detected via a clang warning that the do_shmat() function
      was unused on Alpha.)

      Cc: Richard Henderson <rth@twiddle.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b6e2c9353a5bd8649ee71a52c35344ce3fb1c7d2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 8 12:19:43 2015 +0000

      linux-user/signal.c: Remove current_exec_domain_sig()

      Remove the function current_exec_domain_sig(), which always returns
      its argument. This was intended as a stub for supporting the kernel's
      exec_domain handling, but:
       * we don't have any of the other code for execution domains
       * in the kernel this handling is architecture-specific, not generic
       * we only call this function in the x86, ppc and sh4 signal code paths,
         and the PPC one is wrong anyway because the PPC kernel doesn't
         have this signal-remapping code

      So it's best to simply delete the function; any future attempt to
      implement exec domains will be better served by adding the correct
      code from scratch based on the kernel sources at that time.

      This change also fixes some clang warnings about the function being
      defined but not used for some target architectures.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Riku Voipio <riku.voipio@linaro.org>

  commit b00c92e3ef59b78f6029d66353aaf995ceaa6605
  Merge: 7baef63 3715345
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 13:17:30 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pci, pc, virtio fixes and cleanups

      A bunch of fixes all over the place.  Also, beginning to generalize acpi build
      code for reuse by ARM.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Tue 27 Jan 2015 13:12:25 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        pc-dimm: Add Error argument to pc_existing_dimms_capacity
        pc-dimm: Make pc_existing_dimms_capacity global
        pc: Fix DIMMs capacity calculation
        smbios: Don't report unknown CPU speed (fix SVVP regression)
        smbios: Fix dimm size calculation when RAM is multiple of 16GB
        bios-linker-loader: move source to common location
        bios-linker-loader: move header to common location
        virtio: fix feature bit checks
        bios-tables-test: split piix4 and q35 tests
        acpi: build_append_nameseg(): add padding if necessary
        acpi: update generated hex files
        acpi-test: update expected DSDT
        pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
        pci: Split pcie_host_mmcfg_map()
        Add some trace calls to pci.c.
        ich9: add disable_s3, disable_s4, s4_val properties

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 37153450436f58449ce7e41d13a23821611e889e
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:02 2015 +0530

      pc-dimm: Add Error argument to pc_existing_dimms_capacity

      Now that pc_existing_dimms_capacity() is an API, include Error pointer
      as an argument and modify the caller appropriately.

      Suggested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>

  commit 9967c94957f60c2d1cadbe0bfd4373a13fb1a226
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:01 2015 +0530

      pc-dimm: Make pc_existing_dimms_capacity global

      Move pc_existing_dimms_capacity() to pc-dimm.c since it would be needed
      by PowerPC memory hotplug code too.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 759048ac20174b34fa7a593f4da2e7fed34e599c
  Author: Bharata B Rao <bharata@linux.vnet.ibm.com>
  Date:   Tue Jan 27 09:35:00 2015 +0530

      pc: Fix DIMMs capacity calculation

      pc_existing_dimms_capacity() is returning DIMMs count rather than capacity.
      Fix this to return the capacity. Also consider only realized devices for
      capacity calculation.

      Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 07d01c9c1929e43216005fcc8eccea75776ee0d2
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Jan 7 15:36:34 2015 -0200

      smbios: Don't report unknown CPU speed (fix SVVP regression)

      SVVP requires processor speed on Type 4 structures to not be unknown.
      This was fixed in SeaBIOS 0.5.0 (in 2009), but the bug was reintroduced
      in QEMU 2.1.

      Revert to old behavior and report CPU speed as 2000 MHz instead of
      unknown.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 744c6d474791ff3ad5c2f08edc732564199fd146
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Wed Jan 7 15:36:33 2015 -0200

      smbios: Fix dimm size calculation when RAM is multiple of 16GB

      The Memory Device size calculation logic is broken when the RAM size is
      a multiple of 16GB, making the size of the last entry be 0 instead of
      16GB. Fix the logic to handle that case correctly.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 09852232ee131d0bfa5bdf7f44a806158a5c8711
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jan 19 23:58:55 2015 +0200

      bios-linker-loader: move source to common location

      There are plans to use bios linker by MIPS, ARM.

      It's only used by ACPI ATM, so put it in hw/acpi
      and make it depend on CONFIG_ACPI.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 0058ae1d9483f5f96c7798e2ae51cce42c69abfb
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Jan 19 23:58:55 2015 +0200

      bios-linker-loader: move header to common location

      Will be usable by MIPS, ARM.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 91d5c57a2e98845c02cda026f3f6a88cb5e14225
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Fri Dec 12 10:01:46 2014 +0100

      virtio: fix feature bit checks

      Several places check against the feature bit number instead of against
      the feature bit. Fix them.

      Cc: qemu-stable@nongnu.org
      Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 71f4be25d476c2865688da1e568257313cc2e511
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 19 17:50:38 2015 +0100

      bios-tables-test: split piix4 and q35 tests

      This makes it clear which one is failing.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit 6d848641b7a4da92840fb2f5c240d1668f5a9281
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Dec 19 11:47:00 2014 +0000

      acpi: build_append_nameseg(): add padding if necessary

      According to ACPI spec NameSeg shorter than 4 characters
      must be padded up to 4 characters with "_" symbol.
      ACPI 5.0:  20.2.2 "Name Objects Encoding"

      Do it in build_append_nameseg() so that caller shouldn't know
      or care about it.

      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit e909c16d924c0dbb852de3c0dd3d9cb5213b90c5
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jan 27 14:40:44 2015 +0200

      acpi: update generated hex files

      Previous patch
          pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
      changed DSDT, update hex files for non-iasl builds.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 215d8d130be605c1927c764b027047c0ae0c6122
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Jan 27 14:40:44 2015 +0200

      acpi-test: update expected DSDT

      Previous patch
          pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled
      changed DSDT, update expected test files.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 7baef630732a50fcbb7ca5b1e9cc0ecf4f2998c9
  Merge: 1ac0206 0953225
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 27 11:15:09 2015 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150127' into staging

      tricore bugfixes and RR1, RR2, RRPW and RRR insn

      # gpg: Signature made Tue 27 Jan 2015 12:02:06 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20150127:
        target-tricore: Add instructions of RRR opcode format
        target-tricore: Add instructions of RRPW opcode format
        target-tricore: Add instructions of RR2 opcode format
        target-tricore: Add instructions of RR1 opcode format, that have 0x93 as first opcode
        target-tricore: split up suov32 into suov32_pos and suov32_neg
        target-tricore: Fix bugs found by coverity
        target-tricore: calculate av bits before saturation
        target-tricore: Several translator and cpu model fixes
        target-tricore: Add missing ULL suffix on 64 bit constant

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0953225588ee30de2e92485331ad1bb3d7c7d089
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:43:07 2015 +0000

      target-tricore: Add instructions of RRR opcode format

      Add microcode generator function gen_cond_sub.

      Add helper functions:
          * ixmax/ixmin: search for the max/min value and its related index in a
                         vector of 16-bit values.
          * pack: dack two data registers into an IEEE-754 single precision floating
                  point format number.
          * dvadj: divide-adjust the result after dvstep instructions.
          * dvstep: divide a reg by a divisor, producing 8-bits of quotient at a time.

      OPCM_32_RRR_FLOAT -> OPCM_32_RRR_DIVIDE

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 8fb9d0eb68376363553d81525cc526842543e2dc
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:13:00 2015 +0000

      target-tricore: Add instructions of RRPW opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 12f323e66e2d850b0e27300d609deae6e7290457
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 15:05:01 2015 +0000

      target-tricore: Add instructions of RR2 opcode format

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f1cc6eafdd08817a234e0e1a9c8f03177a31faf1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 14:58:42 2015 +0000

      target-tricore: Add instructions of RR1 opcode format, that have 0x93 as first opcode

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 85d604af5f96c32734af9974ec6ddb625b6716a2
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Jan 19 14:28:59 2015 +0000

      target-tricore: split up suov32 into suov32_pos and suov32_neg

      suov checks unsigned for an overflow and an underflow, after some arithmetic
      operations and saturates the result to either max_uint32 or 0. So far we
      handled this by expanding to the next bigger data type and compare whether
      the result is > max_uint32 or < 0.

      However this approach can fail for an 32 bit multiplication, if both operands of
      the multiplication are 0x80000000. This sets the sign bit of the 64 bit integer
      and would result in a false saturation to 0.

      Since unsigned operations, e.g add, sub, mul always result in either a positive
      or negative overflow, we split the functions for suov32 up into two functions
      (suov32_pos, suov32_neg) for each case.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 40a1f64b468ee247fca3b237f0b89f066e59626c
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 16:16:01 2015 +0000

      target-tricore: Fix bugs found by coverity

      This fixes one bug and one false positive found by coverity. The bug is,
      that gen_mtcr was missing a mask to check the flag, which resulted in dead code.

      The false positive is a intentional missing break for a jump and link address
      insn followed by a jump and link insn. This adds a fall through comment to avoid
      the false positive in the future.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 811ea608e9721dc4f6933da440f235e7d3a39c0f
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Jan 21 15:55:15 2015 +0000

      target-tricore: calculate av bits before saturation

      64 bit mac instructions calculated the av bits after the saturation, which
      resulted in a wrong PSW. This moves the av bit calculation before the
      saturation.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 5f30046f156c181fb4088da2f4b8ea25a7d07c7a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sat Jan 17 22:34:27 2015 +0000

      target-tricore: Several translator and cpu model fixes

      Fix tc1796 cpu model using wrong ISA version.
      Fix cond_add sometimes writing back wrong result.
      Fix RCR_SEL and RCR_SELN using wrong registers for result and cond.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 452e3d49d871f311f7b884dc69160c3e0973b050
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:24:09 2014 +0000

      target-tricore: Add missing ULL suffix on 64 bit constant

      Add a missing ULL suffix to a 64 bit constant: this suppresses a
      compiler warning from mingw32 gcc.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 6d4e4cb9985e24557abcf3932a0e7f8f6ab3c1d2
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   Fri Dec 19 11:46:57 2014 +0000

      pc: acpi: fix WindowsXP BSOD when memory hotplug is enabled

      ACPI parser in XP considers PNP0A06 devices of CPU and
      memory hotplug as duplicates. Adding unique _UID
      to CPU hotplug device fixes BSOD.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 27fb9688f9162515901ebf29e3879788fd326ea7
  Author: Alexander Graf <agraf@suse.de>
  Date:   Tue Jan 6 17:03:08 2015 +0100

      pci: Split pcie_host_mmcfg_map()

      The mmcfg space is a memory region that allows access to PCI config space
      in the PCIe world. To maintain abstraction layers, I would like to expose
      the mmcfg space as a sysbus mmio region rather than have it mapped straight
      into the system's memory address space though.

      So this patch splits the initialization of the mmcfg space from the actual
      mapping, allowing us to only have an mmfg memory region without the map.

      Signed-off-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>

  commit 7828d75045380ac659f2ad85fb5fec9bbb0746ac
  Author: Don Koch <dkoch@verizon.com>
  Date:   Fri Jan 16 14:20:51 2015 -0500

      Add some trace calls to pci.c.

      Signed-off-by: Don Koch <dkoch@verizon.com>
      Acked-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

  commit 6ac0d8d44c0966225b200cc25f8c5270f1191ec0
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Mon Jan 12 17:30:14 2015 +0530

      ich9: add disable_s3, disable_s4, s4_val properties

      PIIX4 has disable_s3 and disable_s4 properties to enable or disable PM
      functions.  Add such properties to the ICH9 chipset as well for the Q35
      machine type.

      S3 / S4 are not guaranteed to always work (needs work in the guest as
      well as QEMU for things to work properly), and disabling advertising of
      these features ensures guests don't go into zombie state if something
      isn't working right.

      The defaults are kept the same as in PIIX4: both S3 and S4 are enabled
      by default.

      These can be disabled via the cmdline:

        ... -global ICH9-LPC.disable_s3=1 -global ICH9-LPC.disable_s4=1

      Note: some guests can fake hibernation by writing a hibernate image and
      doing a shutdown instead of S4 if S4 isn't available; there's nothing we
      can do guests to stop doing this, and this patch can't affect that
      functionality.

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>

  commit 1ac0206b2ae1ffaeec564f110664a3a77bafafd2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 16:16:40 2015 +0000

      qemu-timer.c: Trim list of included headers

      qemu-timer.c was including a lot more headers than it needed to,
      presumably for historical reasons. In particular, it included
      ui/console.h; this now tries to pull in <pixman.h>, which will
      cause a compilation failure in --disable-tools --disable-system
      configurations when running "make check" (which builds qemu-timer.c,
      even though the linux-user binaries themselves don't need it).

      Fix this build failure by trimming down the set of included
      headers severely -- we only really need main-loop.h and timer.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1421770600-17525-1-git-send-email-peter.maydell@linaro.org

  commit 074092d074f7a55378659223cf54ca06f6d0fbde
  Merge: 0c28d0d d01a5a3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 13:11:16 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-26' into staging

      * remotes/sstabellini/xen-2015-01-26:
        fix QEMU build on Xen/ARM

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d01a5a3fe19645f3cdea1566f0e518ea2152a029
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Fri Jan 23 12:09:47 2015 +0000

      fix QEMU build on Xen/ARM

      xen_get_vmport_regs_pfn should take a xen_pfn_t argument, not an
      unsigned long argument (in fact xen_pfn_t is defined as uint64_t on
      ARM).

      Also use xc_hvm_param_get instead of the deprecated xc_get_hvm_param.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>

  commit 0c28d0d07fbcd7aa44d231241d444d00882256e2
  Merge: d109f80 fc116ef
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 26 11:50:29 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - Many fixes from the floor as usual
      - New "edu" device (v1->v2: fix 32-bit compilation)
      - Disabling HLE and RTM on Haswell & Broadwell
      - kvm_stat updates
      - Added --enable-modules to Travis, in preparation for switching
        the default

      # gpg: Signature made Mon 26 Jan 2015 11:44:40 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        kvm_stat: Add RESET support for perf event ioctl
        target-i386: Disable HLE and RTM on Haswell & Broadwell
        sparse: Fix build with sparse on .S files
        exec: fix madvise of NULL pointer
        .travis.yml: Add "--enable-modules"
        apic: do not dereference pointer before it is checked for NULL
        kvm_stat: Print errno when syscall to perf_event_open() fails
        kvm_stat: Update exit reasons to the latest defintion
        kvm_stat: Add aarch64 support
        hw: misc, add educational driver
        vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*
        qemu-timer: introduce timer_deinit
        qemu-timer: add timer_init and timer_init_ns/us/ms
        target-i386: make xmm_regs 512-bit wide
        target-i386: use vmstate_offset_sub_array for AVX registers
        tests/multiboot: Add test for modules
        multiboot: Fix offset of bootloader name
        tests/multiboot: Update reference output
        pc: fix KVM features in pc-1.3 and earlier machine types

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fc116efad0aadb2f8a49d51240bddbfe21b631a0
  Author: Wei Huang <wei@redhat.com>
  Date:   Fri Jan 23 15:56:04 2015 -0500

      kvm_stat: Add RESET support for perf event ioctl

      While running kvm_stat using tracepoint on ARM64 hardware (e.g. "kvm_stat
      -1 -t"), the initial values of some kvm_userspace_exit counters were found
      to be very suspecious. For instance the tracing tool showed that S390_TSCH
      was called many times on ARM64 machine, which apparently was wrong.

      This patch adds RESET ioctl support for perf monitoring. Before calling
      ioctl to enable a perf event, this patch resets the counter first. With
      this patch, the init counter values become correct on ARM64 hardware.

      Example:

      ==== before patch ====
      kvm_userspace_exit(S390_SIEIC)      1426         0
      kvm_userspace_exit(S390_TSCH)       339         0

      ==== after patch ====
      kvm_userspace_exit(S390_SIEIC)         0         0
      kvm_userspace_exit(S390_TSCH)         0         0

      Signed-off-by: Wei Huang <wei@redhat.com>

  commit 13704e4c455770d500d6b87b117e32f0d01252c9
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Thu Jan 22 17:22:54 2015 -0200

      target-i386: Disable HLE and RTM on Haswell & Broadwell

      All Haswell CPUs and some Broadwell CPUs were updated by Intel to have
      the HLE and RTM features disabled. This will prevent
      "-cpu Haswell,enforce" and "-cpu Broadwell,enforce" from running out of
      the box on those CPUs.

      Disable those features by default on Broadwell and Haswell CPU models,
      starting on pc-*-2.3. Users who want to use those features can enable
      them explicitly on the command-line.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 80fd48df4a53d01cc5d8a41e565f81af5978121f
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Jan 22 10:53:46 2015 +0100

      sparse: Fix build with sparse on .S files

      rules.mak has a rule for .S files using CPP. This will result in
      errors like
        CPP   s390-ccw/start.asm
       cc: error: unrecognized command line option '-Wbitwise'

      Lets also redefine CPP in case of --enable-sparse.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a904c91196a9c5dbd7b9abcd3d40b0824286fb1c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 21 16:18:35 2015 +0100

      exec: fix madvise of NULL pointer

      Coverity flags this as "dereference after null check".  Not quite a
      dereference, since it will just EFAULT, but still nice to fix.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit dd858343a73c5c47019c6ade282a91681e0d7105
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jan 23 10:43:49 2015 +0100

      .travis.yml: Add "--enable-modules"

      We will change the default to "--enable-modules", let's cover it before
      the switch.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 927411fa42c5fcf16ed0fcc0447d5ee8c83b22ca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 11:07:09 2015 +0100

      apic: do not dereference pointer before it is checked for NULL

      Right now you only get to apic_init_reset if you have an APIC
      (do_cpu_init is reached only if CPU_INTERRUPT_INIT is set and
      that only happens in hw/intc/apic.c).  However, this is wrong
      because for example a port 92 or keyboard controller reset is
      really an INIT, and that can happen also with no APIC.  So
      keep the check and fix the error that Coverity reported.

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 874b1cfad51e325d535f99261f91c92df444c18c
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:31 2015 -0500

      kvm_stat: Print errno when syscall to perf_event_open() fails

      kvm_stat uses syscall() to call perf_event_open(). If this function
      call fails, the returned value is -1, which doesn't tell the details
      of such failure (i.e. ENOSYS or EINVAL). This patch retrieves errno
      and prints it when syscall() fails. The error message will look like
      "Exception: perf_event_open failed, errno = 38".

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2c9d535a2e43699de32987b76cf548a39e4d04d2
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:30 2015 -0500

      kvm_stat: Update exit reasons to the latest defintion

      This patch updates the exit reasons for x86_vmx, x86_svm, and userspace
      to the latest definition.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit edcbc401f42077f9d62713d439839201a73a5966
  Author: Wei Huang <wei@redhat.com>
  Date:   Wed Jan 21 16:15:29 2015 -0500

      kvm_stat: Add aarch64 support

      This patch enables aarch64 support for kvm_stat. The platform detection
      is based on OS uname.

      Signed-off-by: Wei Huang <wei@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b30934cb52a72a763da21dccc9994c64517d6f25
  Author: Jiri Slaby <jslaby@suse.cz>
  Date:   Wed Jan 21 17:48:33 2015 +0100

      hw: misc, add educational driver

      I am using qemu for teaching the Linux kernel at our university. I
      wrote a simple PCI device that can answer to writes/reads, generate
      interrupts and perform DMA. As I am dragging it locally over 2 years,
      I am sending it to you now.

      Signed-off-by: Jiri Slaby <jslaby@suse.cz>
      [Fix 32-bit compilation. - Paolo]
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e720677e32e70b1f60637ebbcf2ffb23a4607f3e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Jan 8 10:18:59 2015 +0100

      vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*

      Old users of VMSTATE_TIMER* are mechanically changed to VMSTATE_TIMER_PTR
      variants.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd1bd53a669c88f219ca47b538889cd918605fea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 24 10:57:04 2014 +0100

      qemu-timer: introduce timer_deinit

      In some cases, a timer was set to NULL so that we could check if it is
      initialized.  Use the timer_list field instead, and add a timer_deinit
      function that NULLs it.

      It then makes sense that timer_del be a no-op (instead of a crasher) on
      such a de-initialized timer.  It avoids the need to poke at the timerlist
      field to check if the timers are initialized.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 65a81af8df722714298f17d2b40da8e5f045e059
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 21:40:55 2014 +0100

      qemu-timer: add timer_init and timer_init_ns/us/ms

      These functions for the main loop TimerListGroup will replace
      timer_new and timer_new_ns/us/ms.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b7711471f551aa4419f9d46a11121f48ced422da
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 09:50:21 2014 +0200

      target-i386: make xmm_regs 512-bit wide

      Right now, the AVX512 registers are split in many different fields:
      xmm_regs for the low 128 bits of the first 16 registers, ymmh_regs
      for the next 128 bits of the same first 16 registers, zmmh_regs
      for the next 256 bits of the same first 16 registers, and finally
      hi16_zmm_regs for the full 512 bits of the second 16 bit registers.

      This makes it simple to move data in and out of the xsave region,
      but would be a nightmare for a hypothetical TCG implementation and
      leads to a proliferation of [XYZ]MM_[BWLSQD] macros.  Instead,
      this patch marshals data manually from the xsave region to a single
      32x512-bit array, simplifying the macro jungle and clarifying which
      bits are in which vmstate subsection.

      The migration format is unaffected.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a03c3e90e11976fb147904d537457984bb938ce2
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 10:18:38 2014 +0200

      target-i386: use vmstate_offset_sub_array for AVX registers

      After the next patch, each vmstate field will extract parts of a larger
      (32x512-bit) array, so we cannot check the vmstate field against the
      type of the array.

      While changing this, change the macros to accept the index of the first
      element (which will not be 0 for Hi16_ZMM_REGS) instead of the number
      of elements (which is always CPU_NB_REGS).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit a9c837d8ef573604328e4cb61e2e0cab61bba319
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:44 2015 +0100

      tests/multiboot: Add test for modules

      This test case is meant to detect corruptions of the Multiboot modules
      as well as the multiboot modules list and the module command lines.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4168498f613db3d908909106146001a9279e732
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:43 2015 +0100

      multiboot: Fix offset of bootloader name

      This fixes a bug introduced in commit 5eba5a66 ('Add bootloader name to
      multiboot implementation').

      The calculation of the bootloader name offset didn't consider space
      occupied by module command lines, so some unlucky module got its command
      line partially overwritten with a "qemu" string.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 43bfb507f422a642ea2893555e13ccc2557d810a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Jan 15 12:26:42 2015 +0100

      tests/multiboot: Update reference output

      The changes look okay (larger PCI hole, some rounding differences), so
      just update the reference output of the test case.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0034a0f239623388525c884dabf9a125eafb1acb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 17:53:55 2015 +0100

      pc: fix KVM features in pc-1.3 and earlier machine types

      Due to a typo, instead of disabling KVM_FEATURE_PV_EOI (bit
      6) these machine types are disabling bits 1 and 2, which are
      KVM_FEATURE_NOP_IO_DELAY and KVM_FEATURE_MMU_OP.  Not a big deal
      because they aren't very important and KVM_FEATURE_MMU_OP is
      disabled anyway.  The worst part is actually that KVM_FEATURE_PV_EOI
      is remaining enabled.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d109f80af3ad5c64c8c30e7ab21f2e342b5e9a8d
  Merge: a46b3aa bc63781
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 23 18:25:30 2015 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Fri 23 Jan 2015 17:53:06 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream:
        iotests: Lower 064's memory usage
        block: vhdx - force FileOffsetMB field to '0' for certain block states
        block: update string sizes for filename,backing_file,exact_filename
        block: mirror - change string allocation to 2-bytes
        block: remove unused variable in bdrv_commit
        block: qapi - move string allocation from stack to the heap
        block: vmdk - move string allocations from stack to the heap
        block: vmdk - make ret variable usage clear
        iotests: Add tests for more corruption cases
        qcow2: Add two more unalignment checks
        virtio-blk: Use blk_aio_ioctl
        virtio-blk: Pass req to virtio_blk_handle_scsi_req

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit bc63781ca350cad4c9eb142ce8f55bfaded4276e
  Merge: 9a29e18 e35053b
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Fri Jan 23 18:51:47 2015 +0100

      Merge remote-tracking branch 'mreitz/block' into queue-block

      * mreitz/block:
        iotests: Lower 064's memory usage
        block: vhdx - force FileOffsetMB field to '0' for certain block states

  commit e35053b25aeeef5c67b38603e4ded526c2229371
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Jan 23 09:59:45 2015 -0500

      iotests: Lower 064's memory usage

      Test 064 reads a lot of data at once which currently results in qemu-io
      having to allocate up to about 1 GB of memory (958 MB, to be exact).
      This patch lowers that amount to 128 MB by making the test read smaller
      chunks.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Jeff Cody <jcody@redhat.com>
      Message-id: 1422025185-25229-1-git-send-email-mreitz@redhat.com

  commit cdf9634bdf76c8f59d9f7a04df30fa26d8e93d96
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Tue Jan 20 16:01:43 2015 -0500

      block: vhdx - force FileOffsetMB field to '0' for certain block states

      The v1.0.0 spec calls out PAYLOAD_BLOCK_ZERO FileOffsetMB field as being
      'reserved'.  In practice, this means that Hyper-V will fail to read a
      disk image with PAYLOAD_BLOCK_ZERO block states with a FileOffsetMB
      value other than 0.

      The other states that indicate a block that is not there
      (PAYLOAD_BLOCK_UNDEFINED, PAYLOAD_BLOCK_NOT_PRESENT,
       PAYLOAD_BLOCK_UNMAPPED) have multiple options for what FileOffsetMB may
      be set to, and '0' is explicitly called out as an option.

      For all the above states, we will also just set the FileOffsetMB value
      to 0.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: a9fe92f53f07e6ab1693811e4312c0d1e958500b.1421787566.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 9a29e18f7dfd5a0e80d1c60fc856ebba18ddb738
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:30 2015 -0500

      block: update string sizes for filename,backing_file,exact_filename

      The string field entries 'filename', 'backing_file', and
      'exact_filename' in the BlockDriverState struct are defined as 1024
      bytes.

      However, many places that use these values accept a maximum of PATH_MAX
      bytes, so we have a mixture of 1024 byte and PATH_MAX byte allocations.
      This patch makes the BlockDriverStruct field string sizes match usage.

      This patch also does a few fixes related to the size that needs to
      happen now:

          * the block qapi driver is updated to use PATH_MAX bytes
          * the qcow and qcow2 drivers have an additional safety check
          * the block vvfat driver is updated to use PATH_MAX bytes
            for the size of backing_file, for systems where PATH_MAX is < 1024
            bytes.
          * qemu-img uses PATH_MAX rather than 1024.  These instances were not
            changed to be dynamically allocated, however, as the extra
            temporary 3K in stack usage for qemu-img does not seem worrisome.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1d33936ea847693a6d69f9049691a0341d6e0b9f
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:29 2015 -0500

      block: mirror - change string allocation to 2-bytes

      The backing_filename string in mirror_run() is only used to check
      for a NULL string, so we don't need to allocate 1024 bytes (or, later,
      PATH_MAX bytes), when we only need to copy the first 2 characters.

      We technically only need 1 byte, as we are just checking for NULL, but
      since backing_filename[] is populated by bdrv_get_backing_filename(), a
      string size of 1 will always only return '\0';

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a1a11d10abfff6638479b7510ee1df4f737d89d6
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:28 2015 -0500

      block: remove unused variable in bdrv_commit

      As Stefan pointed out, the variable 'filename' in bdrv_commit is unused,
      despite being maintained in previous patches.

      With this patch, get rid of the variable for good.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 564d64bdde8e0a6b732a56fa41670e73b19ee062
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:27 2015 -0500

      block: qapi - move string allocation from stack to the heap

      Rather than declaring 'backing_filename2' on the stack in
      bdrv_query_image_info(), dynamically allocate it on the heap.

      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fe2065629a9c256f836770ca54449ae77b22d188
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:26 2015 -0500

      block: vmdk - move string allocations from stack to the heap

      Functions 'vmdk_parse_extents' and 'vmdk_create' allocate several
      PATH_MAX sized arrays on the stack.  Make these dynamically allocated.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 395a22fae064df64d987d703cf70ae0f57306be8
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Thu Jan 22 08:03:25 2015 -0500

      block: vmdk - make ret variable usage clear

      Keep the variable 'ret' something that is returned by the function it is
      defined in.  For the return value of 'sscanf', use a more meaningful
      variable name.

      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f30136b35a271109b89353b9a5349cf32e6aeda7
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 19 15:49:04 2015 -0500

      iotests: Add tests for more corruption cases

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8dd93d9339505376f6ce6737ead871ff6d7e676f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Jan 19 15:49:03 2015 -0500

      qcow2: Add two more unalignment checks

      This adds checks for unaligned L2 table offsets and unaligned data
      cluster offsets (actually the preallocated offsets for zero clusters) to
      the zero cluster expansion function.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1dc936aa84b300940b2797c391cc3ca519bc78ce
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 20 11:28:47 2015 +0800

      virtio-blk: Use blk_aio_ioctl

      Use the asynchronous interface of ioctl. This will not make the VM
      unresponsive if the ioctl takes a long time.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 75344fa4c5d6a3ebe2dec2d87cbea8524f5d0f42
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Jan 20 11:28:46 2015 +0800

      virtio-blk: Pass req to virtio_blk_handle_scsi_req

      In preparation for calling blk_aio_ioctl. Also make the function static
      as no other files need it.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a46b3aaf6bb038d4f6f192a84df204f10929e75c
  Merge: c644145 4b45b05
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 23 13:24:17 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150123' into staging

      seccomp branch queue

      # gpg: Signature made Fri 23 Jan 2015 13:11:05 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150123:
        seccomp: add mlockall to whitelist

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4b45b055491a319292beefb8080a81d96cf55cf6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 14:32:33 2015 +0100

      seccomp: add mlockall to whitelist

      This is used by "-realtime mlock=on".

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit c6441452b50c44fdbb362b239ce623f77cf3cd51
  Merge: 8f970ef 9939375
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 18:57:36 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-20150122-1' into staging

      b16: fix interrupt acknowledgement

      # gpg: Signature made Thu 22 Jan 2015 11:38:29 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-audio-20150122-1:
        sb16: fix interrupt acknowledgement

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8f970eff6e318524f189f105c236e47633759890
  Merge: adeecf1 0ee4de5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 17:41:59 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150122-1' into staging

      input: misc fixes.

      # gpg: Signature made Thu 22 Jan 2015 11:27:37 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-input-20150122-1:
        hw/input/hid.c Fix capslock hid code
        hid: handle full ptr queues in post_load
        input: improve docs for input-send-event qmp command

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adeecf14d668f5f0a73c9be91772e15b4f8727f3
  Merge: b3a4755 51a0909
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 13:56:11 2015 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150122-1' into staging

      spice: fix coverity defect, add unix address support

      # gpg: Signature made Thu 22 Jan 2015 11:17:24 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20150122-1:
        spice: fix coverity reported defect in display code
        spice: add unix address support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b3a4755a67a52aa7297eb8927b482d09dabdefec
  Merge: a805ca5 4478aa7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 12:14:19 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150122-1' into staging

      vnc: add support for multiple vnc displays

      # gpg: Signature made Thu 22 Jan 2015 11:00:54 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20150122-1:
        monitor: add vnc websockets
        monitor: add query-vnc-servers command
        vnc: factor out qmp_query_client_list
        vnc: track & limit connections
        vnc: update docs/multiseat.txt
        vnc: allow binding servers to qemu consoles
        vnc: switch to QemuOpts, allow multiple servers
        vnc: add display id to acl names
        vnc: remove unused DisplayState parameter, add id instead.
        vnc: remove vnc_display global

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0ee4de5840ccc1072459ec68062bfb63c888a94d
  Author: Dinar Valeev <dvaleev@suse.com>
  Date:   Wed Jan 21 23:48:41 2015 +0100

      hw/input/hid.c Fix capslock hid code

      When ever USB keyboard is used, e.g. '-usbdevice keyboard' pressing
      caps lock key send 0x32 hid code, which is treated as backslash.
      Instead it should be 0x39 code. This affects sending uppercase keys,
      as they typed whith caps lock active.

      While on x86 this can be workarounded by using ps/2 protocol. On
      Power it is crusial as we don't have anything else than USB.

      This is fixes guest automation tasts over vnc.

      Signed-off-by: Dinar Valeev <dvaleev@suse.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit ba4d26064e8c42711a1a6eb287cedac75deb1478
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Nov 27 10:02:35 2014 +0100

      hid: handle full ptr queues in post_load

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Tested-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 4083ae311d51edf93e2e163f4af2b22a1d0952cc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Nov 21 10:25:57 2014 +0100

      input: improve docs for input-send-event qmp command

      Text partly suggested by Markus Armbruster <armbru@redhat.com>

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a805ca54015bd123e2bc2454ec59619d0ed106c2
  Merge: 699eae1 7230818
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 22 11:16:20 2015 +0000

      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

      qemu-sparc update

      # gpg: Signature made Wed 21 Jan 2015 16:56:31 GMT using RSA key ID AE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

      * remotes/mcayland/tags/qemu-sparc-signed:
        disas/sparc: Remove unused data sparc_opcode_archs[]
        target-sparc: Mark gen_load_trap_state_at_tl() as !CONFIG_USER_ONLY
        target-sparc: is_translating_asi() is TARGET_SPARC64 only
        target-sparc: address_mask(), asi_address_mask() are TARGET_SPARC64 only
        target-sparc: Remove unused gen_op_subi_cc and gen_op_addi_cc

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4478aa768ccefcc5b234c23d035435fd71b932f6
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 10 09:49:39 2014 +0100

      monitor: add vnc websockets

      Add websockets bool to VncBasicInfo, report websocket server sockets,
      flag websocket client connections.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit df887684603a4b3b0c623090a6b419dc70f22c32
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 17 15:49:44 2014 +0100

      monitor: add query-vnc-servers command

      Add new query vnc qmp command, for the lack of better ideas just name it
      "query-vnc-servers".  Changes over query-vnc:

       * It returns a list of vnc servers, so multiple vnc server instances
         are covered.
       * Each vnc server returns a list of server sockets.  Followup patch
         will use that to also report websockets.  In case we add support for
         multiple server sockets server sockets (to better support ipv4+ipv6
         dualstack) we can add them to the list too.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 2d29a4368c3c00a5cf200f29b3dfd32bc4fb2c31
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Dec 9 15:27:39 2014 +0100

      vnc: factor out qmp_query_client_list

      so we can reuse it for the new vnc query command.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e5f34cdd2da54f28d90889a3afd15fad2d6105ff
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 2 12:09:34 2014 +0200

      vnc: track & limit connections

      Also track the number of connections in "connecting" and "shared" state
      (in addition to the "exclusive" state).  Apply a configurable limit to
      these connections.

      The logic to apply the limit to connections in "shared" state is pretty
      simple:  When the limit is reached no new connections are allowed.

      The logic to apply the limit to connections in "connecting" state (this
      is the state you are in *before* successful authentication) is
      slightly different:  A new connect kicks out the oldest client which is
      still in "connecting" state.  This avoids a easy DoS by unauthenticated
      users by simply opening connections until the limit is reached.

      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 86fdcf23f4a9d8473844734907555b3a93ed686c
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 2 15:53:37 2014 +0200

      vnc: update docs/multiseat.txt

      vnc joins the party ;)
      Also some s/head/seat/ to clarify.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1d0d59fe291967533f974e82213656d479475a1e
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Sep 18 12:54:49 2014 +0200

      vnc: allow binding servers to qemu consoles

      This patch adds a display= parameter to the vnc options.  This allows to
      bind a vnc server instance to a specific display, allowing to create a
      multiseat setup with a vnc server for each seat.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 4db14629c38611061fc19ec6927405923de84f08
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Sep 16 12:33:03 2014 +0200

      vnc: switch to QemuOpts, allow multiple servers

      This patch switches vnc over to QemuOpts, and it (more or less
      as side effect) allows multiple vnc server instances.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit c8496408b443a2a34dd03ad4274c2575248aa3e8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Oct 21 14:50:42 2014 +0200

      vnc: add display id to acl names

      In case the display id is "default" (which is the one you get if you
      don't explicitly assign one) we keep the old name scheme, without
      display, for backward compatibility reasons.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 14f7143ede7c601cce02ce0f8c7f01c41148128b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 29 12:24:55 2014 +0200

      vnc: remove unused DisplayState parameter, add id instead.

      DisplayState isn't used anywhere, drop it.  Add the vnc server ID as
      parameter instead, so it is possible to specify the server instance.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit d616ccc5dd771024e04b9b15d7ca30bc7fe8fce3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Jul 29 12:14:08 2014 +0200

      vnc: remove vnc_display global

      Replace with a vnc_displays list, so we can have multiple vnc server
      instances.  Add vnc_server_find function to lookup a display by id.
      With no id supplied return the first vnc server, for backward
      compatibility reasons.

      It is not possible (yet) to actually create multiple vnc server
      instances.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>

  commit 51a090991449c7d3c6d428eda18b4f30a36e2c1b
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Jan 15 12:06:16 2015 +0100

      spice: fix coverity reported defect in display code

      Report:

      1. Condition surface, taking false branch
      406    if (surface && ssd->surface &&
      407        surface_width(surface) == pixman_image_get_width(ssd->surface) &&
      408        surface_height(surface) == pixman_image_get_height(ssd->surface)) {
      409        /* no-resize fast path: just swap backing store */
      ...

      10. alias_transfer: Assigning: ssd->ds = surface.
      440    ssd->ds = surface;

      11. var_deref_op: Dereferencing null pointer ssd->ds.
      CID 1264334 (#1 of 1): Dereference after null check (FORWARD_NULL)
      441    ssd->surface = pixman_image_ref(ssd->ds->image);

      Fix:

      Move code block dereferencing ssd->ds into the already existing
      if (ssd->ds) { ... } block.

      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fe4831b1e7e7007ae15ae0470a06898660ab3877
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Jan 13 17:57:51 2015 +0100

      spice: add unix address support

      Teach qemu to set up a Spice server with a UNIX socket using the
      following arguments -spice unix,addr=path.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 9939375c282a0f97afa69dc6799d3c77aaf7d544
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Jan 20 17:23:48 2015 +0100

      sb16: fix interrupt acknowledgement

      SoundBlaster 16 emulation is very broken and consumes a lot of CPU, but a
      small fix was suggested offlist and it is enough to fix some games.  I
      got Epic Pinball to work with the "SoundBlaster Clone" option.

      The processing of the interrupt register is wrong due to two missing
      "not"s.  This causes the interrupt flag to remain set even after the
      Acknowledge ports have been read (0x0e and 0x0f).

      The line was introduced by commit 85571bc (audio merge (malc), 2004-11-07),
      but the code might have been broken before because I did not look closely
      at the huge patches from 10 years ago.

      Reported-by: Joshua Bair <j_bair@bellsouth.net>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7230818a2b54df826e5ecdd83bd20632c9a8b07c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:21 2014 +0000

      disas/sparc: Remove unused data sparc_opcode_archs[]

      Remove sparc_opcode_archs and the macros which use it, because we don't
      use them in QEMU and they provoke clang warnings:

      disas/sparc.c:307:39: warning: unused variable 'sparc_opcode_archs' [-Wunused-const-variable]
      static const struct sparc_opcode_arch sparc_opcode_archs[] =
                                            ^

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit a2035e83fd60e5b66644d321816ed634b908b4ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:20 2014 +0000

      target-sparc: Mark gen_load_trap_state_at_tl() as !CONFIG_USER_ONLY

      The function gen_load_trap_state_at_tl() is only used in the softmmu
      configs; wrap it in #ifndef CONFIG_USER_ONLY to avoid clang compiler
      warnings in linux-user builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 69694625e86aebb135b56c4aaafefd5c1d17bb3c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:19 2014 +0000

      target-sparc: is_translating_asi() is TARGET_SPARC64 only

      Move the is_translating_asi() inside the TARGET_SPARC64 ifdef (and remove
      the unimplemented 32-bit codepath), as it is only called from TARGET_SPARC64
      code. This fixes a clang 3.4 unused-function warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit e60538c79fc7285e72f5b431281986737db1607b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:18 2014 +0000

      target-sparc: address_mask(), asi_address_mask() are TARGET_SPARC64 only

      The address_mask() and asi_address_mask() functions are only used in
      TARGET_SPARC64 configs, so guard with ifdefs to avoid warnings about
      unused functions in 32-bit builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 622302901065ebcb21201310d34b22d107fe851e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:11:17 2014 +0000

      target-sparc: Remove unused gen_op_subi_cc and gen_op_addi_cc

      The functions gen_op_addi_cc() and gen_op_subi_cc() are unused; remove them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

  commit 699eae17b841e6784dc3864bf357e26bff1e9dfe
  Merge: a5bd447 de5ee4a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 16:19:58 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-misc-20150120' into staging

      Miscellaneous cross-tree patches:
       * load/store helper cleanup
       * drop TARGET_HAS_ICE define and checks
       * scripts/qapi-types.py: Add dummy member to empty structs
       * cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined

      # gpg: Signature made Tue 20 Jan 2015 15:43:38 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-misc-20150120:
        cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined
        cpu_ldst.h, cpu-all.h, bswap.h: Update documentation on ld/st accessors
        cpu_ldst_template.h: Drop unused cpu_ldfq/stfq/ldfl/stfl accessors
        cpu_ldst.h: Drop unused _raw macros, saddr() and laddr()
        cpu_ldst_template.h: Use ld*_p directly rather than via ld*_raw macros
        cpu_ldst.h: Use inline functions for usermode cpu_ld/st accessors
        cpu_ldst.h: Remove unused very short ld*/st* defines
        cpu_ldst.h: Drop unused ld/st*_kernel defines
        target-mips: Don't use _raw load/store accessors
        linux-user/main.c (m68k): Use get_user_u16 rather than lduw in cpu_loop
        linux-user/vm86.c: Use cpu_ldl_data &c rather than plain ldl &c
        bsd-user/elfload.c: Don't use ldl() or ldq_raw()
        linux-user/elfload.c: Don't use _raw accessor functions
        target-sparc: Don't use {ld, st}*_raw functions
        monitor.c: Use ld*_p() instead of ld*_raw()
        cpu_ldst.h: Remove unused ldul_ macros
        exec.c: Drop TARGET_HAS_ICE define and checks
        scripts/qapi-types.py: Add dummy member to empty structs

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de5ee4a888667ca0a198f0743d70075d70564117
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:35 2015 +0000

      cpu_ldst.h: Don't define helpers if MMU_MODE*_SUFFIX not defined

      Not all targets define a full set of suffix strings for the
      NB_MMU_MODES that they have. In this situation, don't define any
      helper functions for that mode, rather than defining helper functions
      with no suffix at all. The MMU mode is still functional; it is merely
      not directly accessible via cpu_ld*_MODE from target helper functions.

      Also add an "NB_MMU_MODES >= 2" check to the definition of the mode 1
      helpers -- some targets only define one MMU mode.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1421432008-6786-1-git-send-email-peter.maydell@linaro.org

  commit db5fd8d709fd57f4d4f11edfca9f421f657f4508
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:35 2015 +0000

      cpu_ldst.h, cpu-all.h, bswap.h: Update documentation on ld/st accessors

      Add documentation of what the cpu_*_* accessors look like.
      Correct some minor errors in the existing documentation of the
      direct _p accessor family. Remove the near-duplicate comment
      on the _p accessors from cpu-all.h and replace it with a reference
      to the comment in bswap.h.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-16-git-send-email-peter.maydell@linaro.org

  commit 82f11917c99e3c7fa3d6aa98572ecc98c7324c2f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst_template.h: Drop unused cpu_ldfq/stfq/ldfl/stfl accessors

      The cpu_ldfq/stfq/ldfl/stfl accessors for loading and storing
      float32 and float64 are completely unused, so delete them.
      (The union they use for converting from the float32/float64
      type to uint32_t or uint64_t is the wrong way to do it anyway:
      they should be using make_float* and float*_val.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-15-git-send-email-peter.maydell@linaro.org

  commit 800e2ecc896beb6b79e7333c762da163b6a9135a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Drop unused _raw macros, saddr() and laddr()

      The _raw macros and their helpers saddr() and laddr() are now
      totally unused -- delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-14-git-send-email-peter.maydell@linaro.org

  commit 355392329e4a843580e53cb027ed85e0cbebb640
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst_template.h: Use ld*_p directly rather than via ld*_raw macros

      The ld*_raw and st*_raw macros are now only used within the code
      produced by cpu_ldst_template.h, and only in three places.
      Expand these out to just call the ld_p and st_p functions directly.

      Note that in all the callsites the address argument is a uintptr_t,
      so we can drop that part of the double-cast used in the saddr() and
      laddr() macros.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-13-git-send-email-peter.maydell@linaro.org

  commit 9220fe54c679d145232a28df6255e166ebf91bab
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Use inline functions for usermode cpu_ld/st accessors

      Use inline functions rather than macros for cpu_ld/st accessors
      for the *-user configurations, as we already do for softmmu.
      This has a two advantages:
       * we can actually typecheck our arguments
       * we don't need to leak the _raw macros everywhere

      Since the _kernel functions were only used by target-i386/seg_helper.c,
      put the definitions for them in that file too. (It already has the
      similar template include code to define them for the softmmu case,
      so it makes sense to have it deal with defining them for user-only.)

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-12-git-send-email-peter.maydell@linaro.org

  commit 177ea79f65c90b3bc84d59565b7519e47ea02f63
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Remove unused very short ld*/st* defines

      The very short ld*/st* defines are now not used anywhere; delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-11-git-send-email-peter.maydell@linaro.org

  commit 5a0826f7d2f9bea6e02157985b103d0a4c458aaa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:34 2015 +0000

      cpu_ldst.h: Drop unused ld/st*_kernel defines

      The ld*_kernel and st*_kernel defines are not used anywhere;
      delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-10-git-send-email-peter.maydell@linaro.org

  commit 15353001197c413f3ddebd51152a514dce08c458
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      target-mips: Don't use _raw load/store accessors

      Use cpu_*_data instead of the direct *_raw load/store accessors.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-9-git-send-email-peter.maydell@linaro.org

  commit d8d5119cae38da090b7a76f22cecc8088691ab49
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/main.c (m68k): Use get_user_u16 rather than lduw in cpu_loop

      In the m68k cpu_loop() use get_user_u16 to read the immediate for
      the simcall rahter than lduw, to bring it into line with how other
      archs do it and to remove another user of the ldl family of functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-8-git-send-email-peter.maydell@linaro.org

  commit 5899d6d0b4cae1a0ff7487b635eee4d9db1a2a7c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/vm86.c: Use cpu_ldl_data &c rather than plain ldl &c

      Use the cpu_ld*_data and cpu_st*_data family of functions to access
      guest memory in vm86.c rather than the very short-named ldl/stl functions.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-7-git-send-email-peter.maydell@linaro.org

  commit b8d6ac9f90d047cbc8e06366ae33b71ea9c5232c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      bsd-user/elfload.c: Don't use ldl() or ldq_raw()

      Use get_user_u64() and get_user_ual() instead of the ldl() and
      ldq_raw() functions.

      [Note that this change is not compile tested as it is actually
      in dead code -- none of the bsd-user configurations are PPC.]

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-6-git-send-email-peter.maydell@linaro.org

  commit 2ccf97ec0f1b7a62a3220064f305454f3932c55a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:33 2015 +0000

      linux-user/elfload.c: Don't use _raw accessor functions

      The _raw accessor functions are an implementation detail that has
      leaked out to some callsites. Use get_user_u64() instead of ldq_raw().

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-5-git-send-email-peter.maydell@linaro.org

  commit eb513f82f04fab442cdef9db698dafc852275f7f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      target-sparc: Don't use {ld, st}*_raw functions

      Instead of using the _raw family of ld/st accessor functions, use
      cpu_*_data. All this code is CONFIG_USER_ONLY, so the two are the
      same semantically, but the _raw functions are really a detail of
      the implementation which has leaked into a few callsites like this one.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-4-git-send-email-peter.maydell@linaro.org

  commit 24e60305c5839eccf4b915411215b412fb34c52b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      monitor.c: Use ld*_p() instead of ld*_raw()

      The monitor code for doing a memory_dump() was using ld*_raw() to do
      target-CPU accesses out of a local buf[] array. The correct functions
      for this purpose are ld*_p(), which take a host pointer, rather than
      ld*_raw(), which take an integer representing a guest address and
      are somewhat meaningless in softmmu configurations. Nobody noticed
      because for softmmu the _raw functions are the same as ldl_p but
      with some extra casts thrown in. Switch to using the correct functions
      instead.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Message-id: 1421334118-3287-3-git-send-email-peter.maydell@linaro.org

  commit 0c021c1fd2c4ec3c68c59232ccee012c067bc682
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      cpu_ldst.h: Remove unused ldul_ macros

      The five ldul_ macros are not used anywhere and are marked up with an XXX
      comment. "ldul" is a non-standard prefix for our family of load instructions:
      we don't mark 32-bit accesses for signedness because they return a 32 bit
      quantity. So just delete them.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1421334118-3287-2-git-send-email-peter.maydell@linaro.org

  commit ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      exec.c: Drop TARGET_HAS_ICE define and checks

      The TARGET_HAS_ICE #define is intended to indicate whether a target-*
      guest CPU implementation supports the breakpoint handling. However,
      all our guest CPUs have that support (the only two which do not
      define TARGET_HAS_ICE are unicore32 and openrisc, and in both those
      cases the bp support is present and the lack of the #define is just
      a bug). So remove the #define entirely: all new guest CPU support
      should include breakpoint handling as part of the basic implementation.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1420484960-32365-1-git-send-email-peter.maydell@linaro.org

  commit 83ecb22ba2c91a4674ae109595a8ed1da8de4d7a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 15:19:32 2015 +0000

      scripts/qapi-types.py: Add dummy member to empty structs

      Make sure that all generated C structs have at least one field; this
      avoids potential issues with attempting to malloc space for
      zero-length structs in C (g_malloc(sizeof struct) would return NULL).
      It also avoids an incompatibility with C++ (where an empty struct is
      size 1); that isn't important to us now but might be in future.

      Generated empty structures look like this:
          struct Abort
          {
              char qapi_dummy_field_for_empty_struct;
          };

      This silences clang warnings like:
      ./qapi-types.h:3752:1: warning: empty struct has size 0 in C, size 1 in C++ [-Wextern-c-compat]
      struct Abort
      ^

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1419359069-16611-1-git-send-email-peter.maydell@linaro.org

  commit a5bd4470ed34b7cf49bda7ea3dcad3a269c99ada
  Merge: 74acb99 86a6a9b
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 20 14:34:38 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-20-v2' into staging

      * remotes/sstabellini/xen-2015-01-20-v2:
        xen: add a lock for the mapcache
        xen: do not use __-named variables in mapcache
        Xen: Use the ioreq-server API when available
        Add device listener interface

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86a6a9bf551ffa183880480b37c5836d3916687a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 11:20:56 2015 +0100

      xen: add a lock for the mapcache

      Extend the existing dummy mapcache_lock/unlock macros to cover all of
      xen-mapcache.c.  This prepares for unlocked memory access, when parts
      of exec.c will not be protected by the BQL.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 9b6d7b365dc211bbeadb0cf2e7bf1a019001c7f8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 14 11:20:55 2015 +0100

      xen: do not use __-named variables in mapcache

      Keep the namespace clean.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 3996e85c1822e05c50250f8d2d1e57b6bea1229d
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jan 20 11:06:19 2015 +0000

      Xen: Use the ioreq-server API when available

      The ioreq-server API added to Xen 4.5 offers better security than
      the existing Xen/QEMU interface because the shared pages that are
      used to pass emulation request/results back and forth are removed
      from the guest's memory space before any requests are serviced.
      This prevents the guest from mapping these pages (they are in a
      well known location) and attempting to attack QEMU by synthesizing
      its own request structures. Hence, this patch modifies configure
      to detect whether the API is available, and adds the necessary
      code to use the API if it is.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

  commit 707ff80021ccd7a68f4b3d2c44eebf87efbb41c4
  Author: Paul Durrant <paul.durrant@citrix.com>
  Date:   Tue Jan 20 11:05:07 2015 +0000

      Add device listener interface

      The Xen ioreq-server API, introduced in Xen 4.5, requires that PCI device
      models explicitly register with Xen for config space accesses. This patch
      adds a listener interface into qdev-core which can be used by the Xen
      interface code to monitor for arrival and departure of PCI devices.

      Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 74acb99737dbedd86654d660c0c20815139a873c
  Merge: 1e42c35 877417d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 19 13:37:05 2015 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20150119-1' into staging

      ui: add shared surface format negotiation.

      # gpg: Signature made Mon 19 Jan 2015 12:47:36 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-console-20150119-1:
        ui/sdl2: Support shared surface for more pixman formats
        ui/sdl: Support shared surface for more pixman formats
        ui/gtk: Support shared surface for most pixman formats
        ui/spice: Support shared surface for most pixman formats
        ui/vnc: Support shared surface for most pixman formats
        ui/pixman: add qemu_pixman_check_format
        ui: Add dpy_gfx_check_format() to check backend shared surface support
        ui: Make qemu_default_pixman_format() return 0 on unsupported formats

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 877417d9ae6846bea4744b198131a5fe5117d7a5
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 09:27:09 2015 +0100

      ui/sdl2: Support shared surface for more pixman formats

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 7dd93291cad743e83e972a323a5775ff5a954bd5
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:24:42 2014 +1000

      ui/sdl: Support shared surface for more pixman formats

      At least all the ones I've tested. We make the assumption that
      SDL is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: minor format tweaks ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit fcf73af68ecb83dcb1d997c6b6a0c29989ebfea8
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:07:14 2014 +1000

      ui/gtk: Support shared surface for most pixman formats

      At least all the ones I've tested. We make the assumption that
      pixman is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: just hook up qemu_pixman_check_format ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0002a51889101a818c1b8328b2a95f284caa030f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 09:31:58 2015 +0100

      ui/spice: Support shared surface for most pixman formats

      Just hook up qemu_pixman_check_format.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 34da30afa473b9fc12161f53f4b3fd83b8ba5ce8
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 17:18:19 2014 +1000

      ui/vnc: Support shared surface for most pixman formats

      At least all the ones I've tested. We make the assumption that
      pixman is going to be better at conversion than we are.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: just hook up qemu_pixman_check_format ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 8cd996f493d4fc10844bd13bde4b9c9c5e38cc3a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Fri Jan 9 08:49:20 2015 +0100

      ui/pixman: add qemu_pixman_check_format

      Convinience check_format function for UIs using pixman.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 49743df399ca1029f4e22b52e9238d8e25c26bb2
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 16:39:05 2014 +1000

      ui: Add dpy_gfx_check_format() to check backend shared surface support

      This allows VGA to decide whether to use a shared surface based on
      whether the UI backend supports the format or not. Backends that
      don't provide the new callback fallback to native 32 bpp which
      is equivalent to what was supported before.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

      [ kraxel: fix console check, allow only 32 bpp as fallback ]

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit aca7aaf6287b6a9f688c1b115a76fdc056565a7e
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 16:37:26 2014 +1000

      ui: Make qemu_default_pixman_format() return 0 on unsupported formats

      In order to remove the logic for detecting supported shared
      pixmap formats from device models, make qemu_default_pixman_format()
      capable for failing by returning 0 which is not a possible format
      value rather than asserting.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

  commit 1e42c353469cb58ca4f3b450eea4211af7d0b147
  Merge: e68cba3 36b62ae
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 16 12:06:41 2015 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150116' into staging

      target-arm queue:
       * fix endianness handling in fwcfg wide registers
       * fix broken crypto insn emulation on big endian hosts

      # gpg: Signature made Fri 16 Jan 2015 12:04:08 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20150116:
        fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()
        target-arm: crypto: fix BE host support

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 36b62ae6a58f9a588fd33be9386e18a2b90103f5
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Fri Jan 16 11:54:30 2015 +0000

      fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()

      (1) Let's contemplate what device endianness means, for a memory mapped
      device register (independently of QEMU -- that is, on physical hardware).

      It determines the byte order that the device will put on the data bus when
      the device is producing a *numerical value* for the CPU. This byte order
      may differ from the CPU's own byte order, therefore when software wants to
      consume the *numerical value*, it may have to swap the byte order first.

      For example, suppose we have a device that exposes in a 2-byte register
      the number of sheep we have to count before falling asleep. If the value
      is decimal 37 (0x0025), then a big endian register will produce [0x00,
      0x25], while a little endian register will produce [0x25, 0x00].

      If the device register is big endian, but the CPU is little endian, the
      numerical value will read as 0x2500 (decimal 9472), which software has to
      byte swap before use.

      However... if we ask the device about who stole our herd of sheep, and it
      answers "XY", then the byte representation coming out of the register must
      be [0x58, 0x59], regardless of the device register's endianness for
      numeric values. And, software needs to copy these bytes into a string
      field regardless of the CPU's own endianness.

      (2) QEMU's device register accessor functions work with *numerical values*
      exclusively, not strings:

      The emulated register's read accessor function returns the numerical value
      (eg. 37 decimal, 0x0025) as a *host-encoded* uint64_t. QEMU translates
      this value for the guest to the endianness of the emulated device register
      (which is recorded in MemoryRegionOps.endianness). Then guest code must
      translate the numerical value from device register to guest CPU
      endianness, before including it in any computation (see (1)).

      (3) However, the data register of the fw_cfg device shall transfer strings
      *only* -- that is, opaque blobs. Interpretation of any given blob is
      subject to further agreement -- it can be an integer in an independently
      determined byte order, or a genuine string, or an array of structs of
      integers (in some byte order) and fixed size strings, and so on.

      Because register emulation in QEMU is integer-preserving, not
      string-preserving (see (2)), we have to jump through a few hoops.

      (3a) We defined the memory mapped fw_cfg data register as
      DEVICE_BIG_ENDIAN.

      The particular choice is not really relevant -- we picked BE only for
      consistency with the control register, which *does* transfer integers --
      but our choice affects how we must host-encode values from fw_cfg strings.

      (3b) Since we want the fw_cfg string "XY" to appear as the [0x58, 0x59]
      array on the data register, *and* we picked DEVICE_BIG_ENDIAN, we must
      compose the host (== C language) value 0x5859 in the read accessor
      function.

      (3c) When the guest performs the read access, the immediate uint16_t value
      will be 0x5958 (in LE guests) and 0x5859 (in BE guests). However, the
      uint16_t value does not matter. The only thing that matters is the byte
      pattern [0x58, 0x59], which the guest code must copy into the target
      string *without* any byte-swapping.

      (4) Now I get to explain where I screwed up. :(

      When we decided for big endian *integer* representation in the MMIO data
      register -- see (3a) --, I mindlessly added an indiscriminate
      byte-swizzling step to the (little endian) guest firmware.

      This was a grave error -- it violates (3c) --, but I didn't realize it. I
      only saw that the code I otherwise intended for fw_cfg_data_mem_read():

          value = 0;
          for (i = 0; i < size; ++i) {
              value = (value << 8) | fw_cfg_read(s);
          }

      didn't produce the expected result in the guest.

      In true facepalm style, instead of blaming my guest code (which violated
      (3c)), I blamed my host code (which was correct). Ultimately, I coded
      ldX_he_p() into fw_cfg_data_mem_read(), because that happened to work.

      Obviously (...in retrospect) that was wrong. Only because my host happened
      to be LE, ldX_he_p() composed the (otherwise incorrect) host value 0x5958
      from the fw_cfg string "XY". And that happened to compensate for the bogus
      indiscriminate byte-swizzling in my guest code.

      Clearly the current code leaks the host endianness through to the guest,
      which is wrong. Any device should work the same regardless of host
      endianness.

      The solution is to compose the host-endian representation (2) of the big
      endian interpretation (3a, 3b) of the fw_cfg string, and to drop the wrong
      byte-swizzling in the guest (3c).

      Brown paper bag time for me.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1420024880-15416-1-git-send-email-lersek@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b449ca3c1874418d948878d5417a32fc0dbf9fea
  Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
  Date:   Fri Jan 16 11:54:29 2015 +0000

      target-arm: crypto: fix BE host support

      The crypto emulation code in target-arm/crypto_helper.c never worked
      correctly on big endian hosts, due to the fact that it uses a union
      of array types to convert between the native VFP register size (64
      bits) and the types used in the algorithms (bytes and 32 bit words)

      We cannot just swab between LE and BE when reading and writing the
      registers, as the SHA code performs word additions, so instead, add
      array accessors for the CRYPTO_STATE type whose LE and BE specific
      implementations ensure that the correct array elements are referenced.

      Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Acked-by: Laszlo Ersek <lersek@redhat.com>
      Message-id: 1420208303-24111-1-git-send-email-ard.biesheuvel@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e68cba36360a2ab5bf0576b66df4d0eb0d822f8d
  Merge: df58887b ea987c2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 16 10:16:14 2015 +0000

      Merge remote-tracking branch 'remotes/amit-migration/tags/mig-2.3-1' into staging

      A set of patches collected over the holidays.  Mix of optimizations and
      fixes.

      # gpg: Signature made Fri 16 Jan 2015 07:42:00 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-migration/tags/mig-2.3-1:
        vmstate: type-check sub-arrays
        migration_cancel: shutdown migration socket
        Handle bi-directional communication for fd migration
        socket shutdown
        Tests: QEMUSizedBuffer/QEMUBuffer
        QEMUSizedBuffer: only free qsb that qemu_bufopen allocated
        xbzrle: rebuild the cache_is_cached function
        xbzrle: optimize XBZRLE to decrease the cache misses

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea987c2c21d4326bb58ee28f6888fdcf8fbda067
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 7 15:12:13 2015 +0100

      vmstate: type-check sub-arrays

      While we cannot check against the type of the full array, we can check
      against the type of the fields.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit a26ba26e214911dc879a23e797d2c269cdb38577
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jan 8 11:11:32 2015 +0000

      migration_cancel: shutdown migration socket

      Force shutdown on migration socket on cancel to cause the cancel
      to complete even if the socket is blocked on a dead network.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 131fe9b843f9a1e55fcbf2457c9cb25c3711b9d8
  Author: Cristian Klein <cristian.klein@cs.umu.se>
  Date:   Thu Jan 8 11:11:31 2015 +0000

      Handle bi-directional communication for fd migration

      libvirt prefers opening the TCP connection itself, for two reasons.
      First, connection failed errors can be detected easier, without having
      to parse qemu's error output.
      Second, libvirt might be asked to secure the transfer by tunnelling the
      communication through an TLS layer.
      Therefore, libvirt opens the TCP connection itself and passes an FD to qemu
      using QMP and a POSIX-specific mechanism.

      Hence, in order to make the reverse-path work in such cases, qemu needs to
      distinguish if the transmitted FD is a socket (reverse-path available)
      or not (reverse-path might not be available) and use the corresponding
      abstraction.

      Signed-off-by: Cristian Klein <cristian.klein@cs.umu.se>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit e1a8c9b67fc97d293211773edcae9e8e2f3367ab
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Jan 8 11:11:30 2015 +0000

      socket shutdown

      Add QEMUFile interface to allow a socket to be 'shut down' - i.e. any
      reads/writes will fail (and any blocking read/write will be woken).

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Amit Shah <amit.shah@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 8580b06498a5dffe554e7ac627726b1d7775c591
  Author: Yang Hongyang <yanghy@cn.fujitsu.com>
  Date:   Fri Dec 19 11:38:06 2014 +0800

      Tests: QEMUSizedBuffer/QEMUBuffer

      Modify some of tests/test-vmstate.c due to qemu_bufopen() change.
      If you create a QEMUSizedBuffer yourself, you have to explicitly
      free it.

      Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit f018d8cd2123f495300935d5019931abbee4e5d9
  Author: Yang Hongyang <yanghy@cn.fujitsu.com>
  Date:   Fri Dec 19 11:38:05 2014 +0800

      QEMUSizedBuffer: only free qsb that qemu_bufopen allocated

      Only free qsb that qemu_bufopen allocated, and also allow
      qemu_bufopen accept qsb as input for write operation. It
      will make the API more logical:
      1.If you create the QEMUSizedBuffer yourself, you need to
        free it by using qsb_free() but not depends on other API
        like qemu_fclose.
      2.allow qemu_bufopen() accept QEMUSizedBuffer as input for
        write operation, otherwise, it will be a little strange
        for this API won't accept the second parameter.

      This brings API change, since there are only 3
      users of this API currently, this change only impact the
      first one which will be fixed in patch 2 of this patchset,
      so I think it is safe to do this change.

      1     70  tests/test-vmstate.c <<open_mem_file_read>>
                  return qemu_bufopen("r", qsb);
      2    404  tests/test-vmstate.c <<test_save_noskip>>
                  QEMUFile *fsave = qemu_bufopen("w", NULL);
      3    424  tests/test-vmstate.c <<test_save_skip>>
                  QEMUFile *fsave = qemu_bufopen("w", NULL);

      Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
      Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Cc: Juan Quintela <quintela@redhat.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1b826f277814dd9496fe3cc71cbe6ab7b203cadf
  Author: ChenLiang <chenliang88@huawei.com>
  Date:   Mon Nov 24 19:55:48 2014 +0800

      xbzrle: rebuild the cache_is_cached function

      Rebuild the cache_is_cached function by cache_get_by_addr. And
      drops the asserts because the caller is also asserting the same
      thing.

      Signed-off-by: ChenLiang <chenliang88@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 27af7d6ea5015e5ef1f7985eab94a8a218267a2b
  Author: ChenLiang <chenliang88@huawei.com>
  Date:   Mon Nov 24 19:55:47 2014 +0800

      xbzrle: optimize XBZRLE to decrease the cache misses

      Avoid hot pages being replaced by others to remarkably decrease cache
      misses

      Sample results with the test program which quote from xbzrle.txt ran in
      vm:(migrate bandwidth:1GE and xbzrle cache size 8MB)

      the test program:

      include <stdlib.h>
      include <stdio.h>
      int main()
       {
              char *buf = (char *) calloc(4096, 4096);
              while (1) {
                  int i;
                  for (i = 0; i < 4096 * 4; i++) {
                      buf[i * 4096 / 4]++;
                  }
                  printf(".");
              }
       }

      before this patch:
      virsh qemu-monitor-command test_vm '{"execute": "query-migrate"}'
      {"return":{"expected-downtime":1020,"xbzrle-cache":{"bytes":1108284,
      "cache-size":8388608,"cache-miss-rate":0.987013,"pages":18297,"overflow":8,
      "cache-miss":1228737},"status":"active","setup-time":10,"total-time":52398,
      "ram":{"total":12466991104,"remaining":1695744,"mbps":935.559472,
      "transferred":5780760580,"dirty-sync-counter":271,"duplicate":2878530,
      "dirty-pages-rate":29130,"skipped":0,"normal-bytes":5748592640,
      "normal":1403465}},"id":"libvirt-706"}

      18k pages sent compressed in 52 seconds.
      cache-miss-rate is 98.7%, totally miss.

      after optimizing:
      virsh qemu-monitor-command test_vm '{"execute": "query-migrate"}'
      {"return":{"expected-downtime":2054,"xbzrle-cache":{"bytes":5066763,
      "cache-size":8388608,"cache-miss-rate":0.485924,"pages":194823,"overflow":0,
      "cache-miss":210653},"status":"active","setup-time":11,"total-time":18729,
      "ram":{"total":12466991104,"remaining":3895296,"mbps":937.663549,
      "transferred":1615042219,"dirty-sync-counter":98,"duplicate":2869840,
      "dirty-pages-rate":58781,"skipped":0,"normal-bytes":1588404224,
      "normal":387794}},"id":"libvirt-266"}

      194k pages sent compressed in 18 seconds.
      The value of cache-miss-rate decrease to 48.59%.

      Signed-off-by: ChenLiang <chenliang88@huawei.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit df58887b20fab8fe8a6dcca4db30cd4e4077d53a
  Merge: b629a38 99efa84
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Jan 15 10:08:46 2015 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-01-15' into staging

      trivial patches for 2015-01-15

      # gpg: Signature made Thu 15 Jan 2015 08:26:26 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2015-01-15:
        vl.c: fix some alignment issues
        blizzard: do not depend on VGA internals
        Makefile: Remove config.status and common.env during 'make distclean'
        target-openrisc: bugfix for dec_sys to decode instructions correctly
        Do not hang on full PTY
        misc: Fix new typos in comments
        target-arm: Fix typo in comment (seperately -> separately)
        target-tricore: Fix new typos
        migration/qemu-file.c: Don't shift left into sign bit
        translate-all: Mark map_exec() with the 'unused' attribute
        tests/hd-geo-test.c: Remove unused test_image variable
        vt82c686: avoid out-of-bounds read

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 99efa84d5c02e33bcca7be83dd7cabc4b0f22f14
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Jan 11 12:56:51 2015 +0200

      vl.c: fix some alignment issues

      The misalignment was caused by tabs which were used instead of spaces.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 31fc97c3145d428751f8bc4d5666a525d5c3dc2f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Jan 9 10:59:49 2015 +0100

      blizzard: do not depend on VGA internals

      There is nothing that is used by this ARM-specific device.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit ae21935924365efecf5c5ba998cb6cb8c85a499b
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Mon Dec 15 11:19:46 2014 +0100

      Makefile: Remove config.status and common.env during 'make distclean'

      config.status and tests/qemu-iotests/common.env are generated files
      that should be deleted during 'make distclean'.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 3d59b6808bc5e0efbf1aee48d7f9ea96d19df05d
  Author: David Morrison <dmorrison@invlim.com>
  Date:   Tue Jan 6 09:06:18 2015 -0800

      target-openrisc: bugfix for dec_sys to decode instructions correctly

      Fixed the decoding of "system" instructions (starting with 0x2)
      in dec_sys() in translate.c.  In particular, the l.trap instruction
      is now correctly decoded, which enables for singlestepping and
      breakpoints to be set in GDB.

      Signed-off-by: David R. Morrison <dmorrison@invlim.com>
      Acked-by: Jia Liu <proljc@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fac6688a18574b6f2caa8c699a936e729ed53ece
  Author: Don Slutz <dslutz@verizon.com>
  Date:   Mon Dec 22 10:04:00 2014 -0500

      Do not hang on full PTY

      Signed-off-by: Don Slutz <dslutz@verizon.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b4952c3677170139541bc6bc14e9c2cfdc056181
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:39 2015 +0100

      misc: Fix new typos in comments

      recieve -> receive
      suprise -> surprise

      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1281f8e3085b9149b8704419534f0e6f23c1fa64
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:38 2015 +0100

      target-arm: Fix typo in comment (seperately -> separately)

      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Greg Bellows <greg.bellows@linaro.org>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 37097418be0a722342fc0ef77c2e773359d2cd05
  Author: Stefan Weil <sw@weilnetz.de>
  Date:   Sat Jan 3 14:41:37 2015 +0100

      target-tricore: Fix new typos

      adress -> address
      managment -> management

      Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Stefan Weil <sw@weilnetz.de>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 90d6a6730b4dbe7d0ada9900aba8263d61376812
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:26:55 2014 +0000

      migration/qemu-file.c: Don't shift left into sign bit

      Add a cast in qemu_get_be32() to avoid shifting left into the sign
      bit of a signed integer (which is undefined behaviour in C).

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2d8ac5eb7a7e72e0877cca2b3705eebeaf5526e7
  Author: SeokYeon Hwang <syeon.hwang@samsung.com>
  Date:   Tue Dec 23 22:26:54 2014 +0000

      translate-all: Mark map_exec() with the 'unused' attribute

      Mark map_exec() with the 'unused' attribute to avoid '-Wunused-function'
      warnings on clang 3.4 or later. This means we don't need to mark it
      'inline', which is what we were previously using to suppress the warning
      (a trick which only works with gcc, not clang).

      Signed-off-by: SeokYeon Hwang <syeon.hwang@samsung.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      [PMM: tweaked comment message a little]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9c6d5c1ade0b681b6f93c3d9d214389355cc563c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:26:53 2014 +0000

      tests/hd-geo-test.c: Remove unused test_image variable

      Remove unused variable test_image; this silences a clang warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9feb8adeaa850d15b930c30f22c1ed2f2f695172
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 10:17:36 2014 +0100

      vt82c686: avoid out-of-bounds read

      superio_ioport_readb can read the 256th element of the array.
      Coverity reports an out-of-bounds write in superio_ioport_writeb,
      but it does not show the corresponding out-of-bounds read
      because it cannot prove that it can happen.  Fix the root
      cause of the problem (zhanghailang's patch instead fixes
      the logic in superio_ioport_writeb).

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
      Cc: qemu-stable@nongnu.org

  commit b629a38a13745d62d44de8ebb00f4e38ec6d8f7e
  Merge: 3a7f560 1979b90
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Jan 14 18:02:47 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      Mostly bugfixes and cleanups from qemu-devel.  Yet another small patch from
      the record/replay series, and a few SCSI and i386 patches as well.

      # gpg: Signature made Wed 14 Jan 2015 09:39:14 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        cpus: consistently use QEMU_CLOCK_VIRTUAL_RT for icount_warp_rt timer
        qemu-timer: rename timer_init to timer_init_tl
        scsi: fix cancellation when I/O was completed but DMA was not.
        rules.mak: Fix module build
        hw/scsi/lsi53c895a: add support for additional diag / debug registers
        qemu-common.h: optimise muldiv64 if int128 is available
        target-i386: do not memcpy in and out of xmm_regs
        target-i386: fix movntsd on big-endian hosts
        vl.c: fix regression when reading memory size from config file
        vl: Don't silently change topology when all -smp options were set
        vl: fix max_cpus check
        vl: Avoid unnecessary 'if' nesting
        9pfs: changed to use event_notifier instead of qemu_pipe
        vl.c: fix regression when reading machine type from config file
        char: restore stdio echo on resume from suspend.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1979b908b6e99cc24c1c0746060422f8778aa9d9
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Jan 12 15:00:43 2015 +0300

      cpus: consistently use QEMU_CLOCK_VIRTUAL_RT for icount_warp_rt timer

      Fix mismatch between timer_new_ms and timer_mod.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f186aa976bab11130af7299b07f7fafd258a63f1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 21:54:14 2014 +0100

      qemu-timer: rename timer_init to timer_init_tl

      timer_init is not called that often.  Free the name for an equivalent
      of timer_new.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 488eef2f1d16c97cf7f9ebf644ecafa1ea1e9acc
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Jan 12 11:47:30 2015 +0100

      scsi: fix cancellation when I/O was completed but DMA was not.

      Commit d577646 (scsi: Introduce scsi_req_cancel_complete, 2014-09-25)
      was supposed to have no semantic change, but it missed a case.  When
      r->aiocb has already been NULLed, but DMA was not complete and the
      SCSI layer was waiting for scsi_req_continue, after the patch the
      SCSI layer will not call the .cancel callback of SCSIBusInfo.

      Fixes: d5776465ee9a55815792efa34d79de240f4ffd99
      Cc: qemu-stable@nongnu.org
      Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c88f68ec3ce54ebc5da13d07d6512689c4e9be30
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Jan 12 12:43:09 2015 +0800

      rules.mak: Fix module build

      Module build is broken since commit c261d774fb ( rules.mak: Fix DSO
      build by pulling in archive symbols). That commit added .mo placeholders
      of DSO to -y variables, in order to pull stub symbols to executable. But
      the placeholders are unintentionally expanded in -y, rather than
      filtered out while linking.

      Fix it by moving the -objs expanding to before inserting .mo
      placeholders.  Note that passing -cflags and -libs to member objects are
      also moved to keep it happening before object expanding.

      Reported-by: Bharata B Rao <bharata.rao@gmail.com>
      Tested-by: Bharata B Rao <bharata.rao@gmail.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 6f84da3a07668ce881a0c853390eb05313d61157
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Jan 12 10:45:17 2015 +0100

      hw/scsi/lsi53c895a: add support for additional diag / debug registers

      Some ancient Linux kernels read from registers 0x09 and 0x3c-3f during
      boot. According to the spec these registers are for diag and debug
      purposes only. If they are absend qemu aborts on read.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e1660dc57c1bacb78cbe39001e58a577c927dacb
  Author: Frediano Ziglio <freddy77@gmail.com>
  Date:   Fri Jan 9 11:25:20 2015 +0000

      qemu-common.h: optimise muldiv64 if int128 is available

      Let compiler do the job to optimise the function.

      Signed-off-by: Frediano Ziglio <frediano.ziglio@huawei.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Frediano Ziglio <freddy77@gmail.com>

  commit bee818872cd9e8c07be529f75da3e48a68bf7a93
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Oct 24 09:44:38 2014 +0200

      target-i386: do not memcpy in and out of xmm_regs

      After the next patch, we will move the high parts of AVX and AVX512 registers
      in the same array as the SSE registers.  This will make it impossible to
      memcpy an array of 128-bit values in and out of xmm_regs in one swoop.
      Use a for loop instead.

      Similarly, always use XMM_Q in translate.c.  This avoids introducing bugs
      such as the one fixed in the previous patch.

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 07958082fdf39284935d38a5b8aec1fe7d020637
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Jan 7 17:36:27 2015 +0100

      target-i386: fix movntsd on big-endian hosts

      This was accessing an XMM register's low half without going through XMM_Q.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3b9985e9a104dd90427570dd4e06e4d1f152c48b
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Sun Jan 11 12:38:43 2015 +0200

      vl.c: fix regression when reading memory size from config file

      This is happening because an actual logic is performed on the memory
      arguments inside the main's switch, disregarding the config file content.

      Solved by extracting the logic on a separate function and calling it
      after the switch.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3a7f560fa612610822727f7647ed6bc10bccd6ec
  Merge: a00369f c1d322e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 13 18:32:42 2015 +0000

      Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-13' into staging

      * remotes/sstabellini/xen-2015-01-13:
        xen-hvm: increase maxmem before calling xc_domain_populate_physmap
        xen-pt: Fix PCI devices re-attach failed

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c1d322e6048796296555dd36fdd102d7fa2f50bf
  Author: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
  Date:   Wed Dec 3 08:15:19 2014 -0500

      xen-hvm: increase maxmem before calling xc_domain_populate_physmap

      Increase maxmem before calling xc_domain_populate_physmap_exact to
      avoid the risk of running out of guest memory. This way we can also
      avoid complex memory calculations in libxl at domain construction
      time.

      This patch fixes an abort() when assigning more than 4 NICs to a VM.

      Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Signed-off-by: Don Slutz <dslutz@verizon.com>

  commit a00369fc565cef32076b767ecff34469642afe06
  Merge: 7d5ad15 07d31d0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Jan 13 13:49:18 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Tue 13 Jan 2015 13:48:06 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request: (38 commits)
        NVMe: Set correct VS Value for 1.1 Compliant Controllers
        MAINTAINERS: Add migration/block* to block subsystem
        MAINTAINERS: Update email addresses for Chrysostomos Nanakos
        nvme: Fix get/set number of queues feature
        ide: Implement VPD response for ATAPI
        block: Split BLOCK_OP_TYPE_COMMIT to BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}
        block: limited request size in write zeroes unsupported path
        coroutine: try harder not to delete coroutines
        coroutine: drop qemu_coroutine_adjust_pool_size
        coroutine: rewrite pool to avoid mutex
        QSLIST: add lock-free operations
        test-coroutine: avoid overflow on 32-bit systems
        qemu-thread: add per-thread atexit functions
        coroutine-ucontext: use __thread
        qemu-iotests: Add supported os parameter for python tests
        qemu-iotests: Add "_supported_os Linux" to 058
        qemu-iotests: Replace "/bin/true" with "true"
        .gitignore: Ignore generated "common.env"
        libqos: Convert malloc-pc allocator to a generic allocator
        migration/block: fix pending() return value
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 07d31d07f4b28a61b65cec95da69851c675f20b9
  Author: Anubhav Rakshit <anubhav.rakshit@gmail.com>
  Date:   Thu Jan 8 15:10:35 2015 +0530

      NVMe: Set correct VS Value for 1.1 Compliant Controllers

      According to NVMe specifications Bits 15:08 represent Minor Version number.

      Signed-off-by: Anubhav Rakshit <anubhav.rakshit@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 47b0f45a9282aaf73231f34ca60369a12c8d8d3c
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 11 18:49:47 2014 +0800

      MAINTAINERS: Add migration/block* to block subsystem

      We are moving block-migration.c to the separated migration directory,
      keep this file watched by block maintainers is a good idea.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5734edd8372cce37c8c203b95beb03acbec72f49
  Author: Chrysostomos Nanakos <chris@include.gr>
  Date:   Tue Dec 9 14:58:22 2014 +0200

      MAINTAINERS: Update email addresses for Chrysostomos Nanakos

      Remove first email address and let the one from which I am contributing.

      Signed-off-by: Chrysostomos Nanakos <chris@include.gr>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit e7026f1953c16d1cc3e8310cc27db6acf61d9def
  Author: Alex Friedman <alex@e8storage.com>
  Date:   Fri Dec 5 14:40:24 2014 +0200

      nvme: Fix get/set number of queues feature

      According to the specification, the low 16 bits should contain the number of
      I/O submission queues, and the high 16 bits should contain the number of
      I/O completion queues.

      Signed-off-by: Alex Friedman <alex@e8storage.com>
      Acked-by: Keith Busch <keith.busch@intel.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9a502563eef7d7c2c9120b237059426e229eefe9
  Author: John Snow <jsnow@redhat.com>
  Date:   Wed Dec 10 13:17:07 2014 -0500

      ide: Implement VPD response for ATAPI

      SCSI devices have multiple kinds of queries they need to respond
      to, as defined in the "cmd inquiry" section in MMC-6 and SPC-3.

      Relevent sections:
      MMC-6 revision 2g:
            Non-VPD response data and pointer to SPC-3;
            Section 6.8 "Inquiry Command"
      SPC-3 revision 23:
            Inquiry command and error handling:
            Section 6.4 "INQUIRY command"
            VPD data pages format:
            Section 7.6 "Vital product data parameters"

      We implement these Vital Product Data queries for SCSI, but not for
      ATAPI through IDE. The result is that if you are looking for the WWN
      identifier via tools such as sg3_utils, you will be unable to query
      our CD/DVD rom device to obtain it.

      This patch adds the minimum number of mandatory responses as defined
      by SPC-3, which include the "supported pages" response (page 0x00)
      and the "Device Identification" response (page 0x83). It also correctly
      responds when it receives a request for an illegal page to improve
      error output from related tools.

      The Device ID page contains an arbitrary list of identification
      strings of various formats; the ID strings included in this patch
      were chosen to mimic those provided by the libata driver when
      emulating this SCSI query (model, serial, and wwn when present.)

      Example:

      # libata emulated response
      [root@localhost ~]# sg_inq --id /dev/sda
      VPD INQUIRY: Device Identification page
        Designation descriptor number 1, descriptor length: 24
          designator_type: vendor specific [0x0],  code_set: ASCII
          associated with the addressed logical unit
            vendor specific: QM00001
        Designation descriptor number 2, descriptor length: 72
          designator_type: T10 vendor identification,  code_set: ASCII
          associated with the addressed logical unit
            vendor id: ATA
            vendor specific: QEMU HARDDISK                           QM00001

      # QEMU generated ATAPI response, with WWN
      [root@localhost ~]# sg_inq --id /dev/sr0
      VPD INQUIRY: Device Identification page
        Designation descriptor number 1, descriptor length: 24
          designator_type: vendor specific [0x0],  code_set: ASCII
          associated with the addressed logical unit
            vendor specific: QM00005
        Designation descriptor number 2, descriptor length: 72
          designator_type: T10 vendor identification,  code_set: ASCII
          associated with the addressed logical unit
            vendor id: ATA
            vendor specific: QEMU DVD-ROM                            QM00005
        Designation descriptor number 3, descriptor length: 12
          designator_type: NAA,  code_set: Binary
          associated with the addressed logical unit
            NAA 5, IEEE Company_id: 0xc50
            Vendor Specific Identifier: 0x15ea71bb
            [0x5000c50015ea71bb]

      See also: hw/scsi/scsi-disk.c, scsi_disk_emulate_inquiry()

      Signed-off-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bb00021de0b5908bc2c3ca467ad9a2b0c9c36459
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Sep 11 13:14:00 2014 +0800

      block: Split BLOCK_OP_TYPE_COMMIT to BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}

      Like BLOCK_OP_TYPE_BACKUP_SOURCE and BLOCK_OP_TYPE_BACKUP_TARGET,
      block-commit involves two asymmetric devices.

      This change is not user-visible (yet), because commit only works with
      device names.

      But once we enable backing reference in blockdev-add, or specifying
      node-name in block-commit command, we don't want the user to start two
      commit jobs on the same backing chain, which will corrupt things because
      of the final bdrv_swap.

      Before we have per category blockers, splitting this type is still
      better.

      [Resolved virtio-blk dataplane conflict by replacing
      BLOCK_OP_TYPE_COMMIT with both BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}.
      They are safe since the block job runs in the same AioContext as the
      dataplane IOThread.
      --Stefan]

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 095e4fa4b56cf511cb41005872eeace9a2f24582
  Author: Peter Lieven <pl@kamp.de>
  Date:   Mon Jan 5 12:29:49 2015 +0100

      block: limited request size in write zeroes unsupported path

      If bs->bl.max_write_zeroes is large and we end up in the unsupported
      path we might allocate a lot of memory for the iovector and/or even
      generate an oversized requests.

      Fix this by limiting the request by the minimum of the reported
      maximum transfer size or 16MB (32768 sectors).

      Reported-by: Denis V. Lunev <den@openvz.org>
      Signed-off-by: Peter Lieven <pl@kamp.de>
      Reviewed-by: Denis V. Lunev <den@openvz.org>
      Message-id: 1420457389-16332-1-git-send-email-pl@kamp.de
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 51a2219bdceed16e81c6e2e2f08aed39c579728f
  Author: Peter Lieven <pl@kamp.de>
  Date:   Tue Dec 2 12:05:50 2014 +0100

      coroutine: try harder not to delete coroutines

      Placing coroutines on the global pool should be preferrable, because it
      can help all threads.  But if the global pool is full, we can still
      try to save some allocations by stashing completed coroutines on the
      local pool.  This is quite cheap too, because it does not require
      atomic operations, and provides a gain of 15% in the best case.

      Signed-off-by: Peter Lieven <pl@kamp.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-8-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 66552b894bd68dd6539fb6d656ad2c21bdd6acbe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:49 2014 +0100

      coroutine: drop qemu_coroutine_adjust_pool_size

      This is not needed anymore.  The new TLS-based algorithm is adaptive.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4d68e86bb10159099da0798f74e7512955f15eec
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:48 2014 +0100

      coroutine: rewrite pool to avoid mutex

      This patch removes the mutex by using fancy lock-free manipulation of
      the pool.  Lock-free stacks and queues are not hard, but they can suffer
      from the ABA problem so they are better avoided unless you have some
      deferred reclamation scheme like RCU.  Otherwise you have to stick
      with adding to a list, and emptying it completely.  This is what this
      patch does, by coupling a lock-free global list of available coroutines
      with per-CPU lists that are actually used on coroutine creation.

      Whenever the destruction pool is big enough, the next thread that runs
      out of coroutines will steal the whole destruction pool.  This is positive
      in two ways:

      1) the allocation does not have to do any atomic operation in the fast
      path, it's entirely using thread-local storage.  Once every POOL_BATCH_SIZE
      allocations it will do a single atomic_xchg.  Release does an atomic_cmpxchg
      loop, that hopefully doesn't cause any starvation, and an atomic_inc.

      A later patch will also remove atomic operations from the release path,
      and try to avoid the atomic_xchg altogether---succeeding in doing so if
      all devices either use ioeventfd or are not submitting requests actively.

      2) in theory this should be completely adaptive.  The number of coroutines
      around should be a little more than POOL_BATCH_SIZE * number of allocating
      threads; so this also empties qemu_coroutine_adjust_pool_size.  (The previous
      pool size was POOL_BATCH_SIZE * number of block backends, so it was a bit
      more generous.  But if you actually have many high-iodepth disks, it's better
      to put them in different iothreads, which will also use separate thread
      pools and aio=native file descriptors).

      This speeds up perf/cost (in tests/test-coroutine) by a factor of ~1.33.
      No matter if we end with some kind of coroutine bypass scheme or not,
      it cannot hurt to optimize hot code.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit c740ad92d0d958fa785e5d7aa1b67ecaf30a6a54
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:47 2014 +0100

      QSLIST: add lock-free operations

      These operations are trivial to implement and do not have ABA problems.
      They are enough to implement simple multiple-producer, single consumer
      lock-free lists or, as in the next patch, the multiple consumers can
      steal a whole batch of elements and process them at their leisure.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 6d86ae0824bdd6175dd3874688a871e981093888
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:46 2014 +0100

      test-coroutine: avoid overflow on 32-bit systems

      unsigned long is not large enough to represent 1000000000 * duration there.
      Just use floating point.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ef57137f1b30545a477ab798d34a669b0abf5320
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:45 2014 +0100

      qemu-thread: add per-thread atexit functions

      Destructors are the main additional feature of pthread TLS compared
      to __thread.  If we were using C++ (hint, hint!) we could have used
      thread-local objects with a destructor.  Since we are not, instead,
      we add a simple Notifier-based API.

      Note that the notifier must be per-thread as well.  We can add a
      global list as well later, perhaps.

      The Win32 implementation has some complications because a) detached
      threads used not to have a QemuThreadData; b) the main thread does
      not go through win32_start_routine, so we have to use atexit too.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d1d1b206b07977fe0e75b0254e5b50c215c97803
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 2 12:05:44 2014 +0100

      coroutine-ucontext: use __thread

      ELF thread local storage is about 10% faster on tests/test-coroutine's
      perf/cost test.  The timing on my machine is 190ns per iteration with
      pthread TLS, 170 with ELF TLS.

      Based on a patch by Kevin Wolf and Peter Lieven, but redone to follow
      the model of coroutine-win32.c (including the important "noinline"
      attribute!).

      Platforms without thread-local storage (OpenBSD probably?) will need
      a new-enough GCC for this to compile, in order to use the same emutls
      support that Windows already relies on.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417518350-6167-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit bc521696607c5348fcd8a9e57b408d0ac0dbe2f8
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:52 2015 +0800

      qemu-iotests: Add supported os parameter for python tests

      If I understand correctly, qemu-iotests never meant to be portable. We
      only support Linux for all the shell cases, but didn't specify it for
      python tests. Now add this and default all the python tests as Linux
      only. If we cares enough later, we can override the parameter in
      individual cases.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9c8ab1ae0d7c4a135c832c784f088ae5e2140585
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:49 2015 +0800

      qemu-iotests: Add "_supported_os Linux" to 058

      Other cases have this, and this test is not portable as well, as we want
      to add "make check-block" to "make check", it shouldn't fail on Mac OS
      X.

      Reported-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a2d9c0c407456faa871870c57cf99942739e28ab
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:48 2015 +0800

      qemu-iotests: Replace "/bin/true" with "true"

      The former is not portable because on Mac OSX it is /usr/bin/true.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 1dbe67503b8d35cec797d2b8e742f11e4553cf3b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Sun Jan 4 09:53:46 2015 +0800

      .gitignore: Ignore generated "common.env"

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 99605175c93a24be4aa39543cd02551ea205e614
  Author: Liang Li <liang.z.li@intel.com>
  Date:   Tue Jan 13 10:40:53 2015 +0800

      xen-pt: Fix PCI devices re-attach failed

      Use the 'xl pci-attach $DomU $BDF' command to attach more than
      one PCI devices to the guest, then detach the devices with
      'xl pci-detach $DomU $BDF', after that, re-attach these PCI
      devices again, an error message will be reported like following:

          libxl: error: libxl_qmp.c:287:qmp_handle_error_response: receive
          an error message from QMP server: Duplicate ID 'pci-pt-03_10.1'
          for device.

      If using the 'address_space_memory' as the parameter of
      'memory_listener_register', 'xen_pt_region_del' will not be called
      if the memory region's name is not 'xen-pci-pt-*' when the devices
      is detached. This will cause the device's related QemuOpts object
      not be released properly.

      Using the device's address space can avoid such issue, because the
      calling count of 'xen_pt_region_add' when attaching and the calling
      count of 'xen_pt_region_del' when detaching is the same, so all the
      memory region ref and unref by the 'xen_pt_region_add' and
      'xen_pt_region_del' can be released properly.

      Signed-off-by: Liang Li <liang.z.li@intel.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reported-by: Longtao Pang <longtaox.pang@intel.com>

  commit 292be092ad48ac530dd254ada109851e9a2353f5
  Author: Marc Marí <marc.mari.barcelo@gmail.com>
  Date:   Thu Oct 23 10:12:42 2014 +0200

      libqos: Convert malloc-pc allocator to a generic allocator

      The allocator in malloc-pc has been extracted, so it can be used in every arch.
      This operation showed that both the alloc and free functions can be also
      generic.
      Because of this, the QGuestAllocator has been removed from is function to wrap
      the alloc and free function, and now just contains the allocator parameters.
      As a result, only the allocator initalizer and unitializer are arch dependent.

      Signed-off-by: Marc Marí <marc.mari.barcelo@gmail.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 04636dc410b163c2243e66c3813dd4900a50a4ed
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
  Date:   Tue Dec 30 13:04:16 2014 +0300

      migration/block: fix pending() return value

      Because of wrong return value of .save_live_pending() in
      migration/block.c, migration finishes before the whole disk is
      transferred. Such situation occurs when the migration process is fast
      enough, for example when source and dest are on the same host.

      If in the bulk phase we return something < max_size, we will skip
      transferring the tail of the device. Currently we have "set pending to
      BLOCK_SIZE if it is zero" for bulk phase, but there no guarantee, that
      it will be < max_size.

      True approach is to return, for example, max_size+1 when we are in the
      bulk phase.

      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
      Message-id: 1419933856-4018-2-git-send-email-vsementsov@parallels.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 4dd7b8d30cfa1aebee547958db27efd581a58d9b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 19 17:17:06 2014 +0100

      iotests: Filter out "I/O thread spun..." warning

      Filter out the "main loop: WARNING: I/O thread spun for..." warning from
      qemu output (it hardly matters for code specifically testing I/O).

      Furthermore, use _filter_qemu in all the custom functions which run
      qemu.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7c6a4ab871cae829ea754c717db2d40c2c115224
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:07 2014 +0800

      qemu-iotests: Test blockdev-backup in 055

      This applies cases on drive-backup on blockdev-backup, except cases with
      target format and mode.

      Also add a case to check source == target.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-5-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit bd8baecddc3c45f1b3b8322fbf41a3c4b01ec1b7
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:06 2014 +0800

      block: Add blockdev-backup to transaction

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-4-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c29c1dd312f39ec18a3c6177c6da09a75e095d70
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:05 2014 +0800

      qmp: Add command 'blockdev-backup'

      Similar to drive-backup, but this command uses a device id as target
      instead of creating/opening an image file.

      Also add blocker on target bs, since the target is also a named device
      now.

      Add check and report error for bs == target which became possible but is
      an illegal case with introduction of blockdev-backup.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-3-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit b7b9d39a7a5bd3a7fe5968b7780c9868c3210a4d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 18 18:37:04 2014 +0800

      qapi: Comment version info in TransactionAction

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418899027-8445-2-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit c4237dfa635900e4d1cdc6038d5efe3507f45f0c
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
  Date:   Thu Nov 27 12:40:46 2014 +0300

      block: fix spoiling all dirty bitmaps by mirror and migration

      Mirror and migration use dirty bitmaps for their purposes, and since
      commit [block: per caller dirty bitmap] they use their own bitmaps, not
      the global one. But they use old functions bdrv_set_dirty and
      bdrv_reset_dirty, which change all dirty bitmaps.

      Named dirty bitmaps series by Fam and Snow are affected: mirroring and
      migration will spoil all (not related to this mirroring or migration)
      named dirty bitmaps.

      This patch fixes this by adding bdrv_set_dirty_bitmap and
      bdrv_reset_dirty_bitmap, which change concrete bitmap. Also, to prevent
      such mistakes in future, old functions bdrv_(set,reset)_dirty are made
      static, for internal block usage.

      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@parallels.com>
      CC: John Snow <jsnow@redhat.com>
      CC: Fam Zheng <famz@redhat.com>
      CC: Denis V. Lunev <den@openvz.org>
      CC: Stefan Hajnoczi <stefanha@redhat.com>
      CC: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417081246-3593-1-git-send-email-vsementsov@parallels.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit a06e43556e3faea22de4cce0da7a6f362d3ca9a6
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 16 09:40:24 2014 +0800

      qapi: Fix document for BlockStats.node-name

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1418694024-26498-1-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>

  commit 527ab22a2a268421564cfba3409d081aee22c22b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:29 2014 +0100

      iotests: Add test for relative backing file names

      Sometimes, qemu does not have a filename to work with, so it does not
      know which directory to use for a backing file specified by a relative
      filename. Add a test which tests that qemu exits with an appropriate
      error message.

      Additionally, add a test for qemu-img create with a backing filename
      relative to the backed image's base directory while omitting the image
      size.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1085daf9411e355ce3bd6d7034e23a8405599889
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:28 2014 +0100

      block/vmdk: Relative backing file for creation

      When a vmdk image is created with a backing file, it is opened to check
      whether it is indeed a vmdk file by letting qemu probe it. When doing
      so, the backing filename is relative to the image's base directory so it
      should be interpreted accordingly.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 291680186f7f8856d943793414d1b8df6c562fc4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:27 2014 +0100

      block: Relative backing file for image creation

      Relative backing filenames are always relative to the backed image's
      directory; the same applies to image creation. Therefore, if the backing
      file has to be opened for determining its size (in case the size has not
      been explicitly specified) its filename should be interpreted relative
      to the new image's base directory and not relative to qemu's working
      directory.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9f07429e8873124c588847b0d499cb32b9410bdd
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:26 2014 +0100

      block: JSON filenames and relative backing files

      When using a relative backing file name, qemu needs to know the
      directory of the top image file. For JSON filenames, such a directory
      cannot be easily determined (e.g. how do you determine the directory of
      a qcow2 BDS directly on top of a quorum BDS?). Therefore, do not allow
      relative filenames for the backing file of BDSs only having a JSON
      filename.

      Furthermore, BDS::exact_filename should be used whenever possible. If
      BDS::filename is not equal to BDS::exact_filename, the former will
      always be a JSON object.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0a82855a1a819f3de49781d42728f485fbd64284
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:25 2014 +0100

      block: Get full backing filename from string

      Introduce bdrv_get_full_backing_filename_from_filename(), a function
      which takes the name of the backed file and a potentially relative
      backing filename to produce the full (absolute) backing filename.

      Use this function from bdrv_get_full_backing_filename().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit a97ceca578e69f9b050a2400e1979a068b0654eb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Nov 26 17:20:24 2014 +0100

      checkpatch: Brace handling on multi-line condition

      CODING_STYLE states the following about braces around blocks:

      > The opening brace is on the line that contains the control flow
      > statement that introduces the new block; [...]

      This is obviously impossible with multi-line conditions. Therefore,
      CODING_STYLE does not make any clear statement about where to put the
      opening brace after a multi-line condition.

      There is a reason to prefer to place the opening brace on an own line
      after such a condition while still placing it on the same line as the
      "control flow statement" if possible; that reason is that the last line
      of a multi-line condition is indented, in the case of "if", it is often
      indented by four spaces, just as much as the first statement in the
      block will be indented. This is hard to read as there is no clearly
      visible distinction between condition and block. Placing the opening
      brace on a separate line solves this issue.

      Also, there are cases where placing the opening brace on a separate line
      is the only viable option; if the previous line had nearly 80 characters
      and splitting it is not desirable, the opening brace is naturally placed
      on an own line.

      This patch fixes checkpatch.pl to not complain about braces on own lines
      if the condition introducing the block spanned more than one line, or if
      the previous line had 79 or 80 characters.

      Furthermore, the warning about not having braces around a block is fixed
      to mind braces not being on the last line of the condition.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ee82310f8a6cc9ba9e8d1ac892f1a3cfc0debd8c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:10:00 2014 +0100

      block: replace g_new0 with g_new for bottom half allocation.

      This saves about 15% of the clock cycles spent on allocation.  Using the
      slice allocator does not add a visible improvement; allocation is faster
      than malloc, while freeing seems to be slower.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e012b78cf5bc42f20ef1a1f78383035f2293ceea
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:09:59 2014 +0100

      block: do not allocate an iovec per read of a growable/zero_after_eof BDS

      Most reads do not go past the end of the file, and they can use the
      input QEMUIOVector instead of creating one.  This removes the
      qemu_iovec_* functions from the profile.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fcf5def1ab0f94ff120b7141c943b517d2ece83d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 17 16:09:58 2014 +0100

      block: mark AioContext as recursive

      AioContext can be accessed recursively, in fact that's what we do with
      aio_poll.  Marking the GSource as recursive avoids that GLib blocks it
      and unblocks it around every call to aio_dispatch, which is a pretty
      expensive operation.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8aff7d6bfa1632d722f47a1a6bca679221b6db3
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Dec 15 13:07:18 2014 +0800

      qemu-iotests: Speed up make check-block

      Using /tmp, which is usually mounted as tmpfs, the quick group can be
      quicker.

      On my laptop (Lenovo T430s with Fedora 20), this reduces the time from
      50s to 30s.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 709e57753b57cbef674e88e85056612d3e1727c2
  Author: Fam Zheng <famz@redhat.com>
  Date:   Mon Dec 15 13:07:17 2014 +0800

      qemu-iotests: Remove 091 from quick group

      For the purpose of allowing running quick group on tmpfs.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7d5ad15d17f26dd4f9ff5f3491828bc34e74f28c
  Merge: 5435f1d a39d97c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 11:13:24 2015 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Mon 12 Jan 2015 10:27:41 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it
        hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of net_disconnect()
        hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' fails
        net: remove all cleanup methods from NIC NetClientInfos

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a39d97c7becca5fd679d70d17ae5b1d62b9b5da6
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:58:42 2014 +0800

      hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it

      Since net_init() checks whether 'netdev->mac' is NULL, before alloc it;
      net_release() also need set 'netdev->mac' to NULL after free it.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit d46858377b822b820946c6b2e3a9153ee0aebd37
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:52:16 2014 +0800

      hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of net_disconnect()

      net_init() and net_free() are pairs, net_connect() and net_disconnect()
      are pairs. net_init() creates 'netdev->nic', so also need free it in
      net_free().

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b4f72e31b924bec2c18fe0b2a8c6462dbed9dcb2
  Author: Chen Gang <gang.chen.5i5j@gmail.com>
  Date:   Wed Dec 17 04:48:54 2014 +0800

      hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' fails

      When map 'netdev->rxs' fails, need free the original resource, or will
      cause resource leak.

      Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 57407ea44cc0a3d630b9b89a2be011f1955ce5c1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Dec 23 17:53:19 2014 +0100

      net: remove all cleanup methods from NIC NetClientInfos

      All NICs have a cleanup function that, in most cases, zeroes the pointer
      to the NICState.  In some cases, it frees data belonging to the NIC.

      However, this function is never called except when exiting from QEMU.
      It is not necessary to NULL pointers and free data here; the right place
      to do that would be in the device's unrealize function, after calling
      qemu_del_nic.  Zeroing the NIC multiple times is also wrong for multiqueue
      devices.

      This cleanup function gets in the way of making the NetClientStates for
      the NIC hold an object_ref reference to the object, so get rid of it.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5435f1d77eb4e8cf5e4103f64f0ecbe9f2902c71
  Merge: 64ea803 9e03a04
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Jan 12 10:09:41 2015 +0000

      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150112-v3' into staging

      s390x patches for 2.3.

      Highlight is support for PCI devices on s390x. Otherwise, performance
      improvements (register sync) and small cleanups.

      # gpg: Signature made Mon 12 Jan 2015 09:49:31 GMT using RSA key ID C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

      * remotes/cohuck/tags/s390x-20150112-v3:
        kvm: extend kvm_irqchip_add_msi_route to work on s390
        s390: implement pci instructions
        s390: Add PCI bus support
        s390x/kvm: avoid syscalls by syncing registers with kvm_run
        s390x/kvm: sync register support helper function
        s390x/css: Clean up unnecessary CONFIG_USER_ONLY wrappers
        s390x/ccw: fix oddity in machine class init

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9e03a0405d56b4af8952b794d0e5dd9206ee7329
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:40 2015 +0100

      kvm: extend kvm_irqchip_add_msi_route to work on s390

      on s390 MSI-X irqs are presented as thin or adapter interrupts
      for this we have to reorganize the routing entry to contain
      valid information for the adapter interrupt code on s390.
      To minimize impact on existing code we introduce an architecture
      function to fixup the routing entry.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 863f6f52b7134304234ea81554f62f54afb016fa
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:39 2015 +0100

      s390: implement pci instructions

      This patch implements the s390 pci instructions in qemu. It allows
      to access and drive pci devices attached to the s390 pci bus.
      Because of platform constrains devices using IO BARs are not
      supported. Also a device has to support MSI/MSI-X to run on s390.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 8cba80c3a0331926c9c412c4c1e07896de29aab6
  Author: Frank Blaschka <frank.blaschka@de.ibm.com>
  Date:   Fri Jan 9 09:04:38 2015 +0100

      s390: Add PCI bus support

      This patch implements a pci bus for s390x together with infrastructure
      to generate and handle hotplug events, to configure/unconfigure via
      sclp instruction, to do iommu translations and provide s390 support for
      MSI/MSI-X notification processing.

      Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 59ac15326ed8c936459c8163cf264e9fd35a18ba
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:31 2014 +0100

      s390x/kvm: avoid syscalls by syncing registers with kvm_run

      We can avoid loads of syscalls when dropping to user space by storing the values
      of more registers directly within kvm_run.

      Support is added for:
      - ARCH0: CPU timer, clock comparator, TOD programmable register,
               guest breaking-event register, program parameter
      - PFAULT: pfault parameters (token, select, compare)

      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fdb78ec00655e59c8d47eec91918a4da0d966685
  Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:30 2014 +0100

      s390x/kvm: sync register support helper function

      Let's unify the code to sync registers by moving the checks into a helper
      function can_sync_regs().

      Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 6781fc412ef1349740813cbaabe0e86dad39a9be
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Wed Dec 3 15:38:29 2014 +0100

      s390x/css: Clean up unnecessary CONFIG_USER_ONLY wrappers

      The css functions are only used from ioinst.c and other files that are
      only built for CONFIG_SOFTMMU. So we do not need the dummy wrappers for
      the CONFIG_USER_ONLY target in the cpu.h header.

      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Reviewed-by: Jason J. Herne <jjherne@us.ibm.com>
      Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit fb85b34da77cba6e255830e7a49447d3c7ef74f0
  Author: Cornelia Huck <cornelia.huck@de.ibm.com>
  Date:   Wed Dec 3 15:38:28 2014 +0100

      s390x/ccw: fix oddity in machine class init

      ccw_machine_class_init() uses ',' instead of ';' while initializing
      the class' fields. This is almost certainly a copy/paste error and,
      while legal C, rather on the unusual side. Just use ';' everywhere.

      Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
      Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>

  commit 64ea8038ffbf703dcd438a108d2d5499c8ff95d9
  Merge: aaf0301 b3e27c3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 22:29:09 2015 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150109.0' into staging

      VFIO fixes:
      - Fix 32bit overflow in handling large PCI BARs (Alex Williamson)
      - Fix interrupt shutdown ordering (Alex Williamson)

      # gpg: Signature made Fri 09 Jan 2015 16:23:42 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20150109.0:
        vfio-pci: Fix interrupt disabling
        vfio-pci: Fix BAR size overflow

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit aaf03019175949eda5087329448b8a0033b89479
  Merge: 97052d6 a166614
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 21:02:23 2015 +0000

      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

      pc: resizeable ROM blocks

      This makes ROM blocks resizeable.  This infrastructure is required for other
      functionality we have queued.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

      # gpg: Signature made Thu 08 Jan 2015 11:19:24 GMT using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

      * remotes/mst/tags/for_upstream:
        acpi-build: make ROMs RAM blocks resizeable
        memory: API to allocate resizeable RAM MR
        arch_init: support resizing on incoming migration
        exec: qemu_ram_alloc_resizeable, qemu_ram_resize
        exec: split length -> used_length/max_length
        exec: cpu_physical_memory_set/clear_dirty_range
        memory: add memory_region_set_size

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 97052d64e4fb934bcf25f4a6b42dc06f6ecbf9eb
  Merge: e77d927 75c74cc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 19:50:21 2015 +0000

      Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

      Patch queue for ppc - 2015-01-07

      New year's release. This time's highlights:

        - E500: More RAM support
        - pseries: New SLOF release
        - Migration fixes
        - Simplify USB spawning logic, removes support for explicit usb=off
        - TCG: Simple untansactional TM emulation

      # gpg: Signature made Wed 07 Jan 2015 15:19:37 GMT using RSA key ID 03FEDC60
      # gpg: Good signature from "Alexander Graf <agraf@suse.de>"
      # gpg:                 aka "Alexander Graf <alex@csgraf.de>"

      * remotes/agraf/tags/signed-ppc-for-upstream: (37 commits)
        hw/ppc/mac_newworld: simplify usb controller creation logic
        hw/ppc/spapr: simplify usb controller creation logic
        hw/ppc/mac_newworld: QOMified mac99 machines
        hw/usb: simplified usb_enabled
        hw/machine: added machine_usb wrapper
        hw/ppc: modified the condition for usb controllers to be created for some ppc machines
        target-ppc: Cast ssize_t to size_t before printing with %zx
        target-ppc: Mark SR() and gen_sync_exception() as !CONFIG_USER_ONLY
        PPC: e500: Fix GPIO controller interrupt number
        target-ppc: Introduce Privileged TM Noops
        target-ppc: Introduce tcheck
        target-ppc: Introduce TM Noops
        target-ppc: Introduce tbegin
        target-ppc: Introduce TEXASRU Bit Fields
        target-ppc: Power8 Supports Transactional Memory
        target-ppc: Introduce tm_enabled Bit to CPU State
        target-ppc: Introduce Feature Flag for Transactional Memory
        target-ppc: Introduce Instruction Type for Transactional Memory
        pseries: Update SLOF firmware image to 20141202
        PPC: Fix crash on spapr_tce_table_finalize()
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e77d927f1a1876ef341b4df287939b0c935703d5
  Merge: f1c5831 ea259ac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Jan 10 19:06:41 2015 +0000

      Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20150105' into staging

      seccomp branch queue

      # gpg: Signature made Mon 05 Jan 2015 17:17:01 GMT using RSA key ID 12F8BD2F
      # gpg: Can't check signature: public key not found

      * remotes/otubo/tags/pull-seccomp-20150105:
        seccomp: add mbind() to the syscall whitelist
        seccomp: typo in configure error message

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ec2cbbdd80463efd4bc81a9d1362a2acb3097a21
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 00:59:47 2014 -0200

      vl: Don't silently change topology when all -smp options were set

      QEMU tries to change the "threads" option even if it was explicitly set
      in the command-line, and it shouldn't do that.

      The right thing to do when all options (cpus, sockets, cores, threds)
      are explicitly set is to sanity check them and abort in case they don't
      make sense (i.e. when sockets*cores*threads < cpus).

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c00cd99527d0d1b47a387239a7e3a8cf8ff82764
  Author: Andrew Jones <drjones@redhat.com>
  Date:   Fri Dec 19 00:59:46 2014 -0200

      vl: fix max_cpus check

      We should confirm max_cpus, which is >= smp_cpus, is
      <= the machine's true max_cpus, not just smp_cpus.

      Signed-off-by: Andrew Jones <drjones@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 719cac1ce20c8806303793b2501aedb9edf1bca3
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   Fri Dec 19 00:59:45 2014 -0200

      vl: Avoid unnecessary 'if' nesting

      Just a coding style change, to make other changes easier to review.

      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Andrew Jones <drjones@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4d91558d60c229f34819329728cf46ff71e13935
  Author: SeokYeon Hwang <syeon.hwang@samsung.com>
  Date:   Fri Oct 31 17:03:53 2014 +0900

      9pfs: changed to use event_notifier instead of qemu_pipe

      Changed to use event_notifier instead of qemu_pipe.
      It is necessary for porting 9pfs to Windows and MacOS.

      Signed-off-by: SeokYeon Hwang <syeon.hwang@samsung.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 364c3e6b8dd7912e01d19122d791b8c8f6df4f6c
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Wed Jan 7 14:11:38 2015 +0200

      vl.c: fix regression when reading machine type from config file

      After 'Machine as QOM' series the machine type input triggers
      the creation of the machine class.
      If the machine type is set in the configuration file, the machine
      class is not updated accordingly and remains the default.

      Fixed that by querying the machine options after the configuration
      file is loaded.

      Cc: qemu-stable@nongnu.org
      Reported-by: William Dauchy <william@gandi.net>
      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e76d442043ff50716457d5558c237b6e60345f53
  Author: Gal Hammer <ghammer@redhat.com>
  Date:   Wed Jan 7 10:38:35 2015 +0200

      char: restore stdio echo on resume from suspend.

      The monitor's auto-completion feature stopped working when stdio is used
      as an input and qemu was resumed after it was suspended (using ctrl-z).

      Signed-off-by: Gal Hammer <ghammer@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f1c5831ca3e3eafb89331233221768b64db113e8
  Merge: 11fe680 a3a292c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 18:55:29 2015 +0000

      Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-for-2.3' into staging

      Fixes an init-time check for parameter validity

      # gpg: Signature made Mon 05 Jan 2015 08:34:05 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-virtio-rng/tags/rng-for-2.3:
        virtio-rng: fix check for period_ms validity

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11fe680858653e32782b1c24f939e77427f285b4
  Merge: a4ba200 08f432a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 17:59:16 2015 +0000

      Merge remote-tracking branch 'remotes/amit/tags/for-2.3' into staging

      Migration fix for virtio-serial devices on bi-endian targets by David
      Gibson.

      # gpg: Signature made Mon 05 Jan 2015 07:26:07 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit/tags/for-2.3:
        virtio-serial: Don't keep a persistent copy of config space
        virtio_serial: Don't use vser->config.max_nr_ports internally

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a4ba200894e851f4df9be67eb2d091333a17f499
  Merge: 7d010ae 5aa8136
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 16:29:36 2015 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      More migration fixes and more record/replay preparations.  Also moves
      the sdhci-pci device id to make space for the rocker device.

      # gpg: Signature made Sat 03 Jan 2015 08:22:36 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream:
        pci: move REDHAT_SDHCI device ID to make room for Rocker
        block/iscsi: fix uninitialized variable
        pckbd: set bits 2-3-6-7 of the output port by default
        serial: refine serial_thr_ipending_needed
        gen-icount: check cflags instead of use_icount global
        translate: check cflags instead of use_icount global
        cpu-exec: add a new CF_USE_ICOUNT cflag
        target-ppc: pass DisasContext to SPR generator functions
        atomic: fix position of volatile qualifier

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b3e27c3aee8f5a96debfe0346e9c0e3a641a8516
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Fri Jan 9 08:50:53 2015 -0700

      vfio-pci: Fix interrupt disabling

      When disabling MSI/X interrupts the disable functions will leave the
      device in INTx mode (when available).  This matches how hardware
      operates, INTx is enabled unless MSI/X is enabled (DisINTx is handled
      separately).  Therefore when we really want to disable all interrupts,
      such as when removing the device, and we start with the device in
      MSI/X mode, we need to pass through INTx on our way to being
      completely quiesced.

      In well behaved situations, the guest driver will have shutdown the
      device and it will start vfio_exitfn() in INTx mode, producing the
      desired result.  If hot-unplug causes the guest to crash, we may get
      the device in MSI/X state, which will leave QEMU with a bogus handler
      installed.

      Fix this by re-ordering our disable routine so that it should always
      finish in VFIO_INT_NONE state, which is what all callers expect.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 29c6e6df492d81b1843e5dd999171bb84c6effea
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Fri Jan 9 08:50:53 2015 -0700

      vfio-pci: Fix BAR size overflow

      We use an unsigned int when working with the PCI BAR size, which can
      obviously overflow if the BAR is 4GB or larger.  This needs to change
      to a fixed length uint64_t.  A similar issue is possible, though even
      more unlikely, when mapping the region above an MSI-X table.  The
      start of the MSI-X vector table must be below 4GB, but the end, and
      therefore the start of the next mapping region, could still land at
      4GB.

      Suggested-by: Nishank Trivedi <nishank.trivedi@netapp.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>

  commit 7d010ae9e0079ea17d56cd961953d8832052c5fd
  Merge: 59a0419 4eab7a0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Jan 9 15:38:20 2015 +0000

      Merge remote-tracking branch 'remotes/mwalle/tags/lm32-fixes/20141229' into staging

      lm32: milkymist fixes and MAINTAINER update

      # gpg: Signature made Tue 30 Dec 2014 16:54:15 GMT using DSA key ID 3F98A378
      # gpg: Can't check signature: public key not found

      * remotes/mwalle/tags/lm32-fixes/20141229:
        MAINTAINERS: add myself to lm32 and milkymist
        milkymist: softmmu: fix event handling

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 59a0419856c9ed24e9ecd033db092b2e8f81a728
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:17 2015 +0200

      hw/ppc/mac_newworld: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-7-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d941fba0b5fa75604503aac9b3bcc2aa38b03cd0
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:16 2015 +0200

      hw/ppc/spapr: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-6-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1c2fb9b29c325a6944ce4ddddef9fe7e9af26bd
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:15 2015 +0200

      hw/ppc/mac_newworld: QOMified mac99 machines

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-5-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de77a243b3e703adae0a5c981914ff87cb99bdf6
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:14 2015 +0200

      hw/usb: simplified usb_enabled

      The argument is not longer used and the implementation
      uses now QOM instead of QemuOpts.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-4-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5e97b623c254a2c7b1f67b21f7aede93d995f4bd
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:13 2015 +0200

      hw/machine: added machine_usb wrapper

      Following QOM convention, object properties should
      not be accessed directly.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-3-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f8b6f8edac926bb979bd2b1d21d896c219b522c2
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:12 2015 +0200

      hw/ppc: modified the condition for usb controllers to be created for some ppc machines

      Some ppc machines create a default usb controller based on a 'machine condition'.
      Until now the logic was: create the usb controller if:
       -  the usb option was supplied in cli and value is true or
       -  the usb option was absent and both set_defaults and the machine
          condition were true.

      Modified the logic to:
      Create the usb controller if:
       - the machine condition is true and defaults are enabled or
       - the usb option is supplied and true.

      The main for this is to simplify the usb_enabled method.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Message-id: 1420550957-22337-2-git-send-email-marcel@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a1666142db623365b2e7619f01c1cbb72d62b514
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 07:51:50 2014 +0200

      acpi-build: make ROMs RAM blocks resizeable

      Use resizeable ram API so we can painlessly extend ROMs in the
      future.  Note: migration is not affected, as we are
      not actually changing the used length for RAM, which
      is the part that's migrated.

      Use this in acpi: reserve x16 more RAM space.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 60786ef33928332ccef21f99503f56d781fade0c
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 00:24:36 2014 +0200

      memory: API to allocate resizeable RAM MR

      Add API to allocate resizeable RAM MR.

      This looks just like regular RAM generally, but
      has a special property that only a portion of it
      (used_length) is actually used, and migrated.

      This used_length size can change across reboots.

      Follow up patches will change used_length for such blocks at migration,
      making it easier to extend devices using such RAM (notably ACPI,
      but in the future thinkably other ROMs) without breaking migration
      compatibility or wasting ROM (guest) memory.

      Device is notified on resize, so it can adjust if necessary.

      Note: nothing prevents making all RAM resizeable in this way.
      However, reviewers felt that only enabling this selectively will
      make some class of errors easier to detect.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b0cc3f839751bd83bdfcc480097c981c7aa1f3ec
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 17:55:43 2014 +0200

      arch_init: support resizing on incoming migration

      If block used_length does not match, try to resize it.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 62be4e3a5041e84304aa23637da623a205c53ecc
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 14:27:41 2014 +0200

      exec: qemu_ram_alloc_resizeable, qemu_ram_resize

      Add API to allocate "resizeable" RAM.
      This looks just like regular RAM generally, but
      has a special property that only a portion of it
      (used_length) is actually used, and migrated.

      This used_length size can change across reboots.

      Follow up patches will change used_length for such blocks at migration,
      making it easier to extend devices using such RAM (notably ACPI,
      but in the future thinkably other ROMs) without breaking migration
      compatibility or wasting ROM (guest) memory.

      Device is notified on resize, so it can adjust if necessary.

      qemu_ram_alloc_resizeable allocates this memory, qemu_ram_resize resizes
      it.

      Note: nothing prevents making all RAM resizeable in this way.
      However, reviewers felt that only enabling this selectively will
      make some class of errors easier to detect.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9b8424d5735278ca382f11adc7c63072b632ab83
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Dec 15 22:55:32 2014 +0200

      exec: split length -> used_length/max_length

      This patch allows us to distinguish between two
      length values for each block:
          max_length - length of memory block that was allocated
          used_length - length of block used by QEMU/guest

      Currently, we set used_length - max_length, unconditionally.
      Follow-up patches allow used_length <= max_length.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c8d6f66ae7d0ce5f3622c19e29a2333d28dc1e9a
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Nov 17 17:54:07 2014 +0200

      exec: cpu_physical_memory_set/clear_dirty_range

      Make cpu_physical_memory_set/clear_dirty_range
      behave symmetrically.

      To clear range for a given client type only, add
      cpu_physical_memory_clear_dirty_range_type.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e7af4c67300b3f9382e96f7a6741a5992116b2d2
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Tue Dec 16 11:21:23 2014 +0200

      memory: add memory_region_set_size

      Add API to change MR size.
      Will be used internally for RAM resize.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 75c74ccbe1d4175edb79c6f810c2207dcf5edb22
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:17 2015 +0200

      hw/ppc/mac_newworld: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4ee9ced979e68522ee38ea759e7630ac70f15fa8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:16 2015 +0200

      hw/ppc/spapr: simplify usb controller creation logic

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b8cbc738de38f2a669de9920fc0b0ee14c1d2dd8
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:15 2015 +0200

      hw/ppc/mac_newworld: QOMified mac99 machines

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 09f28e5b51e0fb822021efd8396057c818927775
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:14 2015 +0200

      hw/usb: simplified usb_enabled

      The argument is not longer used and the implementation
      uses now QOM instead of QemuOpts.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 759bf45d81a892c359fa1a3848c36dcd74b6a42b
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:13 2015 +0200

      hw/machine: added machine_usb wrapper

      Following QOM convention, object properties should
      not be accessed directly.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit c760dbb9dc4dfceeb5d4ae07876b10da58d4c630
  Author: Marcel Apfelbaum <marcel@redhat.com>
  Date:   Tue Jan 6 15:29:12 2015 +0200

      hw/ppc: modified the condition for usb controllers to be created for some ppc machines

      Some ppc machines create a default usb controller based on a 'machine condition'.
      Until now the logic was: create the usb controller if:
       -  the usb option was supplied in cli and value is true or
       -  the usb option was absent and both set_defaults and the machine
          condition were true.

      Modified the logic to:
      Create the usb controller if:
       - the machine condition is true and defaults are enabled or
       - the usb option is supplied and true.

      The main for this is to simplify the usb_enabled method.

      Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2f285bdd54bb2ff25a213b3b77e9bf46f4306320
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:22:16 2014 +0000

      target-ppc: Cast ssize_t to size_t before printing with %zx

      The mingw32 compiler complains about trying to print variables of type
      ssize_t with the %z format string specifier. Since we're printing it
      as unsigned hex anyway, cast to size_t to silence the warning.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 466976d9eed8d618aed93cb1fac04845e86253cf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 22:22:15 2014 +0000

      target-ppc: Mark SR() and gen_sync_exception() as !CONFIG_USER_ONLY

      The functions SR() and gen_sync_exception() are only used in softmmu
      configs; wrap them in #ifndef CONFIG_USER_ONLY to suppress clang warnings
      on the linux-user builds.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 82e345f57e6482cef960677613125c5aaf2b1654
  Author: Amit Tomar <Amit.Tomar@freescale.com>
  Date:   Fri Dec 19 14:20:37 2014 +0000

      PPC: e500: Fix GPIO controller interrupt number

      The GPIO controller lives at IRQ 47, not 43 on real hardware. This is a problem
      because IRQ 43 is occupied by the I2C controller which we want to implement
      next, so we'd have a conflict on that IRQ number.

      Move the GPIO controller to IRQ 47 where it belongs.

      Signed-off-by: Amit Singh Tomar <amit.tomar@freescale.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f83c2378bb412b205e9d14dca2f7758d3d23cc88
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:37 2014 -0600

      target-ppc: Introduce Privileged TM Noops

      Add the supervisory Transactional Memory instructions treclaim. and
      trechkpt.  The implementation is a degenerate one that simply
      checks privileged state, TM availability and then sets CR[0] to
      0b0000, just like the unprivileged noops.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aeedd58234e7f211bcd6d0ad04cdc60c2a967aca
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:36 2014 -0600

      target-ppc: Introduce tcheck

      Add a degenerate implementation of the Transaction Check (tcheck)
      instruction.  Since transaction always immediately fail, this
      implementation simply sets CR[BF] to 0b1000, i.e. TDOOMED = 1
      and MSR[TS] == 0.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 56a846157edaba3389eb141e104774451d82ce51
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:35 2014 -0600

      target-ppc: Introduce TM Noops

      Add degenerate implementations of the non-privileged Transactional
      Memory instructions tend., tabort*. and tsr.  This implementation
      simply checks the MSR[TM] bit and then sets CR0 to 0b0000.  This
      is a reasonable degenerate implementation since transactions are
      never allowed to begin and hence MSR[TS] is always 0b00.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 0ff93d11bc0890b2569f748266c04f4417ec3233
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:34 2014 -0600

      target-ppc: Introduce tbegin

      Provide a degenerate implementation of the tbegin instruction.  This
      implementation always fails the transaction, recording the failure
      per Book II Section 5.3.2 of the Power ISA V2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit aac862379ceaa724aba2ba9f4b825479c1401b1a
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:33 2014 -0600

      target-ppc: Introduce TEXASRU Bit Fields

      Define mnemonics for the various bit fields in the Transaction
      EXception And Summary Register (TEXASR).
      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 3e28c5e363aaf3de8b99acb662b7488ed6b49197
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:32 2014 -0600

      target-ppc: Power8 Supports Transactional Memory

      The Power8 processor implements the Transactional Memory Facility
      as defined in Power ISA 2.07.  Update the initialization code to
      indicate this.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 69d1a9377453d78ba2279fa56ae9623b3cd98673
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:31 2014 -0600

      target-ppc: Introduce tm_enabled Bit to CPU State

      Add a bit (tm_enabled) to CPU state that mirrors the MSR[TM] bit.
      This is analogous to the other "available" bits in the MSR (FP,
      VSX, etc.).

      NOTE: Since MSR[TM] occupies big-endian bit 31, the code is wrapped
      with a PPC64 bit check.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e43668a7d20e5d2dfe92b2f3426280b2a351333c
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:30 2014 -0600

      target-ppc: Introduce Feature Flag for Transactional Memory

      Add a flag (POWERPC_FLAG_TM) for the Transactional Memory
      Facility introduced in Power ISA 2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit f90468b6465f64d4f5cf24ad81142c51f37320cf
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Thu Dec 18 10:34:29 2014 -0600

      target-ppc: Introduce Instruction Type for Transactional Memory

      Add a category (PPC2_TM) for the Transactional Memory instructions
      introduced in Power ISA 2.07.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 549cfe5d5d315babec92d4e7043bb872f61c838a
  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  Date:   Tue Dec 2 15:32:46 2014 +1100

      pseries: Update SLOF firmware image to 20141202

      The changelog is:
        > version: update to 20141202
        > ipv4: Fix send packet across a subnet
        > pci: scan only type 0 and type 1
        > usb-xhci: support xhci extended capabilities
        > Fix term-io-key to also work when stdin has not been set yet
        > net-snk: llfw startup is using the wrong offset to handler
        > net-snk: Make call_client_interface() a bit more ABI compliant
        > net-snk: Remove custom printf version
        > net-snk: Sanitize our .lds file
        > net-snk: Avoid type clash for stdin & stdout
        > net-snk: use socket descriptor in the network stack
        > net-snk: Remove printk() in favor of printf()
        > net-snk: Remove redundant prototypes
        > net-snk: Remove unused timer functions
        > net-snk: Remove some unused PCI functions
        > net-snk: Remove module system
        > net-snk: Remove insmod/rmmod
        > net-snk: Remove snk_kernel_interface and related definitions
        > net-snk: Remove pci/vio_config gunk
        > js2x: Fix build
        > net-snk: Remoe some now unused "kernel" functions
        > rtas: Improve error handling in instantiate-rtas
        > version: update to 20140827
        > Add private HCALL to inform updated RTAS base and entry
        > xhci: fix port assignment

      Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 5f9490de566c5b092a6cfedc3c7a37a9c9dee917
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Mon Dec 8 13:48:02 2014 +1100

      PPC: Fix crash on spapr_tce_table_finalize()

      spapr_tce_table_finalize() can SEGV if the object was not previously
      realized.  In particular this can be triggered by running
               qemu-system-ppc -device spapr-tce-table,?

      The basic problem is that we have mismatched initialization versus
      finalization: spapr_tce_table_finalize() is attempting to undo things that
      are done in spapr_tce_table_realize(), not an instance_init function.

      Therefore, replace spapr_tce_table_finalize() with
      spapr_tce_table_unrealize().

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 77bad151fbd2b2eed1e959ecc2c3f2ee2f080f6c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 15:01:01 2014 +0100

      ppc: do not use get_clock_realtime()

      Use the external qemu-timer API instead.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2bf9febc95e5bcef8edb10ebc967325917b9c958
  Author: Sergey Fedorov <serge.fdrv@gmail.com>
  Date:   Thu Dec 11 18:45:05 2014 +0300

      device-tree: fix memory leak

      Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e6b8fd246c19701b05f5b65a56b0cc91bbd05ac6
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:30 2014 +1100

      spapr: Fix stale HTAB during live migration (TCG)

      If a TCG guest reboots during a running migration HTAB entries are not
      marked dirty, and the destination boots with an invalid HTAB.

      When a reboot occurs, explicitly mark the current HTAB dirty after
      clearing it.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 338c25b6929b5436a42aaa106c7e9136cf1ff4dc
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:29 2014 +1100

      spapr: Fix integer overflow during migration (TCG)

      The n_valid and n_invalid fields are unsigned short integers but it is
      possible to have more than 65535 entries in a contiguous hunk, overflowing
      the field. This results in an incorrect HTAB being sent to the destination
      during migration.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 01a579729b2e614bd02b25c8504976eeecb64eff
  Author: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
  Date:   Mon Nov 17 15:12:28 2014 +1100

      spapr: Fix stale HTAB during live migration (KVM)

      If a guest reboots during a running migration, changes to the
      hash page table are not necessarily updated on the destination.
      Opening a new file descriptor to the HTAB forces the migration
      handler to resend the entire table.

      Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
      Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e094c4c12f33a1c965f5af02f33968a337348739
  Author: Cédric Le Goater <clg@fr.ibm.com>
  Date:   Mon Nov 3 16:14:50 2014 +0100

      target-ppc: explicitly save page table headers in big endian

      Currently, when the page tables are saved, the kvm_get_htab_header structs
      and the ptes are assumed being big endian and dumped as a indistinct blob
      in the statefile. This is no longer true when the host is little endian
      and this breaks restoration.

      This patch unfolds the kvmppc_save_htab routine to write explicitly the
      kvm_get_htab_header structs in big endian. The ptes are left untouched.

      Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 58dd0a478784d4b732a695eb23bf88f4bbf33f5f
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:04 2014 -0600

      target-ppc: Eliminate set_fprf Argument From helper_compute_fprf

      The set_fprf argument to the helper_compute_fprf helper function
      is no longer necessary -- the helper is only invoked when FPSCR[FPRF]
      is going to be set.

      Eliminate the unnecessary argument from the function signature and
      its corresponding implementation.  Change the return value of the
      helper to "void".  Update the name of the local variable "ret" to
      "fprf", which now makes more sense.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 7d45556effa4bf1557ba765b6b94390fb7d06615
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:03 2014 -0600

      target-ppc: Eliminate set_fprf Argument From gen_compute_fprf

      The set_fprf argument to the gen_compute_fprf() utility is no longer
      needed -- gen_compute_fprf() is now called only when FPRF is actually
      computed and set.  Eliminate the obsolete argument.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 00e6fd3e03b8df5553c6ea02bd95630549b0e2d1
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:02 2014 -0600

      target-ppc: Fully Migrate to gen_set_cr1_from_fpscr

      Eliminate the set_rc argument from the gen_compute_fprf utility and
      the corresponding (and incorrect) implementation.  Replace it with
      calls to the gen_set_cr1_from_fpscr() utility.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 14ba79c73a1c2db78becef171ec2f73606c1d7e1
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:01 2014 -0600

      target-ppc: mffs. Should Set CR1 from FPSCR Bits

      Update the Move From FPSCR (mffs.) instruction to correctly
      set CR[1] from FPSCR[FX,FEX,VX,OX].

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 4814f2d116c057d6fdfd57f3b979c77d5668e878
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:46:00 2014 -0600

      target-ppc: Fix Floating Point Move Instructions That Set CR1

      The Floating Point Move instructions (fmr., fabs., fnabs., fneg.,
      and fcpsgn.) incorrectly copy FPSCR[FPCC] instead of [FX,FEX,VX,OX].
      Furthermore, the current code does this via a call to gen_compute_fprf,
      which is awkward since these instructions do not actually set FPRF.

      Change the code to use the gen_set_cr1_from_fpscr utility.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      [agraf: whitespace fixes]
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit b748863a7f7d2996255dd2cb5a20e49785cc7387
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Wed Nov 12 15:45:59 2014 -0600

      target-ppc: VXSQRT Should Not Be Set for NaNs

      The Power ISA square root instructions (fsqrt[s], frsqrte[s]) must
      set the FPSCR[VXSQRT] flag when operating on a negative value.
      However, NaNs have no sign and therefore this flag should not
      be set when operating on one.

      Change the order of the checks in the helper code.  Move the
      SNaN-to-QNaN macro to the top of the file so that it can be
      re-used.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2791128e2fa8b96d0b81622404655529b0b4fd4d
  Author: Tom Musta <tommusta@gmail.com>
  Date:   Mon Nov 17 14:58:31 2014 -0600

      target-ppc: Load/Store Vector Element Storage Alignment

      The Load Vector Element Indexed and Store Vector Element Indexed
      instructions compute an effective address in the usual manner.
      However, they truncate that address to the natural boundary.
      For example, the lvewx instruction will ignore the least significant
      two bits of the address and thus load the aligned word of storage.

      Fix the generators for these instruction to properly perform this
      truncation.

      Signed-off-by: Tom Musta <tommusta@gmail.com>
      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit cb3778a0455a2e5a48d7ef0ec8dc656313820389
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Nov 12 22:44:52 2014 +0100

      PPC: e500 pci host: Add support for ATMUs

      The e500 PCI controller has configurable windows that allow a guest OS
      to selectively map parts of the PCI bus space to CPU address space and
      to selectively map parts of the CPU address space for DMA requests into
      PCI visible address ranges.

      So far, we've simply assumed that this mapping is 1:1 and ignored it.

      However, the PCICSRBAR (CCSR mapped in PCI bus space) always has to live
      inside the first 32bits of address space. This means if we always treat
      all mappings as 1:1, this map will collide with our RAM map from the CPU's
      point of view.

      So this patch adds proper ATMU support which allows us to keep the PCICSRBAR
      below 32bits local to the PCI bus and have another, different window to PCI
      BARs at the upper end of address space. We leverage this on e500plat though,
      mpc8544ds stays virtually 1:1 like it was before, but now also goes via ATMU.

      With this patch, I can run guests with lots of RAM and not coincidently access
      MSI-X mappings while I really want to access RAM.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 44045ce9740945056a58ecb53d2af9ae00083632
  Author: Alexander Graf <agraf@suse.de>
  Date:   Wed Nov 12 22:35:33 2014 +0100

      PPC: mpc8554ds: Tell user about exceeding RAM limits

      The mpc8544ds board only supports up to 3GB of RAM due to its limited
      address space.

      When the user requests more, abort and tell him that he should use less.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit e6b4e5f4795b2591fd91bea671e3e22e08fd0e75
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Nov 7 17:07:03 2014 +0100

      PPC: e500: Move CCSR and MMIO space to upper end of address space

      On e500 we're basically guaranteed to have 36bits of physical address space
      available for our enjoyment. Older chips (like the mpc8544) only had 32bits,
      but everything from e500v2 onwards bumped it up.

      It's reasonably safe to assume that if you're using the PV machine, your guest
      kernel is configured to support 36bit physical address space. So in order to
      support more guest RAM, we can move CCSR and other MMIO windows right below the
      end of our 36bit address space, just like later SoC versions of e500 do.

      With this patch, I'm able to successfully spawn an e500 VM with -m 48G.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit 2eaaac1f01014bc7a3597847646a814539494fca
  Author: Alexander Graf <agraf@suse.de>
  Date:   Fri Nov 7 16:50:44 2014 +0100

      PPC: e500: Move CCSR definition to params

      We want to have different MMIO region offsets for the mpc8544ds machine
      and our e500 PV machine, so move the definitions of those into the machine
      specific params struct.

      Signed-off-by: Alexander Graf <agraf@suse.de>

  commit ea259acae5b2d88ee6e92caf1cf44eb501eaef47
  Author: Paul Moore <pmoore@redhat.com>
  Date:   Wed Dec 17 15:50:09 2014 -0500

      seccomp: add mbind() to the syscall whitelist

      The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to
      set the policy for a memory range.  Add the syscall to the seccomp
      sandbox whitelist.

      Signed-off-by: Paul Moore <pmoore@redhat.com>
      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

  commit aa49668cc3cc680187e9e9b1d2eb8d64d72bff3e
  Author: Eduardo Otubo <eduardo.otubo@profitbricks.com>
  Date:   Fri Dec 19 17:13:38 2014 +0100

      seccomp: typo in configure error message

      Error message was misleading people to install wrong version of
      libseccomp.

      Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>

  commit a3a292c420d2fec3c07a7ca56fbb064cd57a298a
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Thu Dec 11 13:17:42 2014 +0530

      virtio-rng: fix check for period_ms validity

      This was reported for this warning:

      hw/virtio/virtio-rng.c:150:31: warning: logical not is only applied to
      the left hand side of comparison [-Wlogical-not-parentheses]

      Reported-by: dcb
      Suggested-by: dcb
      Bug: https://bugs.launchpad.net/qemu/+bug/1393486
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 08f432aa3eb62d6d781eaa085e161e8628a9a538
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Dec 19 14:57:27 2014 +1100

      virtio-serial: Don't keep a persistent copy of config space

      The 'config' field in the VirtIOSerial structure keeps a copy of the virtio
      console's config space as visible to the guest, that is to say, in guest
      endianness.  This is fiddly to maintain, because on some targets, such as
      powerpc, the "guest endianness" can change when a new guest OS boots.

      In fact, there's no need to maintain such a guest view of config space -
      instead we can reconstruct it from host-format data when it is accessed
      with get_config.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit f2f6e00b2e27b65edaa6ce5cb01770c973cbf8fb
  Author: David Gibson <david@gibson.dropbear.id.au>
  Date:   Fri Dec 19 14:57:26 2014 +1100

      virtio_serial: Don't use vser->config.max_nr_ports internally

      A number of places in the virtio_serial driver retrieve the number of ports
      from vser->config.max_nr_ports, which is guest-endian.  But for internal
      users, we already have a host-endian copy of the number of ports in
      vser->serial.max_virtserial_ports.  Using that instead of the config field
      removes the need for easy-to-forget byteswapping.

      In particular this fixes a bug on incoming migration, where we don't adjust
      the endianness vser->config correctly, because it hasn't yet been loaded
      from the migration stream when virtio_serial_load_device() is called.

      Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 5aa8136020f47fbd38c458b9834c783cb7063db8
  Author: Scott Feldman <sfeldma@gmail.com>
  Date:   Mon Dec 29 21:14:02 2014 -0800

      pci: move REDHAT_SDHCI device ID to make room for Rocker

      The rocker device uses same PCI device ID as sdhci.  Since rocker device driver
      has already been accepted into Linux 3.18, and REDHAT_SDHCI device ID isn't
      used by any drivers, it's safe to move REDHAT_SDHCI device ID, avoiding
      conflict with rocker.

      Signed-off-by: Scott Feldman <sfeldma@gmail.com>
      Signed-off-by: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit debfb917a4f9c0784772c86f110f2bcd22e5a14f
  Author: Peter Wu <peter@lekensteyn.nl>
  Date:   Tue Dec 23 16:30:41 2014 +0100

      block/iscsi: fix uninitialized variable

      'ret' was never initialized in the success path.

      Signed-off-by: Peter Wu <peter@lekensteyn.nl>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d13c0404092eb46e548754a47a808da1bb8d4fd0
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 08:55:19 2014 +0100

      pckbd: set bits 2-3-6-7 of the output port by default

      OSes typically write 0xdd/0xdf to turn the A20 line off and on.  This
      has bits 2-3-6-7 on, so that the output port subsection is migrated.
      Change the reset value and migration default to include those four
      bits, thus avoiding that the subsection is migrated.

      This strictly speaking changes guest ABI, but the long time during which
      we have not migrated the value means that the guests really do not care
      much; so the change is for all machine types.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bfa7362889d05d6951493d1c298289b39cf9bf86
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 08:51:57 2014 +0100

      serial: refine serial_thr_ipending_needed

      If the THR interrupt is disabled, there is no need to migrate thr_ipending
      because LSR.THRE will be sampled again when the interrupt is enabled.
      (This is the behavior that is not documented in the datasheet, but
      relied on by Windows!)

      Note that in this case IIR will never be 0x2 so, if thr_ipending were
      to be one, QEMU would produce the subsection.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit cd42d5b23691ad73edfd6dbcfc935a960a9c5a65
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:40:05 2014 +0300

      gen-icount: check cflags instead of use_icount global

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bd79255d2571a3c68820117caf94ea9afe1d527e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:59 2014 +0300

      translate: check cflags instead of use_icount global

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4eab7a0a2394275a611a19aef6619402ad524b63
  Author: Michael Walle <michael@walle.cc>
  Date:   Sun Nov 2 18:11:11 2014 +0100

      MAINTAINERS: add myself to lm32 and milkymist

      Add myself to lm32 and milkymist files.

      Signed-off-by: Michael Walle <michael@walle.cc>

  commit 857cccac0d9450d9be6af1ca3e5b7730b408b33c
  Author: Michael Walle <michael@walle.cc>
  Date:   Sat Oct 4 20:00:07 2014 +0200

      milkymist: softmmu: fix event handling

      Keys which send more than one scancode (esp. windows key) weren't handled
      correctly since commit 1ff5eedd. Two events were put into the input event
      queue but only one was processed. This fixes this by fetching all pending
      events in the callback handler.

      Signed-off-by: Michael Walle <michael@walle.cc>
      Cc: Gerd Hoffmann <kraxel@redhat.com>

  commit ab0302ee764fd702465aef6d88612cdff4302809
  Merge: 03de06d aa35106
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 15:05:22 2014 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141223' into staging

      target-arm queue:
       * enable 32-bit EL3 (TrustZone) for vexpress and virt boards
       * add fw_cfg device to virt board for UEFI firmware config
       * support passing commandline kernel/initrd to firmware

      # gpg: Signature made Tue 23 Dec 2014 13:50:33 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20141223: (31 commits)
        hw/arm/virt: enable passing of EFI-stubbed kernel to guest UEFI firmware
        hw/arm: pass pristine kernel image to guest firmware over fw_cfg
        hw/loader: split out load_image_gzipped_buffer()
        arm: add fw_cfg to "virt" board
        fw_cfg_mem: expose the "data_width" property with fw_cfg_init_mem_wide()
        fw_cfg_mem: introduce the "data_width" property
        exec: allows 8-byte accesses in subpage_ops
        fw_cfg_mem: flip ctl_mem_ops and data_mem_ops to DEVICE_BIG_ENDIAN
        fw_cfg_mem: max access size and region size are the same for data register
        fw_cfg: move boards to fw_cfg_init_io() / fw_cfg_init_mem()
        fw_cfg: hard separation between the MMIO and I/O port mappings
        target-arm: add cpu feature EL3 to CPUs with Security Extensions
        target-arm: Disable EL3 on unsupported machines
        target-arm: Breakout integratorcp and versatilepb cpu init
        target-arm: Set CPU has_el3 prop during virt init
        target-arm: Enable CPU has_el3 prop during VE init
        target-arm: Add arm_boot_info secure_boot control
        target-arm: Add ARMCPU secure property
        target-arm: Add feature unset function
        target-arm: Add virt machine secure property
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 03de06dde54df1f64bb099efe22edfa773b16e8e
  Merge: 7e58e2a dcbfc5c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 23 14:01:13 2014 +0000

      Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20141222.0' into staging

      VFIO updates:
      - Conversion to tracepoints (Eric Auger)
      - Fix memory listener address space (Frank Blaschka)
      - Move to hw/vfio/ and split common vs pci (Eric Auger & Kim Phillips)
      - Trivial error_report() fixes (Alex Williamson)

      In addition to enabling S390 with the address space fix and updating
      to use tracepoints rather than compile time debug, this set of patches
      moves hw/misc/vfio.c to hw/vfio/ and paves the way for vfio-platform
      support by splitting common functionality from PCI specific code.

      # gpg: Signature made Mon 22 Dec 2014 20:19:43 GMT using RSA key ID 3BB08B22
      # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex@shazbot.org>"
      # gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
      # gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

      * remotes/awilliam/tags/vfio-update-20141222.0:
        vfio: Cleanup error_report()s
        hw/vfio: create common module
        hw/vfio/pci: use name field in format strings
        hw/vfio/pci: rename group_list into vfio_group_list
        hw/vfio/pci: split vfio_get_device
        hw/vfio/pci: Introduce VFIORegion
        hw/vfio/pci: handle reset at VFIODevice
        hw/vfio/pci: add type, name and group fields in VFIODevice
        hw/vfio/pci: introduce minimalist VFIODevice with fd
        hw/vfio/pci: generalize mask/unmask to any IRQ index
        hw/vfio/pci: Rename VFIODevice into VFIOPCIDevice
        vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio
        vfio: fix adding memory listener to the right address space
        vfio: migration to trace points

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0266359e57987d6be53fbcb885f2dd39c1dae940
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:53 2014 +0300

      cpu-exec: add a new CF_USE_ICOUNT cflag

      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 69b058c8818bdd4da48b3b9dd1a5d64490c7df17
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 13:39:48 2014 +0300

      target-ppc: pass DisasContext to SPR generator functions

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2cbcfb281afa041a41f6e4c4da0f5c9314084604
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Tue Nov 4 14:35:28 2014 +0100

      atomic: fix position of volatile qualifier

      What needs to be volatile is not the pointer, but the pointed-to
      value!

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit aa351061dbb0e3054db11c00a69395785c4186c8
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:45 2014 +0100

      hw/arm/virt: enable passing of EFI-stubbed kernel to guest UEFI firmware

      The virt board already ensures mutual exclusion between -bios and -pflash
      unit#0; we only need to set "bootinfo.firmware_loaded", introduced in the
      previous patch, if either of those options was used to load the guest
      firmware.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-12-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 07abe45c4814d42f3aca879d7932c5bc90d98bdf
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:44 2014 +0100

      hw/arm: pass pristine kernel image to guest firmware over fw_cfg

      Introduce the new boolean field "arm_boot_info.firmware_loaded". When this
      field is set, it means that the portion of guest DRAM that the VCPU
      normally starts to execute, or the pflash chip that the VCPU normally
      starts to execute, has been populated by board-specific code with
      full-fledged guest firmware code, before the board calls
      arm_load_kernel().

      Simultaneously, "arm_boot_info.firmware_loaded" guarantees that the board
      code has set up the global firmware config instance, for arm_load_kernel()
      to find with fw_cfg_find().

      Guest kernel (-kernel) and guest firmware (-bios, -pflash) has always been
      possible to specify independently on the command line. The following cases
      should be considered:

      nr  -bios    -pflash  -kernel  description
                   unit#0
      --  -------  -------  -------  -------------------------------------------
      1   present  present  absent   Board code rejects this case, -bios and
          present  present  present  -pflash unit#0 are exclusive. Left intact
                                     by this patch.

      2   absent   absent   present  Traditional kernel loading, with qemu's
                                     minimal board firmware. Left intact by this
                                     patch.

      3   absent   present  absent   Preexistent case for booting guest firmware
          present  absent   absent   loaded with -bios or -pflash. Left intact
                                     by this patch.

      4   absent   absent   absent   Preexistent case for not loading any
                                     firmware or kernel up-front. Left intact by
                                     this patch.

      5   present  absent   present  New case introduced by this patch: kernel
          absent   present  present  image is passed to externally loaded
                                     firmware in unmodified form, using fw_cfg.

      An easy way to see that this patch doesn't interfere with existing cases
      is to realize that "info->firmware_loaded" is constant zero at this point.
      Which makes the "outer" condition unchanged, and the "inner" condition
      (with the fw_cfg-related code) dead.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-11-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7d48a0f7217474899c5f5920b21f4cfdf4efa8d1
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:43 2014 +0100

      hw/loader: split out load_image_gzipped_buffer()

      In the next patch we'd like to reuse the image decompression facility
      without installing the output as a ROM at a specific guest-phys address.

      In addition, expose LOAD_IMAGE_MAX_GUNZIP_BYTES, because that's a
      straightforward "max_sz" argument for the new load_image_gzipped_buffer().

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-10-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 578f3c7b083514b4fec0bf8fa0617934cdbdf826
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:42 2014 +0100

      arm: add fw_cfg to "virt" board

      fw_cfg already supports exposure over MMIO (used in ppc/mac_newworld.c,
      ppc/mac_oldworld.c, sparc/sun4m.c); we can easily add it to the "virt"
      board.

      Because MMIO access is slow on ARM KVM, we enable the guest, with
      fw_cfg_init_mem_wide(), to transfer up to 8 bytes with a single access.
      This has been measured to speed up transfers up to 7.5-fold, relative to
      single byte data access, on both ARM KVM and x86_64 TCG.

      The MMIO register block of fw_cfg is advertized in the device tree. As
      base address we pick 0x09020000, which conforms to the comment preceding
      "a15memmap": it falls in the miscellaneous device I/O range 128MB..256MB,
      and it is aligned at 64KB. The DTB properties follow the documentation in
      the Linux source file "Documentation/devicetree/bindings/arm/fw-cfg.txt".

      fw_cfg automatically exports a number of files to the guest; for example,
      "bootorder" (see fw_cfg_machine_reset()).

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-9-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6c87e3d5967a1d731b5f591a8f0ee6c319c14ca8
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:41 2014 +0100

      fw_cfg_mem: expose the "data_width" property with fw_cfg_init_mem_wide()

      We rebase fw_cfg_init_mem() to the new function for compatibility with
      current callers.

      The behavior of the (big endian) multi-byte data reads is best shown
      with a qtest session.  Here, we are reading the first six bytes of
      the UUID

          $ arm-softmmu/qemu-system-arm -M virt -machine accel=qtest \
               -qtest stdio -uuid 4600cb32-38ec-4b2f-8acb-81c6ea54f2d8
      >>> writew 0x9020008 0x0200
      <<< OK
      >>> readl 0x9020000
      <<< OK 0x000000004600cb32

      Remember this is big endian.  On big endian machines, it is stored
      directly as 0x46 0x00 0xcb 0x32.

      On a little endian machine, we have to first swap it, so that it becomes
      0x32cb0046.  When written to memory, it becomes 0x46 0x00 0xcb 0x32
      again.

      Reading byte-by-byte works too, of course:

      >>> readb 0x9020000
      <<< OK 0x0000000000000038
      >>> readb 0x9020000
      <<< OK 0x00000000000000ec

      Here only a single byte is read at a time, so they are read in order
      similar to the 1-byte data port that is already in PPC and SPARC
      machines.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-8-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit cfaadf0e89e7c2a47462d5f96390c9a9b4de037c
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:40 2014 +0100

      fw_cfg_mem: introduce the "data_width" property

      The "data_width" property is capable of changing the maximum valid access
      size to the MMIO data register, and resizes the memory region similarly,
      at device realization time.

      The default value of "data_memwidth" is set so that we don't yet diverge
      from "fw_cfg_data_mem_ops".

      Most of the fw_cfg_mem users will stick with the default, and for them we
      should continue using the statically allocated "fw_cfg_data_mem_ops". This
      is beneficial for debugging because gdb can resolve pointers referencing
      static objects to the names of those objects.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-7-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ff6cff7554be06e95f8d712f66cd16bd6681c746
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Dec 22 13:11:39 2014 +0100

      exec: allows 8-byte accesses in subpage_ops

      Otherwise fw_cfg accesses are split into 4-byte ones before they reach the
      fw_cfg ops / handlers.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d789c84547abaaf82828b20998aee618b9327261
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:38 2014 +0100

      fw_cfg_mem: flip ctl_mem_ops and data_mem_ops to DEVICE_BIG_ENDIAN

      The standalone selector port (fw_cfg_ctl_mem_ops) is only used by big
      endian guests to date (*), hence this change doesn't regress them. Paolo
      and Alex have suggested / requested an explicit DEVICE_BIG_ENDIAN setting
      here, for clarity.

      (*) git grep -l fw_cfg_init_mem

          hw/nvram/fw_cfg.c
          hw/ppc/mac_newworld.c
          hw/ppc/mac_oldworld.c
          hw/sparc/sun4m.c
          include/hw/nvram/fw_cfg.h

      The standalone data port (fw_cfg_data_mem_ops) has max_access_size 1 (for
      now), hence changing its endianness doesn't change behavior for existing
      guest code.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86099db3823fec1800225f89544014a98b227ed9
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:37 2014 +0100

      fw_cfg_mem: max access size and region size are the same for data register

      Make it clear that the maximum access size to the MMIO data register
      determines the full size of the memory region.

      Currently the max access size is 1.

      This patch doesn't change behavior.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 66708822cd3007ae1ec5104d274a861148725e7a
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:36 2014 +0100

      fw_cfg: move boards to fw_cfg_init_io() / fw_cfg_init_mem()

      This allows us to drop the fw_cfg_init() shim and to enforce the possible
      mappings at compile time.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5712db6ae5101db645f71edc393368cd59bfd314
  Author: Laszlo Ersek <lersek@redhat.com>
  Date:   Mon Dec 22 13:11:35 2014 +0100

      fw_cfg: hard separation between the MMIO and I/O port mappings

      We are going to introduce a wide data register for fw_cfg, but only for
      the MMIO mapped device. The wide data register will also require the
      tightening of endiannesses.

      However we don't want to touch the I/O port mapped fw_cfg device at all.

      Currently QEMU provides a single fw_cfg device type that can handle both
      I/O port and MMIO mapping. This flexibility is not actually exploited by
      any board in the tree, but it renders restricting the above changes to
      MMIO very hard.

      Therefore, let's derive two classes from TYPE_FW_CFG: TYPE_FW_CFG_IO and
      TYPE_FW_CFG_MEM.

      TYPE_FW_CFG_IO incorporates the base I/O port and the related combined
      MemoryRegion. (NB: all boards in the tree that use the I/O port mapped
      flavor opt for the combined mapping; that is, when the data port overlays
      the high address byte of the selector port. Therefore we can drop the
      capability to map those I/O ports separately.)

      TYPE_FW_CFG_MEM incorporates the base addresses for the MMIO selector and
      data registers, and their respective MemoryRegions.

      The "realize" and "props" class members are specific to each new derived
      class, and become unused for the base class. The base class retains the
      "reset" member and the "vmsd" member, because the reset functionality and
      the set of migrated data are not specific to the mapping.

      The new functions fw_cfg_init_io() and fw_cfg_init_mem() expose the
      possible mappings in separation. For now fw_cfg_init() is retained as a
      compatibility shim that enforces the above assumptions.

      Signed-off-by: Laszlo Ersek <lersek@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1419250305-31062-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c0ccb02db46c72b4b0fa8a475a6890c1e28064f0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Mon Dec 15 17:09:52 2014 -0600

      target-arm: add cpu feature EL3 to CPUs with Security Extensions

      Set ARM_FEATURE_EL3 feature for CPUs that implement Security Extensions.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-16-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 61e2f3521c9ee2dc3ebab2e84329d5ebd10d8518
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:51 2014 -0600

      target-arm: Disable EL3 on unsupported machines

      Disables the CPU ARM_FEATURE_EL3 featuere on machine models that can be
      configured to use Cortex-A9, Cortex-A15, and ARM1176 but don't officially
      support EL3.  This preserves backwards compatibility.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-15-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 223a72f1179dc0b56bae3b01bc3e3208ef100fcc
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:50 2014 -0600

      target-arm: Breakout integratorcp and versatilepb cpu init

      This commit changes the integratorcp and versatilepb CPU initialization from
      using the generic ARM cpu_arm_init function to doing it inline.  This is
      necessary in order to allow CPU configuration changes to occur between CPU
      instance initialization and realization.  Specifically, this change is in
      preparation for disabling CPU EL3 support.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-14-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e5a5604f8fdabfc788fbf75354b7f92eb349dcff
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:49 2014 -0600

      target-arm: Set CPU has_el3 prop during virt init

      Adds setting of the CPU has_el3 property based on the virt machine
      secure state property during initialization.  This enables/disables EL3
      state during start-up.  Changes include adding an additional secure state
      boolean during virt CPU initialization.  Also disables the ARM secure boot
      by default.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418684992-8996-13-git-send-email-greg.bellows@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 12d027f132246826c4358f3734d738a3385bf75f
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:48 2014 -0600

      target-arm: Enable CPU has_el3 prop during VE init

      Adds setting of the CPU has_el3 property based on the vexpress machine
      secure state property during initialization.  This enables/disables EL3
      state during start-up.  Changes include adding an additional secure state
      boolean during vexpress CPU initialization.  Also enables the ARM secure boot
      by default.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418684992-8996-12-git-send-email-greg.bellows@linaro.org
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c8e829b7bf6e1c84af8b4b13ee7fce2959c63e0e
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:47 2014 -0600

      target-arm: Add arm_boot_info secure_boot control

      Adds the secure_boot boolean field to the arm_boot_info descriptor.  This
      fields is used to indicate whether Linux should boot into secure or non-secure
      state if the ARM EL3 feature is enabled.  The default is to leave the CPU in an
      unaltered reset state.  On EL3 enabled systems, the reset state is secure and
      can be overridden by setting the added field to false.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-11-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51942aee3c51ca23b0dd78f95534a57e8dc1e582
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:46 2014 -0600

      target-arm: Add ARMCPU secure property

      Added a "has_el3" state property to the ARMCPU descriptor.  This property
      indicates whether the ARMCPU has security extensions enabled (EL3) or not.
      By default it is disabled at this time.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-10-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 08828484a5c1ec55a6cbb4b4d377bfcf41199b5c
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:45 2014 -0600

      target-arm: Add feature unset function

      Add an unset_feature() function to compliment the set_feature() function.  This
      will be used to disable functions after they have been enabled during
      initialization.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 083a58906cb32731dd98a93fcf451ec7718c0924
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:44 2014 -0600

      target-arm: Add virt machine secure property

      Add "secure" virt machine specific property to allow override of the
      default secure state configuration.  By default, when using the QEMU
      -kernel command line argument, virt machines boot into NS/SVC.  When using
      the QEMU -bios command line argument, virt machines boot into S/SVC.

      The secure state can be changed from the default specifying the secure
      state as a machine property.  For example, the below command line would disable
      security extensions on a -kernel Linux boot:

          aarch64-softmmu/qemu-system-aarch64
              -machine type=virt,secure=off
              -kernel ...

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c29196904b2bad015edc553a5693c5c9e6f8177a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:43 2014 -0600

      target-arm: Add virt class and machine types

      Switch virt qemu machine support to use the newer object type, class, and
      instance model.  Added virt TypeInfo with static registration along with virt
      specific class and machine structs.  Also added virt class initialization
      method.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-7-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e364bab69bd70825e7583e0bbc812fb67b63b366
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:42 2014 -0600

      target-arm: Change vexpress daughterboard init arg

      Change the Vexpress daughterboard initialization method to take a vexpress
      machine state pointer instead of the daughterboard struct pointer.  The machine
      state now contains the daughterboard pointer.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-6-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 490219243208a0fa8abb2290509f31654c888954
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:41 2014 -0600

      target-arm: Add vexpress machine secure property

      Add "secure" Vexpress machine specific property to allow override of the
      default secure state configuration.  By default, when using the QEMU
      -kernel command line argument, Vexpress machines boot into NS/SVC.  When using
      the QEMU -bios command line argument, Vexpress machines boot into S/SVC.

      The secure state can be changed from the default specifying the secure
      state as a machine property.  For example, the below command line would disable
      security extensions on a -kernel Linux boot:

          aarch64-softmmu/qemu-system-aarch64
              -machine type=vexpress-a15,secure=off
              -kernel ...

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit af7c9f34b1bacd329a479e79bd608580d0511596
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:40 2014 -0600

      target-arm: Switch to common vexpress machine init

      Switched the Vexpress machine initialization to use the common function with
      the machine pointer to board info.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9ee00ba8311a9cc59f8d1034c98b6f9f3694495b
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:39 2014 -0600

      target-arm: Add vexpress a9 & a15 machine objects

      Add Vexpress machine objects for the the Cortex A9 & A15 variants.  The older
      style QEMUMachine types were replaced with dedicated TypeInfo objects. The new
      objects include dedicated class init functions that currently ustilze dedicated
      machine init methods.  The previous qemu_register_machine calls were replaced
      with the newer type_register_status calls.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7eb1dc7f0b65a324323541440baf2ea544adcefb
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Mon Dec 15 17:09:38 2014 -0600

      target-arm: Add vexpress class and machine types

      Adds base Vexpress class and machine objects and infrastructure.  This is in
      preparation for switching to the full QEMU object model.  The base vexpress
      infrastructure is intended to handle common vexpress details.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418684992-8996-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 52eb3dfd7d6585f0049a6d41ddb81ef8d4496146
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:06 2014 +0000

      vl.c: add HMP help to machine

      The help is based on the actual machine properties
      exposing only the relevant options.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-4-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 2e16898a61a25cb76dd48f6e74f3b7a500d0c91a
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      vl.c: simplified machine_set_property

      Refactored the code to re-use object_property_parse.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-3-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 49d2e648e8087d154d8bf8b91f27c8e05e79d5a6
  Author: Marcel Apfelbaum <marcel.a@redhat.com>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      machine: remove qemu_machine_opts global list

      QEMU has support for options per machine, keeping
      a global list of options is no longer necessary.

      Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
      Reviewed-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418217570-15517-2-git-send-email-marcel.a@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 60fb1a87b47b14e4ea67043aa56f353e77fbd70a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      target-arm: Merge EL3 CP15 register lists

      Merge of the v8_el2_cp_reginfo and el3_cp_reginfo ARMCPRegInfo lists.
      Previously, some EL3 registers were restricted to the ARMv8 list under the
      impression that they were not needed on ARMv7.  However, this is not the case
      as the ARMv7/32-bit variants rely on the ARMv8/64-bit variants to handle
      migration and reset.  For this reason they must always exist.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Message-id: 1418406450-14961-1-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b28fb27b5edf77f6fd0ac550a156fb20f2218db3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 16:58:05 2014 +0000

      audio: Don't free hw resources until after hw backend is stopped

      When stopping an audio voice, call the audio backend's fini
      method before calling audio_pcm_hw_free_resources_ rather than
      afterwards. This allows backends which use helper threads (like
      pulseaudio) to terminate those threads before the conv_buf or
      mix_buf are freed and avoids race conditions where the helper
      may access a NULL pointer or freed memory.

      Cc: qemu-stable@nongnu.org
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418406239-9838-1-git-send-email-peter.maydell@linaro.org

  commit dcbfc5cefb22e9219f8253dba87de33104ca73fe
  Author: Alex Williamson <alex.williamson@redhat.com>
  Date:   Mon Dec 22 10:37:27 2014 -0700

      vfio: Cleanup error_report()s

      With the conversion to tracepoints, a couple previous DPRINTKs are
      now quite a bit more visible and are really just informational.
      Remove these and add a bit more description to another.

      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit e2c7d025ada047a3f0225f89ff36626d1bd46e47
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:51 2014 -0700

      hw/vfio: create common module

      A new common module is created. It implements all functions
      that have no device specificity (PCI, Platform).

      This patch only consists in move (no functional changes)

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit df92ee444884ba66b5cc95e3ff3d5579f89ed4aa
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:49 2014 -0700

      hw/vfio/pci: use name field in format strings

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 62356b729281e7d6672193a98a072b1c7de04dd8
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:46 2014 -0700

      hw/vfio/pci: rename group_list into vfio_group_list

      better fit in the rest of the namespace

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit d13dd2d7a957eacbb9e669c43dd9e19db969755b
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:38 2014 -0700

      hw/vfio/pci: split vfio_get_device

      vfio_get_device now takes a VFIODevice as argument. The function is split
      into 2 parts: vfio_get_device which is generic and vfio_populate_device
      which is bus specific.

      3 new fields are introduced in VFIODevice to store dev_info.

      vfio_put_base_device is created.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit a664477db8dac84cc046e9d79701eefda1d58703
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:37 2014 -0700

      hw/vfio/pci: Introduce VFIORegion

      This structure is going to be shared by VFIOPCIDevice and
      VFIOPlatformDevice. VFIOBAR includes it.

      vfio_eoi becomes an ops of VFIODevice specialized by parent device.
      This makes possible to transform vfio_bar_write/read into generic
      vfio_region_write/read that will be used by VFIOPlatformDevice too.

      vfio_mmap_bar becomes vfio_map_region

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit b47d8efa9f430c332bf96ce6eede169eb48422ad
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:35 2014 -0700

      hw/vfio/pci: handle reset at VFIODevice

      Since we can potentially have both PCI and platform devices in
      the same VFIO group, this latter now owns a list of VFIODevices.
      A unified reset handler, vfio_reset_handler, is registered, looping
      through this VFIODevice list. 2 specialized operations are introduced
      (vfio_compute_needs_reset and vfio_hot_reset_multi): they allow to
      implement type specific behavior. also reset_works and needs_reset
      VFIOPCIDevice fields are moved into VFIODevice.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 462037c9e85b27149e71d7f5c7f41375ca6e47d5
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Mon Dec 22 09:54:31 2014 -0700

      hw/vfio/pci: add type, name and group fields in VFIODevice

      Add 3 new fields in the VFIODevice struct. Type is set to
      VFIO_DEVICE_TYPE_PCI. The type enum value will later be used
      to discriminate between VFIO PCI and platform devices. The name is
      set to domain:bus:slot:function. Currently used to test whether
      the device already is attached to the group. Later on, the name
      will be used to simplify all traces. The group is simply moved
      from VFIOPCIDevice to VFIODevice.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      [Fix g_strdup_printf() usage]
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 7e58e2ac7778cca3234c33387e49577bb7732714
  Merge: 7db96d6 ddcd553
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 14:52:52 2014 +0000

      Merge remote-tracking branch 'remotes/gonglei/tags/bootdevice-next-20141222' into staging

      bootdevice: Refactor and improvement

      # gpg: Signature made Mon 22 Dec 2014 06:44:08 GMT using RSA key ID DDE30FBB
      # gpg: Can't check signature: public key not found

      * remotes/gonglei/tags/bootdevice-next-20141222:
        bootdevice: add Error **errp argument for QEMUBootSetHandler
        bootdevice: add validate check for qemu_boot_set()
        bootdevice: add Error **errp argument for qemu_boot_set()
        bootdevice: add Error **errp argument for validate_bootdevices()
        bootdevice: move code about bootorder from vl.c to bootdevice.c

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7db96d6cf877d4bb8132462ec7dd19055ff968eb
  Merge: c95f390 9655b93
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 22 13:15:52 2014 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20141221' into staging

      TriCore RR, RR1 insn added and several bug fixes

      # gpg: Signature made Sun 21 Dec 2014 18:39:11 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20141221:
        target-tricore: Add instructions of RR1 opcode format, that have 0xb3 as first opcode
        target-tricore: Fix MFCR/MTCR insn and B format offset.
        target-tricore: Add missing 1.6 insn of BOL opcode format
        target-tricore: Add instructions of RR opcode format, that have 0x4b as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0x1 as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0xf as the first opcode
        target-tricore: Add instructions of RR opcode format, that have 0xb as the first opcode
        target-tricore: Change SSOV/SUOV makro name to SSOV32/SUOV32
        target-tricore: Fix mask handling JNZ.T being 7 bit long
        target-tricore: pretty-print register dump and show more status registers
        target-tricore: add missing 64-bit MOV in RLC format
        target-tricore: typo in BOL format
        target-tricore: fix offset masking in BOL format

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ddcd55316fb2851e144e719171621ad2816487dc
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 19:04:02 2014 +0000

      bootdevice: add Error **errp argument for QEMUBootSetHandler

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.
      For x86 architecture, we pass &local_err to set_boot_dev()
      when vm startup in pc_coms_init().

      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Blue Swirl <blauwirbel@gmail.com>
      Cc: qemu-ppc@nongnu.org
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 3b08098b409c0fb28f85436ba1adeb1d401ec8f7
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 18:25:46 2014 +0000

      bootdevice: add validate check for qemu_boot_set()

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit f1839938b090b28537d9be2c1b255b834f3cfbb8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 18:20:58 2014 +0000

      bootdevice: add Error **errp argument for qemu_boot_set()

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 703008e81a6ace40f227aae16d630014e5016af1
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 17:11:39 2014 +0000

      bootdevice: add Error **errp argument for validate_bootdevices()

      It will be useful for checking when we change traditional
      boot order dynamically and propagate error message
      to the monitor.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit 9816833d3b8ec9adfb63b6a53f1b56f5304f4c40
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Wed Dec 3 16:49:46 2014 +0000

      bootdevice: move code about bootorder from vl.c to bootdevice.c

      First, we can downsize vl.c, make it simpler by
      little and little. Second, I can maintain those code
      and make some improvement.

      Cc: Jan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>

  commit c95f3901b4ead79f3fe2c641fda7d2c70fc84c72
  Merge: 328b3b6 d3f3a0f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sun Dec 21 23:17:00 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20141219-1' into staging

      sdl2: fixes, cleanups and opengl preparation.

      # gpg: Signature made Fri 19 Dec 2014 09:06:07 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-sdl-20141219-1:
        sdl2: Work around SDL2 SDL_ShowWindow() bug
        sdl2: Use correct sdl2_console for window events
        sdl2: move sdl2_2d_refresh to sdl2-2d.c
        sdl2: factor out sdl2_poll_events
        sdl2: add+use sdl2_2d_redraw function.
        sdl2: move sdl_switch to sdl2-2d.c
        sdl2: overhaul window size handling
        sdl2: move sdl_update to new sdl2-2d.c
        sdl2: turn on keyboard grabs
        sdl2: move keyboard input code to new sdl2-input.c
        sdl2: rename sdl2_state to sdl2_console, move to header file
        sdl: move version logic from source code to makefile

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 9655b9328a566116c198c52792775a0641d56915
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Dec 12 16:55:34 2014 +0000

      target-tricore: Add instructions of RR1 opcode format, that have 0xb3 as first opcode

      Add instructions of RR1 opcode format, that have 0xb3 as first opcode.
      Add helper functions mulh, mulmh and mulrh, that compute multiplication,
      with multiprecision (mulmh) or rounding (mulrh) of 4 halfwords, being either low or high parts
      of two 32 bit regs.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 436d63ff3e3f87cda3e8df35827a40093cc17430
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Dec 3 17:40:21 2014 +0000

      target-tricore: Fix MFCR/MTCR insn and B format offset.

      Fix gen_mtcr using wrong register.
      Fix gen_mtcr/mfcr using sign extended offsets.
      Fix B format insn using not sign extendend offsets.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit b5fd8fa34594da327e2965a8c3b5dddf21f862ff
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Dec 5 14:37:17 2014 +0000

      target-tricore: Add missing 1.6 insn of BOL opcode format

      Some of the 1.6 ISA instructions were still missing. So let's add them.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e2bed107c6d1dbde564029ac2bca450cdb3f596e
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 2 17:22:27 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0x4b as the first opcode

      Add instructions of RR opcode format, that have 0x4b as the first opcode.
      Add helper functions:
          * parity: Calculates the parity bits for every byte of a 32 int.
          * bmerge/bsplit: Merges two regs into one bitwise/Splits one reg into two bitwise.
          * unpack: unpack a IEEE 754 single precision floating point number as exponent and mantissa.
          * dvinit_b_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                             where the quotient result is guaranteed to fit into 8 bit.
          * dvinit_h_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                             where the quotient result is guaranteed to fit into 16 bit.
      OPCM_32_RR_FLOAT -> OPCM_32_RR_DIVIDE.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit f2f1585f60df656dc1755727cc66a0c3c8dd627d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Tue Dec 2 17:15:09 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0x1 as the first opcode

      Add instructions of RR opcode format, that have 0x1 as the first opcode.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0b79a78169d813d11ad32f103e7a2c64c32bd705
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Nov 28 17:07:26 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0xf as the first opcode

      Add instructions of RR opcode format, that have 0xf as the first opcode.
      Add helper functions:
          * clo/z/s: Counts leading ones/zeros/signs.
          * clo/z/s_h: Count leading ones/zeros/signs in two haflwords.
          * sh/_h: Shifts one/two word/hwords.
          * sha/_h: Shifts one/two word/hwords arithmeticly.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit d5de7839d78b08c7bd14b03dac0413699b90da67
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 27 14:30:33 2014 +0000

      target-tricore: Add instructions of RR opcode format, that have 0xb as the first opcode

      Add instructions of RR opcode format, that have 0xb as the first opcode.
      Add helper functions, for hword and byte arithmetics:
          * add_h_ssov/suov: Add two halfword and saturate on overflow.
          * sub_h_ssov/suov: Sub two halfword and saturate on overflow.
          * absdif_h_ssov: Compute absolute difference for halfwords and saturate on overflow.
          * abs_h_ssov/suov: Compute absolute value for two halfwords and saturate on overflow.
          * abs_b/h: Compute absolute value for four/two bytes/halfwords
          * absdif_b/h: Compute absolute difference for four/two bytes/halfwords
          * add_b/h: Add four/two bytes/halfwords.
          * sub_b/h: Sub four/two bytes/halfwords.
          * eq_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on
                    equality and set all bits of to either one ore zero.
          * eqany_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on equality.
          * lt_b/bu/h/hu: Compare four/two bytes/halfwords with four/two bytes/halfwords
                          on less than signed and unsigned.
          * max_b/bu/h/hu: Calculate max for four/two bytes/halfwords signed and unsigned.
          * min_b/bu/h/hu: Calculate min for four/two bytes/halfwords signed and unsigned.
      Add helper function abs_ssov, that computes the absolute value for a 32 bit integer and saturates on overflow.
      Add microcode generator functions:
          * gen_sub_CC: Caluclates sub and sets the carry bit.
          * gen_subc_CC: Caluclates sub and carry and sets the carry bit
          * gen_abs: Compute absolute value for a 32 bit integer.
          * gen_cond_w: Compares two 32 bit values on cond and sets result either zero or all bits one.

      OPC2_32_RR_MIN switched with OPC2_32_RR_MIN_U.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit e4e39176305adff59b05a02a072ae1369d0a2274
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 27 13:45:09 2014 +0000

      target-tricore: Change SSOV/SUOV makro name to SSOV32/SUOV32

      Those makros are exclusively used for 32 bit arithmetics and won't work for
      16 bit with two halfwords. So lets get rid of the len parameter and make them
      always use 32 bit. Now no token pasting is needed anymore and they can be
      regular functions.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 7f13420ec000ad7644b65ea1a32b5674ad0cd204
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Mon Dec 15 21:36:31 2014 +0000

      target-tricore: Fix mask handling JNZ.T being 7 bit long

      The mask is actually 7 bit long, instead of 6, so the expression checking
      for JNZ.T is always false. Let's make the mask 1 bit wider.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 45820fccaf731a2fec5d0cb5416f944104e89373
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 19 12:34:34 2014 +0100

      target-tricore: pretty-print register dump and show more status registers

      Now using psw_read() to retrieve the status bits correctly.

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 4b5b44357651b7563790e246be64bc55f4d90d47
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:29 2014 +0100

      target-tricore: add missing 64-bit MOV in RLC format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit af715d980271a1c8ea9596bf9147b5421a49e01a
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:28 2014 +0100

      target-tricore: typo in BOL format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 781b717c5049f42d45d31fd47617f3129c07541c
  Author: Alex Zuepke <alexander.zuepke@hs-rm.de>
  Date:   Fri Dec 12 15:10:27 2014 +0100

      target-tricore: fix offset masking in BOL format

      Signed-off-by: Alex Zuepke <alexander.zuepke@hs-rm.de>
      Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>

  commit 328b3b6c44c17d94df115ed1851f54a0bd59a471
  Merge: c4e7c17 20302e7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Dec 20 22:04:13 2014 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

      # gpg: Signature made Fri 19 Dec 2014 13:18:18 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/net-pull-request:
        e1000: defer packets until BM enabled
        net: Use g_new() & friends where that makes obvious sense
        net: Fuse g_malloc(); memset() into g_new0()
        net: don't use set/get_pointer() in set/get_netdev()
        tap: fix vcpu long time io blocking on tap

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4e7c17a8ecb41cdbb81374a128161c614ba1f1e
  Merge: adee642 c246cee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Sat Dec 20 21:28:53 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-roms-20141217-1' into staging

      update ipxe from 69313ed to 35c5379

      # gpg: Signature made Wed 17 Dec 2014 14:45:04 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-roms-20141217-1:
        update ipxe from 69313ed to 35c5379

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit adee64249ee37e822d578e65a765750e7f2081f6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 19 12:53:14 2014 +0100

      exec: change default exception_index value for migration to -1

      In QEMU 2.2 the exception_index value was added to the migration stream
      through a subsection.  The default was set to 0, which is wrong and
      should have been -1.

      However, 2.2 does not have commit e511b4d (cpu-exec: reset exception_index
      correctly, 2014-11-26), hence in 2.2 the exception_index is never used
      and is set to -1 on the next call to cpu_exec.  So we can change the
      migration stream to make the default -1.  The effects are:

      - 2.2.1 -> 2.2.0: cpu->exception_index set incorrectly to 0 if it
      were -1 on the source; then reset to -1 in cpu_exec.  This is TCG
      only; KVM does not use exception_index.

      - 2.2.0 -> 2.2.1: cpu->exception_index set incorrectly to -1 if it
      were 0 on the source; but it would be reset to -1 in cpu_exec anyway.
      This is TCG only; KVM does not use exception_index.

      - 2.2.1 -> 2.1: two bugs fixed: 1) can migrate backwards if
      cpu->exception_index is set to -1; 2) should not migrate backwards
      (but 2.2.0 allows it) if cpu->exception_index is set to 0

      - 2.2.0 -> 2.3.0: 2.2.0 will send the subsection unnecessarily if
      exception_index is -1, but that is not a problem.  2.3.0 will set
      cpu->exception_index to -1 if it is 0 on the source, but this would
      be anyway a problem for 2.2.0 -> 2.2.x migration (due to lack of
      commit e511b4d in 2.2.x) so we can ignore it

      - 2.2.1 -> 2.3.0: everything works.

      In addition, play it safe and never send the subsection unless TCG
      is in use.  KVM does not use exception_index (PPC KVM stores values
      in it for use in the subsequent call to ppc_cpu_do_interrupt, but
      does not need it as soon as kvm_handle_debug returns).  Xen and
      qtest do not run any code for the CPU at all.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1418989994-17244-3-git-send-email-pbonzini@redhat.com
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit f9d8f6673591f30028e281e8ff6d5790adc2de83
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 19 12:53:13 2014 +0100

      cpu: initialize cpu->exception_index on reset

      This unbreaks linux-user (broken by e511b4d, cpu-exec: reset exception_index
      correctly, 2014-11-26).

      Reported-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
      Tested-by: Eduardo Habkost <ehabkost@redhat.com>
      Message-id: 1418989994-17244-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 5546a621a8801351601537b311539486b9b3ee79
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:31 2014 -0700

      hw/vfio/pci: introduce minimalist VFIODevice with fd

      Introduce a new base VFIODevice strcut that will be used by both PCI
      and Platform VFIO device. Move VFIOPCIDevice fd field there. Obviously
      other fields from VFIOPCIDevice will be moved there but this patch
      file is introduced to ease the review.

      Also vfio_mask_single_irqindex, vfio_unmask_single_irqindex,
      vfio_disable_irqindex now take a VFIODevice handle as argument.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 079eb19cbb3079536788dfd58832824804815e48
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:24 2014 -0700

      hw/vfio/pci: generalize mask/unmask to any IRQ index

      To prepare for platform device introduction, rename vfio_mask_intx
      and vfio_unmask_intx into vfio_mask_single_irqindex and respectively
      unmask_single_irqindex. Also use a nex index parameter.

      With that name and prototype the function will be usable for other
      indexes than VFIO_PCI_INTX_IRQ_INDEX.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 9ee27d7381c2d540ee976c7cbae941c66bb66e70
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 15:24:15 2014 -0700

      hw/vfio/pci: Rename VFIODevice into VFIOPCIDevice

      This prepares for the introduction of VFIOPlatformDevice

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit cf7087db10e2dc112e02782f1d1eb56ec42c728b
  Author: Kim Phillips <kim.phillips@linaro.org>
  Date:   Fri Dec 19 15:24:06 2014 -0700

      vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio

      This is done in preparation for the addition of VFIO platform
      device support.

      Signed-off-by: Kim Phillips <kim.phillips@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit c67676711c7202f48bc43d2f80125eaea355755e
  Author: Frank Blaschka <blaschka@linux.vnet.ibm.com>
  Date:   Fri Dec 19 14:40:06 2014 -0700

      vfio: fix adding memory listener to the right address space

      Depending on the device, container->space->as contains the valid AddressSpace.
      Using address_space_memory breaks devices sitting behind an iommu (and using
      a separate address space).

      Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 385f57cf9ad7566aa4fc125370f14902ea62aae5
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Dec 19 14:40:06 2014 -0700

      vfio: migration to trace points

      This patch removes all DPRINTF and replace them by trace points.
      A few DPRINTF used in error cases were transformed into error_report.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

  commit 20302e71a5b654d7b4d0d61c7384e9dd8d112971
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Mon Dec 1 20:06:52 2014 +0200

      e1000: defer packets until BM enabled

      Some guests seem to set BM for e1000 after
      enabling RX.
      If packets arrive in the window, device is wedged.
      Probably works by luck on real hardware, work around
      this by making can_receive depend on BM.

      Tested-by: Gabriel Somlo <somlo@cmu.edu>
      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Jason Wang <jasowang@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 58889fe50a7c5b8776cf3096a8fe611fb66c4e5c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:28:17 2014 +0100

      net: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 71e28e3cc24ff3b0268903758aae357592eb8b74
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:28:16 2014 +0100

      net: Fuse g_malloc(); memset() into g_new0()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 23120b13c6e316df44aeb63420121a1cf6dc49dc
  Author: Jason Wang <jasowang@redhat.com>
  Date:   Mon Oct 13 13:16:37 2014 +0800

      net: don't use set/get_pointer() in set/get_netdev()

      Commit 1ceef9f27359cbe92ef124bf74de6f792e71f6fb (net: multiqueue
      support) tries to use set_pointer() and get_pointer() to set and get
      NICPeers which is not a pointer defined in DEFINE_PROP_NETDEV. This
      trick works but result a unclean and fragile implementation (e.g
      print_netdev and parse_netdev).

      This patch solves this issue by not using set/get_pinter() and set and
      get netdev directly in set_netdev() and get_netdev(). After this the
      parse_netdev() and print_netdev() were no longer used and dropped from
      the source.

      [Renamed 'err' label to 'out' as suggested by Markus Armbruster.
      --Stefan]

      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 756ae78b275a0625b4559a8fc448df4c6eb331a8
  Author: Wangkai (Kevin,C) <wangkai86@huawei.com>
  Date:   Fri Jul 18 09:33:42 2014 +0000

      tap: fix vcpu long time io blocking on tap

      [Adjusted doc comment for grammar.
      --Stefan]

      Signed-off-by: Wangkai <wangkai86@huawei.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b574f602680d41c4cf4a9c106e3e2244bed01cdd
  Merge: 86b182a 46817e8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 19:22:41 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20141216-1' into staging

      cirrus hwcursor fixes.
      set secondary-vga category.

      # gpg: Signature made Tue 16 Dec 2014 14:44:09 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vga-20141216-1:
        vga: set catagory bit for secondary vga device
        move hw cursor pos from cirrus to vga
        cirrus: Force use of shadow pixmap when HW cursor is enabled
        vga: Add mechanism to force the use of a shadow surface

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 86b182ac0e0b44726d85598cbefb468ed22517fc
  Merge: 84afc4d 97e89ee
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 17:31:26 2014 +0000

      Merge remote-tracking branch 'remotes/xtensa/tags/20141217-xtensa' into staging

      Xtensa updates for 2.3:

      - fix cross-page opcode handling;
      - move window overflow exception generation decision to translation phase;
      - don't generate dead code after privilege, window overflow or coprocessor
        exception;
      - add monitor command 'info opcount' for dumping TCG opcode counters.

      # gpg: Signature made Wed 17 Dec 2014 02:57:01 GMT using RSA key ID F83FA044
      # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
      # gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

      * remotes/xtensa/tags/20141217-xtensa:
        target-xtensa: don't generate dead code
        target-xtensa: record available window in TB flags
        target-xtensa: test cross-page opcode
        target-xtensa: fix translation for opcodes crossing page boundary
        tcg: add separate monitor command to dump opcode counters

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 84afc4dd56648ac302c7b5a917e95ca7b1239695
  Merge: 339aaf5 d4fa535
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Wed Dec 17 16:25:21 2014 +0000

      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20141216' into staging

      * remotes/lalrae/tags/mips-20141216: (30 commits)
        target-mips: remove excp_names[] from linux-user as it is unused
        disas/mips: disable unused mips16_to_32_reg_map[]
        disas/mips: remove unused mips_msa_control_names_numeric[32]
        target-mips: convert single case switch into if statement
        target-mips: Fix DisasContext's ulri member initialization
        target-mips: Use local float status pointer across MSA macros
        target-mips: Add missing calls to synchronise SoftFloat status
        linux-user: Use the 5KEf processor for 64-bit emulation
        target-mips: Also apply the CP0.Status mask to MTTC0
        target-mips: gdbstub: Clean up FPU register handling
        target-mips: Correct 32-bit address space wrapping
        target-mips: Tighten ISA level checks
        target-mips: Fix CP0.Config3.ISAOnExc write accesses
        target-mips: Output CP0.Config2-5 in the register dump
        target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP
        target-mips: Correct the writes to Status and Cause registers via gdbstub
        target-mips: Correct the handling of writes to CP0.Status for MIPSr6
        target-mips: Correct MIPS16/microMIPS branch size calculation
        target-mips: Restore the order of helpers
        target-mips: Remove unused `FLOAT_OP' macro
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c246cee4eedb17ae3932d699e009a8b63240235f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Dec 17 13:56:50 2014 +0100

      update ipxe from 69313ed to 35c5379

      Anton D. Kachalov (1):
            [intel] Add 8086:1557 card (Intel 82599 10G ethernet mezz)

      Christian Hesse (1):
            [build] Merge util/geniso and util/genliso

      Curtis Larsen (3):
            [efi] Use EFI_CONSOLE_CONTROL_PROTOCOL to set text mode if available
            [efi] Report errors from attempting to disconnect existing drivers
            [efi] Try various possible SNP receive filters

      Dale Hamel (1):
            [smbios] Expose board serial number as ${board-serial}

      Florian Schmaus (1):
            [build] Set GITVERSION only if there is a git repository

      Hannes Reinecke (3):
            [ethernet] Provide eth_random_addr() to generate random Ethernet addresses
            [igbvf] Assign random MAC address if none is set
            [igbvf] Allow changing of MAC address

      Jan Kiszka (1):
            [intel] Add I217-LM PCI ID

      Marin Hannache (4):
            [nfs] Fix an invalid free() when loading a symlink
            [nfs] Fix an invalid free() when loading a regular (non-symlink) file
            [nfs] Rewrite NFS URI handling
            [readline] Add CTRL-W shortcut to remove a word

      Michael Brown (144):
            [profile] Allow interrupts to be excluded from profiling results
            [intel] Exclude time spent in hypervisor from profiling
            [build] Fix version.o dependency upon git index
            [tcp] Defer sending ACKs until all received packets have been processed
            [lkrnprefix] Function as a bzImage kernel
            [build] Avoid errors when build directory is mounted via NFS
            [undi] Apply quota only to number of complete received packets
            [lkrnprefix] Make real-mode setup code relocatable
            [intel] Increase receive ring fill level
            [syslog] Strip invalid characters from hostname
            [test] Add self-tests for strdup()
            [libc] Prevent strndup() from reading beyond the end of the string
            [efi] Allow for optional protocols
            [efi] Make EFI_DEVICE_PATH_TO_TEXT_PROTOCOL optional
            [efi] Make EFI_HII_DATABASE_PROTOCOL optional
            [efi] Do not try to fetch loaded image device path protocol
            [ipv6] Fix definition of IN6_IS_ADDR_LINKLOCAL()
            [dhcpv6] Do not set sin6_scope_id on the unspecified client socket address
            [ipv6] Do not set sin6_scope_id on source address
            [ipv6] Include network device when transcribing multicast addresses
            [ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()
            [librm] Allow for the PIC interrupt vector offset to be changed
            [ifmgmt] Do not sleep CPU while configuring network devices
            [scsi] Improve sense code parsing
            [iscsi] Read IPv4 settings only from the relevant network device
            [iscsi] Include IP address origin in iBFT
            [debug] Allow debug message colours to be customised via DBGCOL=...
            [build] Expose build timestamp, build name, and product names
            [efi] Allow device paths to be easily included in debug messages
            [efi] Provide a meaningful EFI SNP device name
            [efi] Restructure EFI driver model
            [build] Fix erroneous object name in version object
            [build] Add yet another potential location for isolinux.bin
            [efi] Allow network devices to be created on top of arbitrary SNP devices
            [autoboot] Allow autoboot device to be identified by link-layer address
            [efi] Identify autoboot device by MAC address when chainloading
            [efi] Attempt to start only drivers claiming support for a device
            [efi] Rewrite SNP NIC driver
            [efi] Include SNP NIC driver within the all-drivers target
            [crypto] Add support for iPAddress subject alternative names
            [crypto] Fix debug message
            [netdevice] Reset network device index when last device is unregistered
            [efi] Update EDK2 headers
            [efi] Install our own disk I/O protocol and claim exclusive use of it
            [efi] Allow for interception of boot services calls by loaded image
            [efi] Print well-known GUIDs by name in debug messages
            [efi] Include EFI_CONSOLE_CONTROL_PROTOCOL header
            [ioapi] Fail ioremap() when attempting to map a zero bus address
            [intel] Check for ioremap() failures
            [realtek] Check for ioremap() failures
            [vmxnet3] Check for ioremap() failures
            [skel] Check for ioremap() failures
            [myson] Check for ioremap() failures
            [natsemi] Check for ioremap() failures
            [i386] Add functions to read and write model-specific registers
            [x86_64] Add functions to read and write model-specific registers
            [efi] Show more diagnostic information when building with DEBUG=efi_wrap
            [ioapi] Centralise notion of PAGE_SIZE
            [lotest] Discard packets arriving on the incorrect network device
            [xen] Import selected public headers
            [xen] Add basic support for PV-HVM domains
            [xen] Add support for Xen netfront virtual NICs
            [efi] Default to releasing network devices for use via SNP
            [efi] Unload started images only on failure
            [efi] Fill in loaded image's DeviceHandle if firmware fails to do so
            [efi] Fix incorrect debug message level when device has no device path
            [efi] Report exact failure when unable to open the device path
            [netdevice] Avoid registering duplicate network devices
            [efi] Ignore failures when attempting to install SNP HII protocol
            [efi] Expand the range of well-known EFI GUIDs in debug messages
            [efi] Provide efi_handle_name() for debugging
            [efi] Add ability to dump all openers of a given protocol on a handle
            [efi] Use efi_handle_name() instead of efi_handle_devpath_text()
            [efi] Use efi_handle_name() instead of efi_devpath_text() where applicable
            [efi] Allow compiler to perform type checks on EFI_HANDLE
            [efi] Avoid unnecessarily passing pointers to EFI_HANDLEs
            [efi] Dump existing openers when we are unable to open a protocol
            [efi] Dump handle information around connect/disconnect attempts
            [efi] Improve debugging of the debugging facilities
            [efi] Add excessive sanity checks into efi_debug functions
            [efi] Also try original ComponentName protocol for retrieving driver names
            [efi] Print raw device path when we have no DevicePathToTextProtocol
            [efi] Add ability to dump SNP device mode information
            [efi] Reset multicast filter list when setting SNP receive filters
            [efi] Provide centralised definitions of commonly-used GUIDs
            [efi] Open device path protocol only at point of use
            [efi] Move abstract device path and handle functions to efi_utils.c
            [efi] Generalise snpnet_pci_info() to efi_locate_device()
            [bios] Support displaying and hiding cursor
            [efi] Support displaying and hiding cursor
            [readline] Ensure cursor is visible when prompting for input
            [xen] Accept alternative Xen platform PCI device ID 5853:0002
            [xen] Use version 1 grant tables by default
            [xen] Cope with unexpected initial backend states
            [smc9000] Avoid using CONFIG as a preprocessor macro
            [build] Allow for named configurations at build time
            [intel] Display PBS value when applying ICH errata workaround
            [intel] Display before and after values for both PBS and PBA
            [intel] Apply PBS/PBA errata workaround only to ICH8 PCI device IDs
            [efi] Add definitions of GUIDs observed during Windows boot
            [efi] Dump details of any calls to our dummy block and disk I/O protocols
            [romprefix] Do not preserve unused register %di
            [build] Remove obsolete references to .zrom build targets
            [build] Allow ISA ROMs to be built
            [build] Avoid deleting config header files if build is interrupted
            [prefix] Halt system without burning CPU if we cannot access the payload
            [prefix] Report both %esi and %ecx when opening payload fails
            [util] Use PCI length field to obtain length of individual images
            [mromprefix] Use PCI length field to obtain length of individual images
            [mromprefix] Allow for .mrom images larger than 128kB
            [efi] Show details of intercepted LoadImage() calls
            [efi] Make our virtual file system case insensitive
            [efi] Wrap any images loaded by our wrapped image
            [efi] Use the SNP protocol instance to match the SNP chainloading device
            [efi] Avoid returning uninitialised data from PCI configuration space reads
            [efi] Make EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL optional
            [efi] Allow for non-PCI snpnet devices
            [build] Clean up all binary directories on "make [very]clean"
            [efi] Add efifatbin utility
            [efi] Provide dummy device path in efi_image_probe()
            [dhcp] Check for matching chaddr in received DHCP packets
            [dhcp] Remove obsolete dhcp_chaddr() function
            [build] Use -malign-double to build 32-bit UEFI binaries
            [efi] Centralise definitions of more protocol GUIDs
            [efi] Add definitions of GUIDs observed when chainloading from Intel driver
            [efi] Free transmit ring entry before calling netdev_tx_complete()
            [efi] Generalise snpnet_dev_info() to efi_device_info()
            [efi] Update to current EDK2 headers
            [efi] Add NII / UNDI driver
            [efi] Check for presence of UNDI in NII protocol
            [efi] Include NII driver within "snp" and "snponly" build targets
            [ping] Report timed-out pings via the callback function
            [ping] Allow termination after a specified number of packets
            [ping] Allow "ping" command output to be inhibited
            [intel] Use autoloaded MAC address instead of EEPROM MAC address
            [crypto] Fix parsing of OCSP responder ID key hash
            [vmxnet3] Add profiling code to exclude time spent in the hypervisor
            [netdevice] Fix erroneous use of free(iobuf) instead of free_iob(iobuf)
            [libc] Add ASSERTED macro to test if any assertion has triggered
            [list] Add sanity checks after list-adding functions
            [malloc] Tidy up debug output
            [malloc] Sanity check parameters to alloc_memblock() and free_memblock()
            [malloc] Check integrity of free list
            [malloc] Report caller address as soon as memory corruption is detected

      Peter Lemenkov (1):
            [build] Check if git index actually exists

      Robin Smidsrød (2):
            [build] Add named configuration for VirtualBox
            [build] Avoid using embedded script in VirtualBox named configuration

      Sven Ulland (1):
            [lacp] Set "aggregatable" flag in response LACPDU

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d3f3a0f453ea590be529079ae214c200bb5ecc1a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 12 10:52:52 2014 +0100

      sdl2: Work around SDL2 SDL_ShowWindow() bug

      Apparently it is possible for X to send an event to a hidden SDL2
      window, leading to SDL2 believing it is now shown. SDL2 will pass the
      SDL_WINDOWEVENT_SHOWN message to the application without actually
      showing the window; the problem is that the next SDL_ShowWindow() will
      be a no-op because SDL2 assumes the window is already shown.

      The correct way to react to SDL_WINDOWEVENT_SHOWN would be to clear
      scon->hidden (analogous for SDL_WINDOWEVENT_HIDDEN). However, due to the
      window not actually being shown, this will somehow not be correct after
      all.

      Therefore, just hide the window on SDL_WINDOWEVENT_SHOWN if it is
      supposed to be hidden (and analogous for SDL_WINDOWEVENT_HIDDEN).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 1dfc5c8808e8b523c8ef70859921ab5ecd09cd67
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Dec 12 10:52:51 2014 +0100

      sdl2: Use correct sdl2_console for window events

      SDL_PollEvent() polls events for all windows; therefore,
      sdl2_poll_events() will poll the events for all windows and not only for
      the one identified by the given sdl2_console.

      This should be considered in handle_windowevent(): The window affected
      by the event is not necessarily the one identified by the sdl2_console
      object given to sdl2_poll_events(), but the one identified by
      ev->window.windowID.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 62959ffe45bdd7bb069e529686a8c152518812fc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 12 08:03:34 2014 +0100

      sdl2: move sdl2_2d_refresh to sdl2-2d.c

      Now that common event handling code is split off, we can move
      over sdl_refresh to sdl2-2d.c, and rename it to sdl2_2d_refresh.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 63ed4907cb4cfacf1f875f938037af9c75afa453
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Nov 12 08:01:27 2014 +0100

      sdl2: factor out sdl2_poll_events

      Create a new function to poll and handle sdl2 events,
      which is then just called from the refresh timer.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 0d01b7ce617b5f511c852ad770fd7fdce6bf353d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:31:08 2014 +0100

      sdl2: add+use sdl2_2d_redraw function.

      Add a new sdl2_2d_redraw function for a complete screen refresh,
      so we can stop using graphic_hw_invalidate for that.  There is
      no need to bother console / gfx emulation code if we are just
      going to re-blit the screen after window resizes.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 2c3056f182e16038c8b0663f68b3b5105899fb75
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:22:49 2014 +0100

      sdl2: move sdl_switch to sdl2-2d.c

      Move sdl_switch to sdl2-2d.c file, rename to sdl2_2d_switch.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 46522a82236ea0cf9011b89896d2d8f8ddaf2443
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 13:12:02 2014 +0100

      sdl2: overhaul window size handling

      Split do_sdl_resize function (which does alot more than just resizing)
      into three: sdl2_window_{create,destroy,resize}.

      Fix SDL_Renderer handling: must be guest display size not host window
      size, and SDL2 will magically handle all scaling for us.

      Make fullscreen actually enter fullscreen mode and simplify the code.
      There is no need to store the original window size, the window manager
      will do that for us.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit f1ddebd8651c023409d3505f83416f65ce088961
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 11:09:26 2014 +0100

      sdl2: move sdl_update to new sdl2-2d.c

      Create new sdl2-2d file for 2d display rendering.
      Move over sdl_update code, and rename to sdl2_2d_update.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 44f017d03e72484d47a2aefcbf452af0a9915fbc
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 12:02:50 2014 +0100

      sdl2: turn on keyboard grabs

      Makes quite some keys actually go to the guest instead of
      being captured by the host window manager.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 8fc1a3f58f180089284c7d5c8e67b584930d19fe
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:58:19 2014 +0100

      sdl2: move keyboard input code to new sdl2-input.c

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 5d0fe65078bcd6949372a49b125dded981856197
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:21:24 2014 +0100

      sdl2: rename sdl2_state to sdl2_console, move to header file

      Create sdl2.h header file, in preparation for sdl2 code splitup.
      Populate it with sdl2_console struct (renamed from sdl2_state).

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit 97e89ee914411384dcda771d38bf89f13726d71e
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sat Nov 8 19:00:55 2014 +0300

      target-xtensa: don't generate dead code

      Don't generate TCG operations when privilege, register window or
      coprocessor checks fail.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2db59a76c421cdd1039d10e32a9798952d3ff5ba
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Thu Oct 30 18:07:47 2014 +0300

      target-xtensa: record available window in TB flags

      Record last valid 4-register window pane number in TB flags so that a
      window overflow exception throw point is known at the translation time.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 85d36377e4ff8b98119420099d445369bfd6b7bb
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Dec 14 08:23:52 2014 +0300

      target-xtensa: test cross-page opcode

      Alter cross-page TB test to also test cross-page opcode.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 01673a3401614b4199c9946ad47b97bedfc7a7c2
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Dec 14 07:50:55 2014 +0300

      target-xtensa: fix translation for opcodes crossing page boundary

      If TB ends with an opcode that crosses page boundary and the following
      page is not executable then EPC1 for the code fetch exception wrongly
      points at the beginning of the TB. Always treat instruction that crosses
      page boundary as a separate TB.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

  commit 246ae24d7df47f05d7b102f9c84e00b536eadc43
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   Sun Nov 2 11:04:18 2014 +0300

      tcg: add separate monitor command to dump opcode counters

      Currently 'info jit' outputs half of the information to monitor and the
      rest to qemu log. Dumping opcode counts to monitor as a part of 'info
      jit' command doesn't sound useful. Add new monitor command 'info
      opcount' that only dumps opcode counters.

      Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

  commit 339aaf5b7f26d1e638641c59a44883b7654bd8ea
  Author: Antony Pavlov <antonynpavlov@gmail.com>
  Date:   Sat Dec 13 19:48:18 2014 +0300

      qemu-log: add log category for MMU info

      Running barebox on qemu-system-mips* with '-d unimp' overloads
      stderr by very very many mips_cpu_handle_mmu_fault() messages:

        mips_cpu_handle_mmu_fault address=b80003fd ret 0 physical 00000000180003fd prot 3
        mips_cpu_handle_mmu_fault address=a0800884 ret 0 physical 0000000000800884 prot 3
        mips_cpu_handle_mmu_fault pc a080cd80 ad b80003fd rw 0 mmu_idx 0

      So it's very difficult to find LOG_UNIMP message.

      The mips_cpu_handle_mmu_fault() messages appear on enabling ANY
      logging! It's not very handy.

      Adding separate log category for *_cpu_handle_mmu_fault()
      logging fixes the problem.

      Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
      Acked-by: Alexander Graf <agraf@suse.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Message-id: 1418489298-1184-1-git-send-email-antonynpavlov@gmail.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit d86fb03469e016af4e54f04efccbc20a8afa3e19
  Merge: 4db753b a416427
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 16:52:42 2014 +0000

      Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20141216-1' into staging

      misc spice updates.

      # gpg: Signature made Tue 16 Dec 2014 14:03:07 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/spice/tags/pull-spice-20141216-1:
        spice: fix memory leak
        spice: remove spice-experimental.h include
        spice: do not require TCP ports
        spice: rework mirror allocation, add no-resize fast path
        spice: reduce refresh rate in native mode
        spice: use bottom half instead of refresh timer for cursor updates

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4db753b1ac4aedc6cd67fb13d50e5015ce8052a5
  Merge: dfa9c2a 44a1f94
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 16 14:53:23 2014 +0000

      Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.3-2' into staging

      Migration pull for 2.3.  Mostly moving the code to the migration/
      directory, and updating MAINTAINERS.

      I've also folded my other MAINTAINERS update patches into this, as
      they're small by themselves.

      # gpg: Signature made Tue 16 Dec 2014 12:21:24 GMT using RSA key ID 854083B6
      # gpg: Good signature from "Amit Shah <amit@amitshah.net>"
      # gpg:                 aka "Amit Shah <amit@kernel.org>"
      # gpg:                 aka "Amit Shah <amitshah@gmx.net>"

      * remotes/amit-migration/tags/for-2.3-2:
        MAINTAINERS: Update for migrated migration code
        Split the QEMU buffered file code out
        Split struct QEMUFile out
        Remove migration- pre/post fixes off files in migration/ dir
        Start migrating migration code into a migration directory
        qmp-command.hx: add missing docs for migration capabilites
        cpu: verify that block->host is set
        cpu: assert host pointer offset within block
        exec: add wrapper for host pointer access
        MAINTAINERS: add include files to virtio-serial entry
        MAINTAINERS: add entry for virtio-rng
        MAINTAINERS: migration: add vmstate static checker files
        MAINTAINERS: Add myself to migration maintainers

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 46817e86fc1d97af0a7d9e4060730f7b00183083
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Dec 5 11:33:37 2014 +0800

      vga: set catagory bit for secondary vga device

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 22382bb96c8bd88370c1ff0cb28c3ee6bee79ed3
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Thu Oct 16 10:22:23 2014 +0200

      move hw cursor pos from cirrus to vga

  commit b9fd11b86779b1fe7fe2881c6e312a028e20e67c
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 10:28:39 2014 +1000

      cirrus: Force use of shadow pixmap when HW cursor is enabled

      The HW cursor cannot be painted on a shared surface. This fixes HW
      cursor display in Windows NT 4.0 and Windows 98.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 5508099397c480f1c3b4f14b0e64593ebe284b26
  Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  Date:   Mon Jul 7 10:17:44 2014 +1000

      vga: Add mechanism to force the use of a shadow surface

      This prevents surface sharing which will be necessary to
      fix cirrus HW cursor support.

      Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit a41642708a5d1cbe8ad966227bbee1ed5eb421ad
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Fri Dec 5 16:30:10 2014 +0800

      spice: fix memory leak

      If errors happen for middle items of channel_list,
      qmp_query_spice_channels() returns NULL, and the variable
      cur_item going out of scope leaks the storage it points to.

      The flag is a compatibility thing for older spice-server
      versions. Meanwhile our minimum spice version requirement is
      new enough that we should never ever see this error, and if we
      do something went very seriously wrong. Let's using assert()
      instead of returning NULL to avoid a memory leak.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit e0883e2de0ef36f254acc274e80ddeac13a2a8f6
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Mon Nov 17 16:52:49 2014 +0100

      spice: remove spice-experimental.h include

      Nothing seems to be using functions from spice-experimental.h (better
      that way). Let's remove its inclusion.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit cf7856adefebe86e0cd50302d93b3045e3111690
  Author: Marc-André Lureau <marcandre.lureau@gmail.com>
  Date:   Tue Nov 11 13:39:19 2014 +0100

      spice: do not require TCP ports

      It is possible to use Spice server without TCP port.  On local VM,
      qemu (and libvirt) can add new clients thanks to QMP add_client command.

      Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 555e72f2d02125766601db52c6380357b3820fcb
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Sat Nov 8 08:56:34 2014 +0100

      spice: rework mirror allocation, add no-resize fast path

      Add fast path to qemu_spice_display_switch in case old and new
      displaysurface have identical size (happens with display panning
      and page flipping).  We just swap the backing store then and don't
      go through the whole process of deleting and creating the primary
      surface.

      To simplify the code a bit move mirror surface allocation to
      qemu_spice_display_switch().

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 3dcadce5076d4b42fa395c39662d65e050b77784
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 4 14:16:12 2014 +0100

      spice: reduce refresh rate in native mode

      Now that cursor updates are out of the way qxl needs the refresh timer
      only when when running in vga mode, for dirty bitmap checking.  In
      native qxl mode the guest will notify us, so we don't need to poll and
      can use the idle interval (one refresh wakeup every few seconds).

      Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 0b2824e5e48a787be3edbfc897244b4621e5bd61
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 4 13:59:59 2014 +0100

      spice: use bottom half instead of refresh timer for cursor updates

      Calling directly doesn't work due to the qxl-render code running in
      spice server thread context.  Meanwhile bottom half scheduling is
      thread-safe though, so we can use that to kick a cursor update in
      main i/o thread context.

      Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit d29c431edce6c0cd18fc5c4ecf31417c2569ae4a
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Tue Nov 11 10:13:08 2014 +0100

      sdl: move version logic from source code to makefile

      Compile sdl.c / sdl2.c depending on CONFIG_SDLABI instead of
      compiling both and have version #ifdefs in the source code.

      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit d4fa5354a246a1c6cb538a5d8ebcc21206d502fb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 16:30:59 2014 +0000

      target-mips: remove excp_names[] from linux-user as it is unused

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 8ef39152636d27b0d3340fcf030c3edb85a436cb
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Fri Dec 12 16:12:11 2014 +0000

      disas/mips: disable unused mips16_to_32_reg_map[]

      This array is used by print_mips16_insn_arg() which is guarded by #if 0.
      Therefore doing the same with the array as it generates clang warnings.

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8e5f7570448185297917d82d61ffbe27eff47a01
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 15:48:02 2014 +0000

      disas/mips: remove unused mips_msa_control_names_numeric[32]

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 00fb4a118142650e7fa3d5007b197bc11fec6ea9
  Author: Leon Alrae <leon.alrae@imgtec.com>
  Date:   Wed Dec 10 15:39:42 2014 +0000

      target-mips: convert single case switch into if statement

      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

  commit 66991d1103562591eba6b801049720976317fe61
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 22:31:33 2014 +0000

      target-mips: Fix DisasContext's ulri member initialization

      Set DisasContext's ulri member to 0 or 1 as with other bool members.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1a4d570017bf35d99340781ecb59dd3772464031
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 17:51:12 2014 +0000

      target-mips: Use local float status pointer across MSA macros

      Reduce line wrapping throughout MSA helper macros by using a local float
      status pointer rather than referring to the float status through the
      environment each time.  No functional change.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit bb962386b82c1b0e9e12fdb6b9bb62106bf1f822
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Dec 2 17:02:38 2014 +0000

      target-mips: Add missing calls to synchronise SoftFloat status

      Add missing calls to synchronise the SoftFloat status with the CP1.FSCR:

      + for the rounding and flush-to-zero modes upon processor reset,

      + for the flush-to-zero mode on FSCR updates through the GDB stub.

      Refactor code accordingly and remove the redundant RESTORE_ROUNDING_MODE
      macro.

      Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 74797f40dc3e17633fea614f08c828020f755b28
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Thu Nov 20 16:00:54 2014 +0000

      linux-user: Use the 5KEf processor for 64-bit emulation

      Replace the 20Kc original MIPS64 ISA processor used for 64-bit user
      emulation with the 5KEf processor that implements the MIPS64r2 ISA,
      complementing the choice of the 24Kf processor for 32-bit emulation.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 1d725ae952a14b30c84b7bc81b218b8ba77dd311
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Thu Nov 20 11:15:34 2014 +0000

      target-mips: Also apply the CP0.Status mask to MTTC0

      Make CP0.Status writes made with the MTTC0 instruction respect this
      register's mask just like all the other places.  Also preserve the
      current values of masked out bits.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit cbb26c9a122c3f71fb53989817d406a2f6d08662
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Dec 5 18:46:04 2014 +0000

      target-mips: gdbstub: Clean up FPU register handling

      Rewrite the FPU register access parts of `mips_cpu_gdb_read_register'
      and `mips_cpu_gdb_write_register' for consistency between each other.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c48245f0c62405f27266fcf08722d8c290520418
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 19 17:29:00 2014 +0000

      target-mips: Correct 32-bit address space wrapping

      Make sure the address space is unconditionally wrapped on 32-bit
      processors, that is ones that do not implement at least the MIPS III
      ISA.

      Also make MIPS16 SAVE and RESTORE instructions use address calculation
      rather than plain arithmetic operations for stack pointer manipulation
      so that their semantics for stack accesses follows the architecture
      specification.  That in particular applies to user software run on
      64-bit processors with the CP0.Status.UX bit clear where the address
      space is wrapped to 32 bits.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d9224450208e0de62323b64ace91f98bc31d6e2c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Dec 5 18:47:58 2014 +0000

      target-mips: Tighten ISA level checks

      Tighten ISA level checks down to MIPS II that many of our instructions
      are missing.  Also make sure any 64-bit instruction enables are only
      applied to 64-bit processors, that is ones that implement at least the
      MIPS III ISA.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 90f12d735d66ac1196d9a2bced039a432eefc03d
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 18 03:59:07 2014 +0000

      target-mips: Fix CP0.Config3.ISAOnExc write accesses

      Fix CP0.Config3.ISAOnExc write accesses on microMIPS processors.  This
      bit is mandatory for any processor that implements the microMIPS
      instruction set.  This bit is r/w for processors that implement both the
      standard MIPS and the microMIPS instruction set.  This bit is r/o and
      hardwired to 1 if only the microMIPS instruction set is implemented.

      There is no other bit ever writable in CP0.Config3 so defining a
      corresponding `CP0_Config3_rw_bitmask' member in `CPUMIPSState' is I
      think an overkill.  Therefore make the ability to write the bit rely on
      the presence of ASE_MICROMIPS set in the instruction flags.

      The read-only case of the microMIPS instruction set being implemented
      only can be added when we add support for such a configuration.  We do
      not currently have such support, we have no instruction flag that would
      control the presence of the standard MIPS instruction set nor any
      associated code in instruction decoding.

      This change is needed to boot a microMIPS Linux kernel successfully,
      otherwise it hangs early on as interrupts are enabled and then the
      exception handler invoked loops as its first instruction is interpreted
      in the wrong execution mode and triggers another exception right away.
      And then over and over again.

      We already check the current setting of the CP0.Config3.ISAOnExc in
      `set_hflags_for_handler' to set the ISA bit correctly on the exception
      handler entry so it is the ability to set it that is missing only.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 27e1fb13f21e132011673f0a39e17bcc97583633
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 18 03:20:28 2014 +0000

      target-mips: Output CP0.Config2-5 in the register dump

      Include CP0.Config2 through CP0.Config5 registers in the register dump
      produced with the `info registers' monitor command.  Align vertically
      with the registers already output.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 7215d7e7aea85699bf516c3e8d84f6a22584da35
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 12 15:21:53 2014 +0000

      target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP

      Fix microMIPS MOVE16 and MOVEP instructions on 64-bit processors by
      using register addition operations.

      This copies the approach taken with MIPS16 MOVE instructions (I8_MOV32R
      and I8_MOVR32 opcodes) and follows the observation that OPC_ADDU expands
      to tcg_gen_mov_tl whenever `rt' is 0 and `rs' is not, therefore copying
      `rs' to `rd' verbatim.  This is not the case with OPC_ADDIU where a
      sign-extension from bit #31 is made, unless in the uninteresting case of
      `rs' being 0, losing the upper 32 bits of the value copied for any
      proper 64-bit values.

      This also serves as an optimization as one op is produced in generated
      code rather than two (again, unless `rs' is 0, where it doesn't change
      anything).

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 81a423e6c6d3ccaa79de4e58024369c660c1eeb4
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 10 13:46:35 2014 +0000

      target-mips: Correct the writes to Status and Cause registers via gdbstub

      Make writes to CP0.Status and CP0.Cause have the same effect as
      executing corresponding MTC0 instructions would in Kernel Mode.  Also
      ignore writes in the user emulation mode.

      Currently for requests from the GDB stub we write all the bits across
      both registers, ignoring any read-only locations, and do not synchronise
      the environment to evaluate side effects.  We also write these registers
      in the user emulation mode even though a real kernel presents them as
      read only.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit f88f79ec9df06d26d84e1d2e0c02d2634b4d8583
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 10 13:45:41 2014 +0000

      target-mips: Correct the handling of writes to CP0.Status for MIPSr6

      Correct these issues with the handling of CP0.Status for MIPSr6:

      * only ignore the bit pattern of 0b11 on writes to CP0.Status.KSU, that
        is for processors that do implement Supervisor Mode, let the bit
        pattern be written to CP0.Status.UM:R0 freely (of course the value
        written to read-only CP0.Status.R0 will be discarded anyway); this is
        in accordance to the relevant architecture specification[1],

      * check the newly written pattern rather than the current contents of
        CP0.Status for the KSU bits being 0b11,

      * use meaningful macro names to refer to CP0.Status bits rather than
        magic numbers.

      References:

      [1] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
          Privileged Resource Architecture", MIPS Technologies, Inc., Document
          Number: MD00091, Revision 6.00, March 31, 2014, Table 9.45 "Status
          Register Field Descriptions", pp. 210-211.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c3577479815f5bcf9d38993967bca2115af245d8
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Fri Nov 7 20:05:35 2014 +0000

      target-mips: Correct MIPS16/microMIPS branch size calculation

      Correct MIPS16/microMIPS branch size calculation in PC adjustment
      needed:

      - to set the value of CP0.ErrorEPC at the entry to the reset exception,

      - for the purpose of branch reexecution in the context of device I/O.

      Follow the approach taken in `exception_resume_pc' for ordinary, Debug
      and NMI exceptions.

      MIPS16 and microMIPS branches can be 2 or 4 bytes in size and that has
      to be reflected in calculation.  Original MIPS ISA branches, which is
      where this code originates from, are always 4 bytes long, just as all
      original MIPS ISA instructions.

      Signed-off-by: Nathan Froyd <froydnj@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8fc605b8aa257feb3e69d44794a765bd492b573b
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:38:01 2014 +0000

      target-mips: Restore the order of helpers

      Restore the order of helpers that used to be: unary operations (generic,
      then MIPS-specific), binary operations (generic, then MIPS-specific),
      compare operations.  At one point FMA operations were inserted at a
      random place in the file, disregarding the preexisting order, and later
      on even more operations sprinkled across the file.  Revert the mess by
      moving FMA operations to a new ternary class inserted after the binary
      class and move the misplaced unary and binary operations to where they
      belong.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 51fdea945ae7adae8d7e4a1624e35bb7f714b58f
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:36:28 2014 +0000

      target-mips: Remove unused `FLOAT_OP' macro

      Remove the `FLOAT_OP' macro, unused since commit
      b6d96beda3a6cbf20a2d04a609eff78adebd8859 [Use temporary registers for
      the MIPS FPU emulation.].

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 2b09f94cdbf5c54e2278d7f3aed2eceff3494790
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:35:59 2014 +0000

      target-mips: Make `helper_float_cvtw_s' consistent with the remaining helpers

      Move the call to `update_fcr31' in `helper_float_cvtw_s' after the
      exception flag check, for consistency with the remaining helpers that do
      it last too.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d2bfa6e6222baa0218bd0658499d38bac56ac34c
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:35:31 2014 +0000

      target-mips: Fix formatting in `decode_opc'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 6225a4a0e39cb24e7b9e1d4d2c1a3e6eaee18e85
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:34:58 2014 +0000

      target-mips: Fix formatting in `mips_defs'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit d75de74967f631a7d0b538d4b88f96f9c426bfe2
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Wed Nov 5 15:34:00 2014 +0000

      target-mips: Fix formatting in `decode_extended_mips16_opc'

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 4386f08767240080334539ac0b07a8bfe30bffe9
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:42:19 2014 +0000

      target-mips: Enable vectored interrupt support for the 74Kf CPU

      Enable vectored interrupt support for the 74Kf CPU, reflecting hardware.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 11f5ea105c06bec72e9bc9a700fa65d60afb5ec3
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:39:48 2014 +0000

      target-mips: Add M14K and M14Kc MIPS32r2 microMIPS processors

      Add the M14K and M14Kc processors from MIPS Technologies that are the
      original implementation of the microMIPS ISA.  They are dual instruction
      set processors, implementing both the microMIPS and the standard MIPSr32
      ISA.

      These processors correspond to the M4K and 4KEc CPUs respectively,
      except with support for the microMIPS instruction set added, support for
      the MCU ASE added and two extra interrupt lines, making a total of 8
      hardware interrupts plus 2 software interrupts.  The remaining parts of
      the microarchitecture, in particular the pipeline, stayed unchanged.

      The presence of the microMIPS ASE is is reflected in the configuration
      added.  We currently have no support for the MCU ASE, including in
      particular the ACLR, ASET and IRET instructions in either encoding, and
      we have no support for the extra interrupt lines, including bits in
      CP0.Status and CP0.Cause registers, so these features are not marked,
      making our support diverge from real hardware.

      Signed-off-by: Sandra Loosemore <sandra@codesourcery.com>
      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 8280b12c0e4b515d707509dde4ddde05d9bda4ef
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Tue Nov 4 15:37:17 2014 +0000

      target-mips: Make CP0.Config4 and CP0.Config5 registers signed

      Make the data type used for the CP0.Config4 and CP0.Config5 registers
      and their mask signed, for consistency with the remaining 32-bit CP0
      registers, like CP0.Config0, etc.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 36b86e0dc2be93fc538fe7e11e0fda1a198f0135
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 19:31:26 2014 +0000

      target-mips: Add 5KEc and 5KEf MIPS64r2 processors

      Add the 5KEc and 5KEf processors from MIPS Technologies that are the
      original implementation of the MIPS64r2 ISA.

      Silicon for these processors has never been taped out and no soft cores
      were released even.  They do exist though, a CP0.PRId value has been
      assigned and experimental RTLs produced at the time the MIPS64r2 ISA has
      been finalized.  The settings introduced here faithfully reproduce that
      hardware.

      As far the implementation goes these processors are the same as the 5Kc
      and the 5Kf CPUs respectively, except implementing the MIPS64r2 rather
      than the original MIPS64 instruction set.  There must have been some
      updates to the CP0 architecture as mandated by the ISA, such as the
      addition of the EBase register, although I am not sure about the exact
      details, no documentation has ever been produced for these processors.
      The remaining parts of the microarchitecture, in particular the
      pipeline, stayed unchanged.  Or to put it another way, the difference
      between a 5K and a 5KE CPU corresponds to one between a 4K and a 4KE
      CPU, except for the 64-bit rather than 32-bit ISA.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit c7d4d98ae7057467f48c02a11ad9120021976089
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 18:51:38 2014 +0000

      target-mips: Make CP1.FIR read-only here too

      CP1.FIR is read-only in hardware so gdbstub must respect it.  We already
      respect it for CTC1 instructions, so do it here too.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 800675f11742b6080e40d17b8d5f35d3a5fc5724
  Author: Maciej W. Rozycki <macro@codesourcery.com>
  Date:   Mon Nov 3 18:47:45 2014 +0000

      target-mips: Correct the handling of register #72 on writes

      Fix an off-by-one error in `mips_cpu_gdb_write_register' for register
      matching how `mips_cpu_gdb_read_register' handles it.  This register
      slot is a fake anyway, there's nothing in hardware that corresponds to
      it.

      Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
      Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>

  commit 44a1f94684eeaa6e312ea2d77ede266a81d31210
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:42 2014 +0000

      MAINTAINERS: Update for migrated migration code

      My previous patches migrated the migration code into migration/
      but didn't update MAINTAINERS.

      Note that does mean that the owner for block-migration.c
      changes, but I'll ask block people what they want to do.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 977184db39678624c1fc11d0d834a33127745904
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:41 2014 +0000

      Split the QEMU buffered file code out

      The splitting of qemu-file and addition of the buffered file landed
      at the same time; so now split the buffered file code out.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 4f9d09001261420a2990454e91320aca2d9d8781
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:40 2014 +0000

      Split struct QEMUFile out

      Now we've got multiple QEMUFile source files, some of them need
      access to things that were defined in qemu-file.c, so create
      a -internal header for them.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 329c9b10b659209c663e59ce164727ef9fd2ecdb
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:39 2014 +0000

      Remove migration- pre/post fixes off files in migration/ dir

      The general feeling is that having migration/migration-blah
      is overkill.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 60fe637bf0e4d7989e21e50f52526444765c63b4
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Fri Dec 12 11:13:38 2014 +0000

      Start migrating migration code into a migration directory

      The migration code now occupies a fair chunk of the top level .c
      files, it seems time to give it it's own directory.

      I've not touched:
         arch_init.c - that's mostly RAM migration but has a few random other
                       bits
         savevm.c    - because it's built target specific

      This is purely a code move; no code has changed.
         - it fails checkpatch because of old violations, it feels safer
           to keep this as purely a move and fix those at some mythical future
           date.

      The xbzrle and vmstate tests are now only run for softmmu builds
      since they require files in the migrate/ directory which is only built
      for softmmu.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit d6d69731f5295e4c3bb0196f57e8848af28b705e
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue Dec 9 14:38:37 2014 +0800

      qmp-command.hx: add missing docs for migration capabilites

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit b78accf6147a87a3d9c1cd4287d7a1ff805f358e
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:47 2014 +0200

      cpu: verify that block->host is set

      If it isn't, access at an offset will cause memory corruption.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit fd5f3b636788f79843d42188ed843c0416643326
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:44 2014 +0200

      cpu: assert host pointer offset within block

      Make accesses safer in case we missed some
      check somewhere.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1240be24357ee292f8d05aa2abfdba75dd0ca25d
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   Wed Nov 12 11:44:41 2014 +0200

      exec: add wrapper for host pointer access

      host pointer accesses force pointer math, let's
      add a wrapper to make them safer.

      Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 68a5e38a7e428c05610fdbced7e7320a7aea3dc2
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:27 2014 +0530

      MAINTAINERS: add include files to virtio-serial entry

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 1f51a5cb9741c9bf98b1e3d0e3ee60b71cfdf63e
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:26 2014 +0530

      MAINTAINERS: add entry for virtio-rng

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit c55156402e5b1f64b17c3261ef39a5e6666d9209
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:25 2014 +0530

      MAINTAINERS: migration: add vmstate static checker files

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit 7f4675c3f737f3eded685deb83b47c9257e69999
  Author: Amit Shah <amit.shah@redhat.com>
  Date:   Tue Nov 18 18:01:24 2014 +0530

      MAINTAINERS: Add myself to migration maintainers

      Signed-off-by: Amit Shah <amit.shah@redhat.com>
      Reviewed-by: Juan Quintela <quintela@redhat.com>
      Signed-off-by: Amit Shah <amit.shah@redhat.com>

  commit dfa9c2a0f4d0a0c8b2c1449ecdbb1297427e1560
  Merge: 5460075 224d10f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 15 16:43:42 2014 +0000

      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

      - Migration and linuxboot fixes for 2.2 regressions
      - valgrind/KVM support
      - small i386 patches
      - PCI SD host controller support
      - malloc/free cleanups from Markus (x86/scsi)
      - IvyBridge model
      - XSAVES support for KVM
      - initial patches from record/replay

      # gpg: Signature made Mon 15 Dec 2014 16:35:08 GMT using RSA key ID 78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

      * remotes/bonzini/tags/for-upstream: (47 commits)
        sdhci: Support SDHCI devices on PCI
        sdhci: Define SDHCI PCI ids
        sdhci: Add "sysbus" to sdhci QOM types and methods
        sdhci: Remove class "virtual" methods
        sdhci: Set a default frequency clock
        serial: only resample THR interrupt on rising edge of IER.THRI
        serial: update LSR on enabling/disabling FIFOs
        serial: clean up THRE/TEMT handling
        serial: reset thri_pending on IER writes with THRI=0
        linuxboot: fix loading old kernels
        kvm/apic: fix 2.2->2.1 migration
        target-i386: add Ivy Bridge CPU model
        target-i386: add f16c and rdrand to Haswell and Broadwell
        target-i386: add VME to all CPUs
        pc: add 2.3 machine types
        i386: do not cross the pages boundaries in replay mode
        cpus: make icount warp behave well with respect to stop/cont
        timer: introduce new QEMU_CLOCK_VIRTUAL_RT clock
        cpu-exec: invalidate nocache translation if they are interrupted
        icount: introduce cpu_get_icount_raw
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 224d10ff5aea9e74a1792fc21188bc9752c43ee9
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:33 2014 -0500

      sdhci: Support SDHCI devices on PCI

      Support for PCI devices following the "SD Host Controller Simplified
      Specification Version 2.00" spec.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ece5e5bfa1377546d5f94e1bb04298e48ce60c1c
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:32 2014 -0500

      sdhci: Define SDHCI PCI ids

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 7302dcd60bbde1b11c298feb8134a34791f21b21
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:31 2014 -0500

      sdhci: Add "sysbus" to sdhci QOM types and methods

      Update the sdhci sysbus QOM types and methods so that sysbus is in
      their name.  This is in preparation for adding PCI versions of these
      types and methods.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d368ba4376b2c1c24175c74b3733b8fe64dbe8a6
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:30 2014 -0500

      sdhci: Remove class "virtual" methods

      The SDHCIClass defines a series of class "methods".  However, no code
      in the QEMU tree overrides these methods or even uses them outside of
      sdhci.c.

      Remove the virtual methods and replace them with direct calls to the
      underlying functions.  This simplifies the process of extending the
      sdhci code to support PCI devices (which have a different parent
      class).

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c7ff8daacf4a669f9ab5a975f33a51ef901b7556
  Author: Kevin O'Connor <kevin@koconnor.net>
  Date:   Mon Dec 8 18:10:34 2014 -0500

      sdhci: Set a default frequency clock

      The Linux SDHCI PCI driver will only register the device if there is a
      clock frequency set.  So, set a default frequency of 52Mhz.

      Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1645b8eee558ffe2389a081bf61d08a864c36d2c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 12 11:54:42 2014 +0100

      serial: only resample THR interrupt on rising edge of IER.THRI

      There is disagreement on whether LSR.THRE should be resampled when
      IER.THRI goes from 1 to 1.  Bochs only does it if IER.THRI goes from 0
      to 1; PCE does it even if IER.THRI is unchanged.  But the Windows driver
      seems to always go from 1 to 0 and back to 1, so do things in agreement
      with Bochs, because the handling of thr_ipending was reported in 2010
      (https://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01914.html)
      as breaking DR-DOS Plus.

      Reported-by: Roy Tam <roytam@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 023c3a9707d0d9259a1e858cdf7804dd10973fca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 19:08:14 2014 +0100

      serial: update LSR on enabling/disabling FIFOs

      When the transmit FIFO is emptied or enabled, the transmitter
      hold register is empty.  When it is disabled, it is also emptied and
      in addition the previous contents of the transmitter hold register
      are discarded.  In either case, the THRE bit in LSR must be set and
      THRI raised.

      When the receive FIFO is emptied or enabled, the data ready and break
      bits must be cleared in LSR.  Likewise when the receive FIFO is disabled.

      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0d931d706266d6ada3bf22d3afca1afdc8d12fa9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 17:01:39 2014 +0100

      serial: clean up THRE/TEMT handling

      - assert TEMT is cleared before sending a character; we'll get one from
      TSR if tsr_retry > 0, from the FIFO or THR otherwise

      - assert THRE cleared and FIFO not empty (if enabled) before fetching a
      character to send.  This effectively reverts dffacd46, but the check
      makes no sense and commit f702e62 (serial: change retry logic to avoid
      concurrency, 2014-07-11) must have made it unnecessary.  The commit
      message for f702e62 talks about multiple calls to qemu_chr_fe_add_watch
      triggering s->tsr_retry >= MAX_XMIT_RETRY, but other failures were
      possible.  For example, if you have multiple calls, the subsequent ones
      will see s->tsr_retry == 0 and will find THRE and/or TEMT on entry.

      - for clarity, raise THRI immediately after the code sets THRE

      - check THRE to see if another character has to be sent.  This makes
      the assertions more obvious and also means TEMT has to be set as soon as
      the loop ends.  It makes the loop send both TSR and THR if flow-control
      happens in non-FIFO mode.  Previously, THR would be lost.

      - clear TEMT together with THRE even in the non-FIFO case

      The last two items are bugfixes, but they were just found by inspection
      and do not squash known bugs.

      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4e02b0fcf5c97579d0d3261c80c65abcf92870fe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 12 10:17:08 2014 +0100

      serial: reset thri_pending on IER writes with THRI=0

      This is responsible for failure of migration from 2.2 to 2.1, because
      thr_ipending is always one in practice.

      serial.c is setting thr_ipending unconditionally.  However, thr_ipending
      is not used at all if THRI=0, and it will be overwritten again the next
      time THRE or THRI changes.  For that reason, we can set thr_ipending to
      zero every time THRI is reset.

      There is disagreement on whether LSR.THRE should be resampled when IER.THRI
      goes from 1 to 1.  This patch does not touch the code, leaving that for
      QEMU 2.3+.

      This has no semantic change and is enough to fix migration in the common
      case where the interrupt is not pending or is reported in IIR.  It does not
      change the migration format, so 2.2.0 -> 2.1 will remain broken but we
      can fix 2.2.1 -> 2.1 without breaking 2.2.1 <-> 2.2.0.

      The case that remains broken (the one in which the subsection is strictly
      necessary) is when THRE=1, the THRI interrupt has *not* been acknowledged
      yet, and a higher-priority interrupt comes.  In this case, you need the
      subsection to tell the source that the lower-priority THRI interrupt is
      pending.  The subsection's breakage of migration, in this case, prevents
      continuing the VM on the destination with an invalid state.

      Cc: qemu-stable@nongnu.org
      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 269e2358492b674c50160553d037702e916b9f1b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 02:17:03 2014 +0100

      linuxboot: fix loading old kernels

      Old kernels that used high memory only allowed the initrd to be in the
      first 896MB of memory.  If you load the initrd above, they complain
      that "initrd extends beyond end of memory".

      In order to fix this, while not breaking machines with small amounts
      of memory fixed by cdebec5 (linuxboot: compute initrd loading address,
      2014-10-06), we need to distinguish two cases.  If pc.c placed the
      initrd at end of memory, use the new algorithm based on the e801
      memory map.  If instead pc.c placed the initrd at the maximum address
      specified by the bzImage, leave it there.

      The only interesting part is that the low-memory info block is now
      loaded very early, in real mode, and thus the 32-bit address has
      to be converted into a real mode segment.  The initrd address is
      also patched in the info block before entering real mode, it is
      simpler that way.

      This fixes booting the RHEL4.8 32-bit installation image with 1GB
      of RAM.

      Cc: qemu-stable@nongnu.org
      Cc: mst@redhat.com
      Cc: jsnow@redhat.com
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 575a6f4082c45778b93032ef1e7fbea4467b3a2a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 16:56:46 2014 +0100

      kvm/apic: fix 2.2->2.1 migration

      The wait_for_sipi field is set back to 1 after an INIT, so it was not
      effective to reset it in kvm_apic_realize.  Introduce a reset callback
      and reset wait_for_sipi there.

      Reported-by: Igor Mammedov <imammedo@redhat.com>
      Cc: qemu-stable@nongnu.org
      Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2f9ac42acf4602453d5839221df6cc7cabc3355e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:55:23 2014 +0100

      target-i386: add Ivy Bridge CPU model

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 78a611f1936b3eac8ed78a2be2146a742a85212c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:52:46 2014 +0100

      target-i386: add f16c and rdrand to Haswell and Broadwell

      Both were added in Ivy Bridge (for which we do not have a CPU model
      yet!).

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b3a4f0b1a072a467d003755ca0e55c5be38387cb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 14:12:41 2014 -0200

      target-i386: add VME to all CPUs

      vm86 mode extensions date back to the 486.  All models should have
      them.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 64bbd372f21dac51cbbb6ba4a52fb0ecb21ca159
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Dec 5 10:51:42 2014 +0100

      pc: add 2.3 machine types

      The next patch will differentiate them.

      Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5b9efc39aee90bbd343793e942bf8f582a0c9e4f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:39:42 2014 +0300

      i386: do not cross the pages boundaries in replay mode

      This patch denies crossing the boundary of the pages in the replay mode,
      because it can cause an exception. Do it only when boundary is
      crossed by the first instruction in the block.
      If current instruction already crossed the bound - it's ok,
      because an exception hasn't stopped this code.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bf2a7ddb0a066c27ed1432b918baa046b6b7dfc5
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:55 2014 +0300

      cpus: make icount warp behave well with respect to stop/cont

      This patch makes icount warp use the new QEMU_CLOCK_VIRTUAL_RT clock.
      This way, icount's QEMU_CLOCK_VIRTUAL will never count time during which
      the virtual machine is stopped.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4e7fa73ec2516334b58e82f9a5649b1468b1eb7a
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:50 2014 +0300

      timer: introduce new QEMU_CLOCK_VIRTUAL_RT clock

      This patch introduces new QEMU_CLOCK_VIRTUAL_RT clock, which
      should be used for icount warping.  In the next patch, it
      will be used to avoid a huge icount warp when a virtual
      machine is stopped for a long time.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d8a499f17ee5f05407874f29f69f0e3e3198a853
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:40:16 2014 +0300

      cpu-exec: invalidate nocache translation if they are interrupted

      In this case, QEMU might longjmp out of cpu-exec.c and miss the final
      cleanup in cpu_exec_nocache.  Do this manually through a new compile
      flag.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 2a62914bd8209d97e918f30f0de74bec2bf622c4
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Dec 8 10:53:45 2014 +0300

      icount: introduce cpu_get_icount_raw

      Separate accessing the instruction counter from the compensation for
      speed and halting that are introduced by qemu_icount_bias.  This
      introduces new infrastructure used by the record/replay patches.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 626cf8f4c6157ed133f0daa89b90d4169060bc97
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Mon Dec 8 10:53:17 2014 +0300

      icount: set can_do_io outside TB execution

      This patch sets can_do_io function to allow reading icount
      within cpu-exec, but outside TB execution.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e511b4d783c47a32420da802104cfb0eb974b22f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:39:20 2014 +0300

      cpu-exec: reset exception_index correctly

      Exception index is reset at every entry at every entry into cpu_exec()
      function. This may cause missing the exceptions while replaying them.
      This patch moves exception_index reset to the locations where they are
      processed.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b4ac20b4df0d1eaa5d546ccb84751e3e97d257fd
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Wed Nov 26 13:38:52 2014 +0300

      cpu-exec: fix cpu_exec_nocache

      In icount mode cpu_exec_nocache function is used to execute part of the
      existing TB. At the end of cpu_exec_nocache newly created TB is deleted.
      Sometimes io_read function needs to recompile current TB and restart TB
      lookup and execution. After that tb_find_fast function finds old (bigger)
      TB again. This TB cannot be executed (because icount is not big enough)
      and cpu_exec_nocache is called again. Such a loop continues over and over.
      This patch deletes old TB and avoids finding it in the TB cache.

      Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f8e1f53334700950eb6691076d51c7d60f1c28f7
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Dec 10 11:16:57 2014 +0100

      scsi-disk: provide maximum transfer length

      The QEMU block layer has a limit of INT_MAX bytes per transfer.

      Expose it in the block limits VPD page for both regular transfers
      and WRITE SAME.

      Reported-by: Ming Lei <ming.lei@canonical.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 3c55fe2a13353b3ddf1db51c34ada23d161ee428
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:45 2014 +0100

      scsi: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0bd0adbe5b438cabbf02230dba1be4c209158f57
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:44 2014 +0100

      scsi: Fuse g_malloc(); memset() into g_malloc0()

      Coccinelle semantic patch:

          @@
          expression LHS, SZ;
          @@
          -       LHS = g_malloc(SZ);
          -       memset(LHS, 0, SZ);
          +       LHS = g_malloc0(SZ);

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 1c3381af327b5f94a10942a3c25777a57fcdd85e
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:12:43 2014 +0100

      scsi: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e42a92ae640dc22ecb4eb7705ddfe89aeadb92cc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:46 2014 +0100

      x86: Drop some superfluous casts from void *

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit ab3ad07f89c7f9e03c17c98e1d1a02dbf61c605c
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:45 2014 +0100

      x86: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 4be34d1e2140b6d1be611c4bfa542c54c232520b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:44 2014 +0100

      x86: Fuse g_malloc(); memset() into g_malloc0()

      Coccinelle semantic patch:

          @@
          expression LHS, SZ;
          @@
          -       LHS = g_malloc(SZ);
          -       memset(LHS, 0, SZ);
          +       LHS = g_malloc0(SZ);

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 18fc80553420a3188336baeeb542e9f2d1ada13b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 14:46:43 2014 +0100

      x86: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 18cd2c17b5370369a886155c001da0a7f54bbcca
  Author: Wanpeng Li <wanpeng.li@linux.intel.com>
  Date:   Wed Dec 3 10:36:23 2014 +0800

      target-i386: get/set/migrate XSAVES state

      Add xsaves related definition, it also adds corresponding part
      to kvm_get/put, and vmstate.

      Signed-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 906b53a2de31a4612e94000f7cfe3a8e4b002f25
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Wed Nov 26 14:33:59 2014 +0100

      target-mips: kvm: do not use get_clock()

      Use the external qemu-timer API instead.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 0bb0b2d2fe7f645ddaf1f0ff40ac669c9feb4aa1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Nov 24 15:54:43 2014 +0100

      target-i386: add feature flags for CPUID[EAX=0xd,ECX=1]

      These represent xsave-related capabilities of the processor, and KVM may
      or may not support them.

      Add feature bits so that they are considered by "-cpu ...,enforce", and use
      the new feature work instead of calling kvm_arch_get_supported_cpuid.

      Bit 3 (XSAVES) is not migratables because it requires saving MSR_IA32_XSS.
      Neither KVM nor any commonly available hardware supports it anyway.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e9af2fef242ce92f86d3d5c1a94c3199ff1e24c9
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Nov 20 22:10:58 2014 +0100

      coverity/s390x: avoid false positive in kvm_irqchip_add_adapter_route

      Paolo Bonzini reported that Coverity reports an uninitialized pad value.
      Let's use a designated initializer for kvm_irq_routing_entry to avoid
      this false positive. This is similar to kvm_irqchip_add_msi_route and
      other users of kvm_irq_routing_entry.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit e6eef7c221634c942e9f586df84aae623aa06cd5
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 10:05:28 2014 +0100

      valgrind/s390x: avoid false positives on KVM_SET_FPU ioctl

      struct kvm_fpu contains an alignment padding on s390x. Let's use a
      designated initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 076796f8fd27f4d014fe2efb6372f1cdc1df9a41
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:33:43 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_VCPU_EVENTS ioctl

      struct kvm_vcpu_events contains reserved fields. Let's use a
      designated initializer to avoid false positives in valgrind.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d19ae73e987ecc13a89c0830b501341103d06982
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:33:23 2014 +0100

      valgrind/i386: avoid false positives on KVM_GET_MSRS ioctl

      struct kvm_msrs contains a pad field. Let's use a designated
      initializer on the info part to avoid false positives from
      valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit c7fe4b12984a36b87438080e48aff5e8f6d48ac9
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:27:34 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_MSRS ioctl

      struct kvm_msrs contains padding bytes. Let's use a designated
      initializer on the info part to avoid false positives from
      valgrind/memcheck. Do the same for generic MSRS, the TSC and
      feature control.

      We also need to zero out the reserved fields in the entries.
      We do this in kvm_msr_entry_set as suggested by Paolo. This
      avoids a big memset that a designated initializer on the
      full structure would do.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit bdfc8480c50a53d91aa9a513d23a84de0d5fbc86
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Thu Oct 30 09:23:41 2014 +0100

      valgrind/i386: avoid false positives on KVM_SET_XCRS ioctl

      struct kvm_xcrs contains padding bytes. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit b0a0551283076c6f3e57cf2bdd525334009b2677
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:58:34 2014 +0200

      valgrind/i386: avoid false positives on KVM_SET_PIT ioctl

      struct kvm_pit_state2 contains pad fields. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5e0b7d8869a567d8f535f63510adf8f53ca438d3
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:55:49 2014 +0200

      valgrind/i386: avoid false positives on KVM_SET_CLOCK ioctl

      kvm_clock_data contains pad fields. Let's use a designated
      initializer to avoid false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit d229b985b504261369f2035936cc147c2606fa92
  Author: Christian Borntraeger <borntraeger@de.ibm.com>
  Date:   Tue Oct 14 11:50:27 2014 +0200

      valgrind: avoid false positives in KVM_GET_DIRTY_LOG ioctl

      struct kvm_dirty_log contains padding fields that trigger false
      positives in valgrind. Let's use a designated initializer to avoid
      false positives from valgrind/memcheck.

      Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9fc0e2d8ac10c1bb08720b44a4cf9190f1ab4f9e
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Oct 31 13:38:19 2014 +0000

      vfio: use kvm_resamplefds_enabled()

      Use the kvm_resamplefds_enabled function

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Acked-by: Alex Williamson <alex.williamson@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit f41389ae3c54bd5e2040e3f95a2872981c3ed965
  Author: Eric Auger <eric.auger@linaro.org>
  Date:   Fri Oct 31 13:38:18 2014 +0000

      KVM_CAP_IRQFD and KVM_CAP_IRQFD_RESAMPLE checks

      Compute kvm_irqfds_allowed by checking the KVM_CAP_IRQFD extension.
      Remove direct settings in architecture specific files.

      Add a new kvm_resamplefds_allowed variable, initialized by
      checking the KVM_CAP_IRQFD_RESAMPLE extension. Add a corresponding
      kvm_resamplefds_enabled() function.

      A special notice for s390 where KVM_CAP_IRQFD was not immediatly
      advirtised when irqfd capability was introduced in the kernel.
      KVM_CAP_IRQ_ROUTING was advertised instead.

      This was fixed in "KVM: s390: announce irqfd capability",
      ebc3226202d5956a5963185222982d435378b899 whereas irqfd support
      was brought in 84223598778ba08041f4297fda485df83414d57e,
      "KVM: s390: irq routing for adapter interrupts".  Both commits
      first appear in 3.15 so there should not be any kernel
      version impacted by this QEMU modification.

      Signed-off-by: Eric Auger <eric.auger@linaro.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 9551ea6991cfb7c777f7943ad69b30d0a4fadac3
  Author: Aurelien Jarno <aurelien@aurel32.net>
  Date:   Sat Jun 21 00:48:09 2014 +0200

      target-i386: simplify AES emulation

      This patch simplifies the AES code, by directly accessing the newly added
      S-Box, InvS-Box and InvMixColumns tables instead of recreating them by
      using the AES_Te and AES_Td tables.

      Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: Richard Henderson <rth@twiddle.net>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 5eba5a6632ff4b0aaa8cb6c806fa95758518a28d
  Author: Drew DeVault <sircmpwn@gmail.com>
  Date:   Wed Oct 29 23:52:03 2014 -0600

      Add bootloader name to multiboot implementation

      The name is set to "qemu".

      Signed-off-by: Drew DeVault <sir@cmpwn.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Drew DeVault <sircmpwn@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  commit 54600752a1dd67844c2cf3c467db562c39499838
  Merge: e0d3795 c4d4525
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Mon Dec 15 11:11:52 2014 +0000

      Merge remote-tracking branch 'remotes/rth/tags/x86-next-20141214' into staging

      Collected x86 patches

      # gpg: Signature made Sun 14 Dec 2014 22:54:28 GMT using RSA key ID 4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"

      * remotes/rth/tags/x86-next-20141214:
        target-i386: fix icount processing for repz instructions
        target-i386: fbld instruction doesn't set minus sign
        target-i386: Wrong conversion infinity from float80 to int32/int64

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c4d4525c38cd93cc5d1a743976eb25ac571d435f
  Author: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
  Date:   Fri Dec 5 12:11:13 2014 +0300

      target-i386: fix icount processing for repz instructions

      TCG generates optimized code for i386 repz instructions in single step mode.
      It means that when ecx becomes 0, execution of the string instruction breaks
      immediately without an additional iteration for ecx==0 (which will only check
      ecx and set the flags). Omitting this iteration leads to different
      instructions counting in singlestep mode and in normal execution.
      This patch disables optimization of this last iteration for icount mode
      which should be deterministic.

      v2: inverted the condition and formatted the comment

      Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit 18b41f95d20ac6dbf918c73e704d4ca1fbc1a62f
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Wed Nov 12 08:53:45 2014 +0100

      target-i386: fbld instruction doesn't set minus sign

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit ea32aaf1a72af102b855317b47a22e75ac2965a9
  Author: Dmitry Poletaev <poletaev-qemu@yandex.ru>
  Date:   Tue Nov 11 15:29:39 2014 +0300

      target-i386: Wrong conversion infinity from float80 to int32/int64

      Signed-off-by: Dmitry Poletaev <poletaev-qemu@yandex.ru>
      Signed-off-by: Richard Henderson <rth@twiddle.net>

  commit e0d3795654b7eb5b91b478bc7e6b717b192a8bce
  Merge: 99c9c3c 82595da
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Fri Dec 12 17:10:44 2014 +0000

      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

      # gpg: Signature made Fri 12 Dec 2014 17:09:56 GMT using RSA key ID 81AB73C8
      # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
      # gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

      * remotes/stefanha/tags/block-pull-request:
        linux-aio: simplify removal of completed iocbs from the list
        linux-aio: drop return code from laio_io_unplug and ioq_submit
        linux-aio: rename LaioQueue idx field to "n"
        linux-aio: track whether the queue is blocked
        linux-aio: queue requests that cannot be submitted
        block: drop unused bdrv_clear_incoming_migration_all() prototype
        block: Don't add trailing space in "Formating..." message
        qemu-iotests: Remove traling whitespaces in *.out
        block: vhdx - set .bdrv_has_zero_init to bdrv_has_zero_init_1
        iotests: Fix test 039
        iotests: Filter for "Killed" in qemu-io output
        qemu-io: Add sigraise command
        block: vhdx - change .vhdx_create default block state to ZERO
        block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec
        block: vhdx - remove redundant comments
        block/rbd: fix memory leak
        iotests: Add test for vmdk JSON file names
        vmdk: Fix error for JSON descriptor file names
        block migration: fix return value

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 82595da8dedde128d8004ec47441aeb720c08704
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:30 2014 +0100

      linux-aio: simplify removal of completed iocbs from the list

      There is no need to do another O(n) pass on the list; the iocb to
      split the list at is already available through the array we passed to
      io_submit.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-6-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit de35464461cd8aa764ce03e8026202fe9861e29d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:29 2014 +0100

      linux-aio: drop return code from laio_io_unplug and ioq_submit

      These are unused.

      Suggested-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-5-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 8455ce053aa07eecdbc8da8db612cb58efc0734c
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:28 2014 +0100

      linux-aio: rename LaioQueue idx field to "n"

      It does not identify an index in an array anymore.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-4-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 43f2376e096382df44d9322ae0cbdca89612d464
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:27 2014 +0100

      linux-aio: track whether the queue is blocked

      Avoid that unplug submits requests when io_submit reported that it
      couldn't accept more; at the same time, try more io_submit calls if it
      could handle the whole set of requests that were passed, so that the
      "blocked" flag is reset as soon as possible.

      After the previous patch, laio_submit already tried to avoid submitting
      requests to a blocked queue, by comparing s->io_q.idx with "==" instead
      of the more natural ">=".  Switch to the simpler expression now that we
      have the "blocked" flag.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-3-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 28b240877bbcdc8add61be227f429b536edd4653
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Thu Dec 11 14:52:26 2014 +0100

      linux-aio: queue requests that cannot be submitted

      Keep a queue of requests that were not submitted; pass them to
      the kernel when a completion is reported, unless the queue is
      plugged.

      The array of iocbs is rebuilt every time from scratch.  This
      avoids keeping the iocbs array and list synchronized.

      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Message-id: 1418305950-30924-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit b5cf2c1b0897506a40e0c420391875acc484792b
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Dec 10 12:02:17 2014 +0000

      block: drop unused bdrv_clear_incoming_migration_all() prototype

      The bdrv_clear_incoming_migration_all() function has not existed since
      commit 7ea2d269cb84ca7a2f4b7c3735634176f7c1dc35 ("block/migration:
      Disable cache invalidate for incoming migration").

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1418212937-22222-1-git-send-email-stefanha@redhat.com

  commit 43c5d8f8001eb467abf091c3e2a8aca3d1e5b522
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 9 15:38:04 2014 +0800

      block: Don't add trailing space in "Formating..." message

      Change the message printing code to output a separator for each option
      string before it instead of after, then we don't one more extra ' ' in
      the end.

      To update qemu-iotests output files, most of the times one would just
      copy the *.out.bad to *.out. With this change we will not have the
      space disliked by checkpatch.pl.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418110684-19528-3-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 7486458c33cd3e5714368f181a5fea39c54444ca
  Author: Fam Zheng <famz@redhat.com>
  Date:   Tue Dec 9 15:38:03 2014 +0800

      qemu-iotests: Remove traling whitespaces in *.out

      This is simply:

        $ cd tests/qemu-iotests; sed -i -e 's/ *$//' *.out

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1418110684-19528-2-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 85b712c9d5b873562c864e72f69cbf0d87d2fe40
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:45 2014 -0500

      block: vhdx - set .bdrv_has_zero_init to bdrv_has_zero_init_1

      Now that new VHDX images will default to BAT block states of
      PAYLOAD_BLOCK_ZERO, we can indicate that VHDX has zero init.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 5e582703e36450b9ca939e2e5c9fa3930030f7fe.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 3f394472c5bca59de5cab9baafdff1984b0213a3
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:12 2014 +0100

      iotests: Fix test 039

      Test 039 used qemu-io -c abort for simulating a qemu crash; however,
      abort() generally results in a core dump and ulimit -c 0 is no reliable
      way of preventing that. Use "sigraise $(kill -l KILL)" instead to have
      it crash without a core dump.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9e0c3e8df5d1b12517d587d60b2fe587ea252ebe
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:11 2014 +0100

      iotests: Filter for "Killed" in qemu-io output

      _filter_qemu_io already filters out the process ID when qemu-io is
      aborted; the same should be done when it is killed.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0e82dc7bbd96f9b0fb76e5fe263ba04b15e68127
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Dec 8 10:48:10 2014 +0100

      qemu-io: Add sigraise command

      abort() has the sometimes undesirable side-effect of generating a core
      dump. If that is not needed, SIGKILL has the same effect of abruptly
      crash qemu; without a core dump.

      Thus, -c abort is not always useful to simulate a qemu-io crash;
      therefore, this patch adds a new sigraise command which allows raising
      a signal.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1418032092-16813-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 30af51ce7f4aebb37359367c65b7405451e70702
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:44 2014 -0500

      block: vhdx - change .vhdx_create default block state to ZERO

      The VHDX spec specifies that the default new block state is
      PAYLOAD_BLOCK_NOT_PRESENT for a dynamic VHDX image, and
      PAYLOAD_BLOCK_FULLY_PRESENT for a fixed VHDX image.

      However, in order to create space-efficient VHDX images with qemu-img
      convert, it is desirable to be able to set has_zero_init to true for
      VHDX.

      There is currently an option when creating VHDX images, to use block
      state ZERO for new blocks.  However, this currently defaults to 'off'.
      In order to be able to eventually set has_zero_init to true for VHDX,
      this needs to default to 'on'.

      This patch changes the default to 'on', and provides some help
      information to warn against setting it to 'off' when using qemu-img
      convert.

      [Max Reitz pointed out that a full stop was missing at the end of the
      VHDX_BLOCK_OPT_ZERO option help text.  I have added it.
      --Stefan]

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 85164899eacc86e150c3ceba793cf93b398dedd7.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit a9d1e9daa5527101c0b2dcf1a57aab549075144a
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:43 2014 -0500

      block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec

      The 0.95 VHDX spec defined PAYLOAD_BLOCK_UNMAPPED to be 5.  The 1.00
      VHDX spec redefines PAYLOAD_BLOCK_UNMAPPED to be 3 instead.

      The original value of 5 is now an undefined state in the spec, but it
      should be safe to treat it the same and return zeros for data read.
      This way, we can maintain compatibility with any images out in the wild
      that may have been created in accordance to the 0.95 spec.

      Reported-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 8a4d2da73a8dbc04cde62bea782fc09ff84b1cf1.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 0571df44a1bf810113037abd14c13afd448601c9
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Mon Dec 8 01:07:42 2014 -0500

      block: vhdx - remove redundant comments

      Minor cleanup.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: e8718ae3fd3e40a527e46a00e394973fbaab4d53.1418018421.git.jcody@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 9281dbe6535d79ecae121f6c3e620c25d55230e9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Dec 4 14:34:11 2014 +0800

      block/rbd: fix memory leak

      Variable local_err going out of scope
      leaks the storage it points to.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Message-id: 1417674851-6248-1-git-send-email-arei.gonglei@huawei.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 942764cc3286d9931ea58fce4e299813daeabfe4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 14:57:23 2014 +0100

      iotests: Add test for vmdk JSON file names

      Add a test for vmdk files which use a file with a JSON file name, and
      which then try to open extents. That should fail and the error message
      should at least try to look helpful.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417615043-26174-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 5c98415b2a2fde5739aefe51793f969ce8bb2758
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 14:57:22 2014 +0100

      vmdk: Fix error for JSON descriptor file names

      If vmdk blindly tries to use path_combine() using bs->file->filename as
      the base file name, this will result in a bad error message for JSON
      file names when calling bdrv_open(). It is better to only try
      bs->file->exact_filename; if that is empty, bs->file->filename will be
      useless for path_combine() and an error should be emitted (containing
      bs->file->filename because desc_file_path (which is
      bs->file->exact_filename) is empty).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417615043-26174-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit ebd9fbd7e102c533143c2c8372312b75c2b2678a
  Author: Gary R Hook <gary.hook@nimboxx.com>
  Date:   Tue Nov 25 17:30:02 2014 -0600

      block migration: fix return value

      Modify block_save_iterate() to return positive/zero/negative
      (success/not done/failure) return status. The computation of
      the blocks transferred (an int64_t) exceeds the size of an
      int return value.

      Signed-off-by: Gary R Hook <gary.hook@nimboxx.com>
      Reviewed-by: ChenLiang <chenliang88@huawei.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1416958202-15913-1-git-send-email-gary.hook@nimboxx.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

  commit 99c9c3cb24e566258a0a141178934f9cb5198842
  Merge: b141290 64baadc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 18:27:02 2014 +0000

      Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2014-12-11' into staging

      trivial patches for 2014-12-11

      # gpg: Signature made Thu 11 Dec 2014 18:13:58 GMT using RSA key ID A4C3D7DB
      # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
      # gpg:                 aka "Michael Tokarev <mjt@debian.org>"

      * remotes/mjt/tags/pull-trivial-patches-2014-12-11:
        Sort include/qemu/typedefs.h
        hpet: increase spelling precision
        pflash_cfi02.c: associate "cfi.pflash02" to "Storage devices" category
        vt82c686: fix coverity warning about out-of-bounds write
        virtio: remove useless declaration of virtio_net_init()
        qapi-schema: fix typo about change-vnc-password
        fw_cfg: remove superfluous blank line
        get_maintainer.pl: Remove the --git-chief-penguins option
        configure: Replace which(1) with "has"
        util: Use g_new() & friends where that makes obvious sense
        util: Fuse g_malloc(); memset() into g_new0()
        util: Drop superfluous conditionals around g_free()
        Drop superfluous conditionals around g_strdup()
        Drop superfluous conditionals around qemu_opts_del()
        usb: delete redundant brackets in usb_host_handle_control()
        virtio-bus: avoid breaking build when open DEBUG switch
        acpi-build: Make DPRINTF working for acpi-build
        acpi-build: adjust indention 8 -> 4 spaces
        target-s390x: fix possible out of bounds read
        qmp: fix typo in input-send-event examples

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 64baadc2726ae929660dd0c61a42e8d9f3ba1828
  Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
  Date:   Thu Dec 11 11:46:36 2014 +0000

      Sort include/qemu/typedefs.h

      Mainly to make it less likely to conflict during merges.

      Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
      Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 97c61fb78ad22bbedc34da2af1db2fd9aa1cbff9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Dec 11 09:18:29 2014 +0000

      hpet: increase spelling precision

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b141290478f847ecaa25561f3b31fbf1ddde95e6
  Merge: 7c38433 25f2895
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 16:47:23 2014 +0000

      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141211' into staging

      target-arm queue:
       * pass semihosting exit code out to system
       * more TrustZone support code (still not enabled yet)
       * allow user to direct semihosting to gdb or native explicitly
         rather than always auto-guessing the destination
       * fix memory leak in realview_init
       * fix coverity warning in hw/arm/boot
       * get state migration working for AArch64 CPUs
       * check errors in kvm_arm_reset_vcpu

      # gpg: Signature made Thu 11 Dec 2014 12:16:19 GMT using RSA key ID 14360CDE
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

      * remotes/pmaydell/tags/pull-target-arm-20141211: (33 commits)
        target-arm: Check error conditions on kvm_arm_reset_vcpu
        target-arm: Support save/load for 64 bit CPUs
        target-arm/kvm: make reg sync code common between kvm32/64
        arm_gic_kvm: Tell kernel about number of IRQs
        hw/arm/boot: fix uninitialized scalar variable warning reported by coverity
        hw/arm/realview.c: Fix memory leak in realview_init()
        target-arm: make MAIR0/1 banked
        target-arm: make c13 cp regs banked (FCSEIDR, ...)
        target-arm: make VBAR banked
        target-arm: make PAR banked
        target-arm: make IFAR/DFAR banked
        target-arm: make DFSR banked
        target-arm: make IFSR banked
        target-arm: make DACR banked
        target-arm: make TTBCR banked
        target-arm: make TTBR0/1 banked
        target-arm: make CSSELR banked
        target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI
        target-arm: add SCTLR_EL3 and make SCTLR banked
        target-arm: add MVBAR support
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7c3843332db39c2f27405b882a505144d62b3664
  Merge: a09f2d1 d899d2e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:36:32 2014 +0000

      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

      Block patches for 2.3

      # gpg: Signature made Wed 10 Dec 2014 09:31:53 GMT using RSA key ID C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

      * remotes/kevin/tags/for-upstream: (73 commits)
        vmdk: Set errp on failures in vmdk_open_vmdk4
        vmdk: Remove unnecessary initialization
        vmdk: Check descriptor file length when reading it
        vmdk: Clean up descriptor file reading
        vmdk: Fix comment to match code of extent lines
        vmdk: Use g_random_int to generate CID
        block: Use g_new0() for a bit of extra type checking
        block: remove BLOCK_OPT_NOCOW from vpc_create_opts
        block: remove BLOCK_OPT_NOCOW from vdi_create_opts
        qemu-iotests: Skip 099 for VMDK subformats with desc file
        block/raw-posix: Fix ret in raw_open_common()
        qcow2: Respect bdrv_truncate() error
        qcow2: Flushing the caches in qcow2_close may fail
        qcow2: Prevent numerical overflow
        iotests: Add test for unsupported image creation
        iotests: Only kill NBD server if it runs
        qemu-img: Check create_opts before image amendment
        qemu-img: Check create_opts before image creation
        block: Check create_opts before image creation
        block/nfs: Add create_opts
        ...

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 25f2895e0e437a3548f9794846001fb5d5ab853d
  Author: Christoffer Dall <christoffer.dall@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm: Check error conditions on kvm_arm_reset_vcpu

      When resetting a VCPU we currently call both kvm_arm_vcpu_init() and
      write_kvmstate_to_list(), both of which can fail, but we never check the
      return value.

      The only choice here is to print an error an exit if the calls fail.

      Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1418039630-11773-1-git-send-email-christoffer.dall@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a7130a3ef9b8dc3091a0700abb61e2926e89e916
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm: Support save/load for 64 bit CPUs

      For migration to work on 64 bit CPUs, we need to include both
      the 64-bit integer register file and the PSTATE. Everything
      else is either stored in the same place as existing 32-bit CPU
      state or handled by the generic sysreg mechanism.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1417788683-4038-3-git-send-email-peter.maydell@linaro.org

  commit 38df27c8a7ef9877583a46e74d99181c3224e078
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      target-arm/kvm: make reg sync code common between kvm32/64

      Before we launch a guest we query KVM for the list of "co-processor"
      registers it knows about. This is used to synchronize system
      register state for the bulk of coprocessor/system registers.
      Move this code from the 32-bit specific vcpu init function into
      a common routine and call it also from the 64-bit vcpu init.

      This allows system registers to migrate correctly when using
      KVM, and also permits QEMU code to see the current KVM register
      state (which will be needed to support big-endian guests, since
      the virtio endianness callback must check for some system register
      settings).

      Since vcpu reset also has to sync registers, we move the
      32 bit kvm_arm_reset_vcpu() into common code as well and
      share it with the 64 bit version.

      Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
      [PMM: just copy the 32-bit code rather than improving it along the way;
       don't share reg_syncs_via_tuple_list() between 32 and 64 bit;
       tweak function names; move reset]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 72149414e25784de60b821fe67c56108a5b03ce1
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      arm_gic_kvm: Tell kernel about number of IRQs

      Newer kernels support a device attribute on the GIC which allows us to
      tell it how many IRQs this GIC instance is configured with; use it, if
      it exists.

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
      Message-id: 1417718679-1071-1-git-send-email-peter.maydell@linaro.org

  commit a554ecb49d0021fd8bb0fd4f2f6be807b3c8b54f
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Thu Dec 11 12:07:53 2014 +0000

      hw/arm/boot: fix uninitialized scalar variable warning reported by coverity

      Coverity reports the 'size' may be used uninitialized, but that can't happen,
      because the caller has checked "if (binfo->dtb_filename || binfo->get_dtb)"
      before call 'load_dtb'.

      Here we simply remove the 'if (binfo->get_dtb)' to satisfy coverity.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Message-id: 1416826240-12368-1-git-send-email-zhang.zhanghailiang@huawei.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b1ab03af890b2b6c5bafc9344b7fe05b392180a5
  Author: Nikita Belov <zodiac@ispras.ru>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      hw/arm/realview.c: Fix memory leak in realview_init()

      Variable 'ram_lo' is allocated unconditionally, but used only in some cases.
      When it is unused pointer will be lost at function exit, resulting in a
      memory leak. Allocate memory for 'ram_lo' only if it is needed.

      Valgrind output:
      ==16879== 240 bytes in 1 blocks are definitely lost in loss record 6,033 of 7,018
      ==16879==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==16879==    by 0x33D2CE: malloc_and_trace (vl.c:2804)
      ==16879==    by 0x509E610: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
      ==16879==    by 0x288836: realview_init (realview.c:55)
      ==16879==    by 0x28988C: realview_pb_a8_init (realview.c:375)
      ==16879==    by 0x341426: main (vl.c:4413)

      Signed-off-by: Nikita Belov <zodiac@ispras.ru>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit be693c87e440e671ed913784554384349ce8331d
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make MAIR0/1 banked

      Added CP register info entries for the ARMv7 MAIR0/1 secure banks.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-26-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 54bf36ed351c526cde0c853079f9ff1ab7e2ff89
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make c13 cp regs banked (FCSEIDR, ...)

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      FCSEIDR, CONTEXTIDR, TPIDRURW, TPIDRURO and TPIDRPRW have a secure
      and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-25-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit fb6c91ba2bb0b1c1b8662ceeeeb9474a025f9a6b
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make VBAR banked

      When EL3 is running in Aarch32 (or ARMv7 with Security Extensions)
      VBAR has a secure and a non-secure instance, which are mapped to
      VBAR_EL1 and VBAR_EL3.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-24-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 01c097f7960b330c4bf038d34bae17ad6c1ba499
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:52 2014 +0000

      target-arm: make PAR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      PAR has a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-23-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b848ce2b9cbd38da3f2530fd93dba76dba0621c0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make IFAR/DFAR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      IFAR and DFAR have a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-22-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 4a7e2d7315bd2ce28e49ccd0bde73eabdfd7437b
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make DFSR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      DFSR has a secure and a non-secure instance.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-21-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 88ca1c2d70523486a952065f3ed7b8fc823b5863
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make IFSR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      IFSR has a secure and a non-secure instance.  Adds IFSR32_EL2 definition and
      storage.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-20-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0c17d68c1d3d6c35f37f5692042d2edb65c8bcc0
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make DACR banked

      When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
      DACR has a secure and a non-secure instance.  Adds definition for DACR32_EL2.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-19-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 11f136ee25232a00f433cefe98ee33cd614ecccc
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make TTBCR banked

      Adds secure and non-secure bank register suport for TTBCR.
      Added new struct to compartmentalize the TCR data and masks.  Removed old
      tcr/ttbcr data and added a 4 element array of the new structs in cp15.  This
      allows for one entry per EL.  Added a CP register definition for TCR_EL3.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-18-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 7dd8c9af0d9d18fb3e54a4843b3bb1398bd330bc
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:51 2014 +0000

      target-arm: make TTBR0/1 banked

      Adds secure and non-secure bank register suport for TTBR0 and TTBR1.
      Changes include adding secure and non-secure instances of ttbr0 and ttbr1 as
      well as a CP register definition for TTBR0_EL3.  Added a union containing
      both EL based array fields and secure and non-secure fields mapped to them.
      Updated accesses to use A32_BANKED_CURRENT_REG_GET macro.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-17-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit b85a1fd61c4d72c7928cd9b70f9f59fb2895936d
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: make CSSELR banked

      Rename CSSELR (cache size selection register) and add secure
      instance (AArch32).

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-16-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 6e8801f9dea9e10449f4fd7d85dbe8cab708a686
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI

      Add checks of SCR AW/FW bits when performing writes of CPSR.  These SCR bits
      are used to control whether the CPSR masking bits can be adjusted from
      non-secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-15-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 137feaa9a1622620adf19c0b707883dd990738e2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add SCTLR_EL3 and make SCTLR banked

      Implements SCTLR_EL3 and uses secure/non-secure instance when
      needed.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-14-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit e89e51a17ea0d8aef9bf9b766c98f963e835fbf2
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add MVBAR support

      Use MVBAR register as exception vector base address for
      exceptions taken to CPU monitor mode.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-13-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 144634ae6c1618dcee6aced9c0d4427844154091
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:50 2014 +0000

      target-arm: add SDER definition

      Added CP register defintions for SDER and SDER32_EL3 as well as cp15.sder for
      register storage.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-12-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 770225764f831031d2e1453f69c365eb1b647d87
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add NSACR register

      Implements NSACR register with corresponding read/write functions
      for ARMv7 and ARMv8.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-11-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit de38d23b542efca54108ef28bcc0efe96f378d2e
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: implement IRQ/FIQ routing to Monitor mode

      SCR.{IRQ/FIQ} bits allow to route IRQ/FIQ exceptions to monitor CPU
      mode. When taking IRQ exception to monitor mode FIQ exception is
      additionally masked.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-10-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0f1a3b2470d798ad5335eb9d6236f02ff64e31a8
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: move AArch32 SCR into security reglist

      Define a new ARM CP register info list for the ARMv7 Security Extension
      feature. Register that list only for ARM cores with Security Extension/EL3
      support. Moving AArch32 SCR into Security Extension register group.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-9-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3f3c82a57d128aa3ec823aa8032867c3a6e2e795
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: insert AArch32 cpregs twice into hashtable

      Prepare for cp register banking by inserting every cp register twice,
      once for secure world and once for non-secure world.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-8-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 51a79b039728277e35fd19f7a7b4bc6cb323697f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add secure state bit to CPREG hash

      Added additional NS-bit to CPREG hash encoding.  Updated hash lookup
      locations to specify hash bit currently set to non-secure.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-7-git-send-email-greg.bellows@linaro.org
      [PMM: fix uses of ENCODE_CP_REG in kvm32.c to add extra argument]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit c3e302606253a17568dc3ef30238f102468f7ee1
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:49 2014 +0000

      target-arm: add CPREG secure state support

      Prepare ARMCPRegInfo to support specifying two fieldoffsets per
      register definition. This will allow us to keep one register
      definition for banked registers (different offsets for secure/
      non-secure world).

      Also added secure state tracking field and flags.  This allows for
      identification of the register info secure state.

      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-6-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 3f342b9e0e64ad681cd39840bfa75ef12d2807c1
  Author: Sergey Fedorov <s.fedorov@samsung.com>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add non-secure Translation Block flag

      This patch is based on idea found in patch at
      git://github.com/jowinter/qemu-trustzone.git
      f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by
      Johannes Winter <johannes.winter@iaik.tugraz.at>.

      The TBFLAG captures the SCR NS secure state at the time when a TB is created so
      the correct bank is accessed on system register accesses.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-5-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit ea30a4b824ecc3c829b70eb9999ac5457dc5790f
  Author: Fabian Aggeler <aggelerf@ethz.ch>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add banked register accessors

      If EL3 is in AArch32 state certain cp registers are banked (secure and
      non-secure instance). When reading or writing to coprocessor registers
      the following macros can be used.

      - A32_BANKED macros are used for choosing the banked register based on provided
        input security argument.  This macro is used to choose the bank during
        translation of MRC/MCR instructions that are dependent on something other
        than the current secure state.
      - A32_BANKED_CURRENT macros are used for choosing the banked register based on
        current secure state.  This is NOT to be used for choosing the bank used
        during translation as it breaks monitor mode.

      If EL3 is operating in AArch64 state coprocessor registers are not
      banked anymore. The macros use the non-secure instance (_ns) in this
      case, which is architecturally mapped to the AArch64 EL register.

      Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com>
      Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-4-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 0eeb17d618361a0f4faddc160e33598b23da6dd5
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: add async excp target_el function

      Adds a dedicated function and a lookup table for determining the target
      exception level of IRQ and FIQ exceptions.  The lookup table is taken from the
      ARMv7 and ARMv8 specification exception routing tables.

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-3-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 57e3a0c7cb0ac2f0288890482e0a463adce2080a
  Author: Greg Bellows <greg.bellows@linaro.org>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      target-arm: extend async excp masking

      This patch extends arm_excp_unmasked() to use lookup tables for determining
      whether IRQ and FIQ exceptions are masked.  The lookup tables are based on the
      ARMv8 and ARMv7 specification physical interrupt masking tables.

      If EL3 is using AArch64 IRQ/FIQ masking is ignored in all exception levels
      other than EL3 if SCR.{FIQ|IRQ} is set to 1 (routed to EL3).

      Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Message-id: 1416242878-876-2-git-send-email-greg.bellows@linaro.org
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a38bb0792ca8b4082d81884a6cb25fa0d334b4a6
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      Add the "-semihosting-config" option.

      The usual semihosting behaviour is to process the system calls locally and
      return; unfortuantelly the initial implementation dinamically changed the
      target to GDB during debug sessions, which, for the usual arm-none-eabi-gdb,
      is not implemented. The result was that during debug sessions the semihosting
      calls were discarded.

      This patch adds a configuration variable and an option to set it on the
      command line:

          -semihosting-config [enable=on|off,]target=native|gdb|auto

      This option enables semihosting and defines where the semihosting calls will
      be addressed, to QEMU ('native') or to GDB ('gdb'). The default is auto, which
      means 'gdb' during debug sessions and 'native' otherwise.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Message-id: 1416341957-9796-1-git-send-email-ilg@livius.net
      [PMM: moved declaration and definition of semihosting_target to
       gdbstub.h and gdbstub.c to fix build failure on linux-user]
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 1ecc3a2df168034b8ab33ff5ba6434ce3593dbb5
  Author: Liviu Ionescu <ilg@livius.net>
  Date:   Thu Dec 11 12:07:48 2014 +0000

      Pass semihosting exit code back to system.

      In order to run unit tests under semihosting, it is necessary to pass the
      application exit code back to the system.

      ARM defines only the code to be used for non-error application exit
      (ADP_Stopped_ApplicationExit), all other codes should return non-zero
      exit codes.

      This patch checks if the application code passed via TARGET_SYS_EXIT is
      ADP_Stopped_ApplicationExit, and return 0, otherwise return 1.

      Signed-off-by: Liviu Ionescu <ilg@livius.net>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit a09f2d16f6b9f5bcdedb4d116bb54da86e9a3f6e
  Merge: 67a5eeb 328f1f0
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 11:41:11 2014 +0000

      Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20141210' into staging

      TriCore BOL, BRC, BRN, BRR, RC, RCPW, RCRR, RCR, RLC and RCR insn added

      # gpg: Signature made Wed 10 Dec 2014 11:21:58 GMT using RSA key ID 6B69CA14
      # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

      * remotes/bkoppelmann/tags/pull-tricore-20141210:
        target-tricore: Add instructions of RCR opcode format
        target-tricore: Add instructions of RLC opcode format
        target-tricore: Add instructions of RCPW, RCRR and RCRW opcode format
        target-tricore: Make TRICORE_FEATURES implying others.
        target-tricore: Add instructions of RC opcode format
        target-tricore: Add instructions of BRR opcode format
        target-tricore: Add instructions of BRN opcode format
        target-tricore: Add instructions of BRC opcode format
        target-tricore: Add instructions of BOL opcode format

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit 67a5eebca1ac15442f06096977381a70a403bc5b
  Merge: 7fb8da2 4394838
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Thu Dec 11 11:19:57 2014 +0000

      Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20141210-1' into staging

      vnc-enc-tight fix, keymaps code style.

      # gpg: Signature made Wed 10 Dec 2014 09:24:33 GMT using RSA key ID D3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

      * remotes/kraxel/tags/pull-vnc-20141210-1:
        keymaps: correct keymaps.c following Qemu coding style
        vnc-enc-tight: fix Arguments in wrong order

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

  commit df6f93182a898c295d90dd502d49818c6bb98200
  Author: Antony Pavlov <antonynpavlov@gmail.com>
  Date:   Sun Dec 7 21:20:45 2014 +0300

      pflash_cfi02.c: associate "cfi.pflash02" to "Storage devices" category

      Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 328f1f0f08f1aa303eef7493bd7c3d97a8d9636a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Nov 2 17:31:45 2014 +0000

      target-tricore: Add instructions of RCR opcode format

      Add instructions of RCR opcode format.
      Add helper for madd32/64_ssov and madd32/64_suov.
      Add helper for msub32/64_ssov and msub32/64_suov.
      Add microcode generator function madd/msub for 32bit and 64bit, which calculate a mul and a add/sub.
      OPC2_32_RCR_MSUB_U_32 -> OPC2_32_RCR_MSUB_U_32.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 2b2f7d97d856a4e7020d881ec1e6e60be64d0ab6
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 30 12:06:53 2014 +0000

      target-tricore: Add instructions of RLC opcode format

      Add instructions of RLC opcode format.
      Add helper psw_write/read.
      Add microcode generator gen_mtcr/mfcr, which loads/stores a value to a core special function register, which are defined in csfr.def

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit ed51626066ea40092335f653780b6d1ca22c574a
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Wed Oct 29 19:48:18 2014 +0000

      target-tricore: Add instructions of RCPW, RCRR and RCRW opcode format

      Add instructions of RCPW, RCRR and RCRW opcode format.
      Add microcode generator function gen_insert.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 47e04430ed3e6ab835f023a5c84381ca2ce9f4d8
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Nov 13 14:17:08 2014 +0000

      target-tricore: Make TRICORE_FEATURES implying others.

      Since all the TriCore instructionsets are subsets of each other (1.3 C 1.3.1 C 1.6),
      make the features implying each other, e.g 1.6 also has 1.3.1 and 1.3. This way
      we only need to check our features for the instructionset, where a instruction was first introduced.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 0974257ed58ff3e9512d74ffa5b4039bbec49b2d
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Sun Oct 26 21:49:41 2014 +0000

      target-tricore: Add instructions of RC opcode format

      Add instructions of RC opcode format.
      Add helper for mul, sha, absdif with signed saturation on overflow.
      Add helper for add, sub, mul with unsigned saturation on overflow.
      Add microcode generator functions:
          * gen_add_CC, which calculates the carry bit.
          * gen_addc_CC, which adds the carry bit to the add and calculates the carry bit.
          * gen_absdif, which calculates the absolute difference.
          * gen_mul_i64s/u, which mul two 32 bits val into one 64bit reg.
          * gen_sh_hi, which shifts two 16bit words in one reg.
          * gen_sha_hi, which does a arithmetic shift on two 16bit words.
          * gen_sh_cond, which shifts left a reg by one and writes the result of cond into the lsb.
          * gen_accumulating_cond, which ands/ors/xors the result of cond of the lsbs
            with the lsb of the result.
          * gen_eqany_bi/hi, which checks ever byte/hword on equality.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit a68e0d547f042f1d75f4d56ca5b6c4cc719d7077
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 23 12:18:02 2014 +0100

      target-tricore: Add instructions of BRR opcode format

      Add instructions of BRR opcode format.
      Add MASK_OP_BRR_DISP15_SEXT.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 83c1bb1868848912f3d5516880e937cb247dfcd1
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Oct 17 17:46:29 2014 +0100

      target-tricore: Add instructions of BRN opcode format

      Add instructions of BRN opcode format.
      Add MASK_OP_BRN_DISP15_SEXT.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit fc2ef4a391c39688d35c7f78cec6a20d552e5a3b
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Fri Oct 17 17:29:01 2014 +0100

      target-tricore: Add instructions of BRC opcode format

      Add instructions of BRC opcode format.
      Fixed OP2_BRC_JGE -> OP2_32_BRC_JGE

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit 3fb763cb55c282a686e22b7639ff6615d527bb10
  Author: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
  Date:   Thu Oct 16 21:07:29 2014 +0100

      target-tricore: Add instructions of BOL opcode format

      Add instructions of BOL opcode format.

      Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
      Reviewed-by: Richard Henderson <rth@twiddle.net>

  commit d899d2e248b900c53dd9081bde9f110e05747433
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:34 2014 +0800

      vmdk: Set errp on failures in vmdk_open_vmdk4

      Reported-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-7-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9aeecbbc62ce52a94b2621a0d53567b5d4ed915d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:33 2014 +0800

      vmdk: Remove unnecessary initialization

      It will be assigned to the return value of vmdk_read_desc.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-6-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 03c3359dfc490eaf922f88955d6a8cc51a37ce92
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:32 2014 +0800

      vmdk: Check descriptor file length when reading it

      Since a too small file cannot be a valid VMDK image, and also since the
      buffer's first 4 bytes will be unconditionally examined by
      vmdk_open_sparse, let's error out the small file case to be clear.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Message-id: 1417649314-13704-5-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73b7bcad439e0edaced05049897090cc10d84b5b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:31 2014 +0800

      vmdk: Clean up descriptor file reading

      Zeroing a buffer that will be filled right after is not necessary, and
      allocating a power of two + 1 is naughty.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-4-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8a3e0bc370de9274170b82f48b0393204c3fb43b
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:30 2014 +0800

      vmdk: Fix comment to match code of extent lines

      commit 04d542c8b (vmdk: support vmfs files) added support of VMFS extent
      type but the comment above the changed code is left out. Update the
      comment so they are consistent.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Message-id: 1417649314-13704-3-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e5dc64b8ff09cc4c186273e4461c7479739db2ae
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 07:28:29 2014 +0800

      vmdk: Use g_random_int to generate CID

      This replaces two "time(NULL)" invocations with "g_random_int()".
      According to VMDK spec, CID "is a random 32‐bit value updated the first
      time the content of the virtual disk is modified after the virtual disk
      is opened". Using "seconds since epoch" is just a "lame way" to generate
      it, and not completely safe because of the low precision.

      Suggested-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Don Koch <dkoch@verizon.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1417649314-13704-2-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3ba235a02284c39b34a68a2a588508ffb52a7b55
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 13:55:09 2014 +0100

      block: Use g_new0() for a bit of extra type checking

      g_new(T, 1) is safer than g_malloc(sizeof(T)), because it returns T *
      rather than void *, which lets the compiler catch more type errors.

      Missed in commit 02c4f26.

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 1417697709-13087-1-git-send-email-armbru@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 625fa9fe6fbf9d45607d2c0144e1a44712d0cefc
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Wed Dec 3 10:30:08 2014 -0500

      block: remove BLOCK_OPT_NOCOW from vpc_create_opts

      In commit fef6070, the need for NOCOW was removed from the vpc driver,
      as we removed the the posix calls.  However, the BLOCK_OPT_NOCOW was not
      removed from vpc_create_opts.  This was a mistake - remove the opt from
      there as well.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: 8ba076fa725fed681cde7d8afc4fb239ae06a9c6.1417620301.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0d0d7f47b4c0fa4908e1747a94f96d4d9668f4aa
  Author: Jeff Cody <jcody@redhat.com>
  Date:   Wed Dec 3 10:30:07 2014 -0500

      block: remove BLOCK_OPT_NOCOW from vdi_create_opts

      In commit 7074786, the need for NOCOW was removed from the vdi driver,
      as we removed the the posix calls.  However, the BLOCK_OPT_NOCOW was not
      removed from vdi_create_opts.  This was a mistake - remove the opt from
      there as well.

      Signed-off-by: Jeff Cody <jcody@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Message-id: e189364de11929d8fa04722f5d845de0a9834d44.1417620301.git.jcody@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0fc9b0d16265033403334a5fa7863dde6129a3cd
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Dec 3 09:49:30 2014 +0800

      qemu-iotests: Skip 099 for VMDK subformats with desc file

      VMDK extent parsing code doesn't handle the JSON file name, so the case
      fails for these subformats. Disabled them.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Message-id: 1417571370-19495-1-git-send-email-famz@redhat.com
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 01212d4ed68fc8daa29062a9a38650cf8febe392
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:53 2014 +0100

      block/raw-posix: Fix ret in raw_open_common()

      The return value must be negative on error; there is one place in
      raw_open_common() where errp is set, but ret remains 0. Fix it.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 6a69b9620ac1562a067990d87284a85552bfd61b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:52 2014 +0100

      qcow2: Respect bdrv_truncate() error

      bdrv_truncate() may fail and qcow2_write_compressed() should return the
      error code in that case.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3b5e14c76a6bb142bf250ddf99e24a0ac8c7bc12
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:51 2014 +0100

      qcow2: Flushing the caches in qcow2_close may fail

      qcow2_cache_flush() may fail; if one of the caches failed to be flushed
      successfully to disk in qcow2_close() the image should not be marked
      clean, and we should emit a warning.

      This breaks the (qcow2-specific) iotests 026, 071 and 089; change their
      output accordingly.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 11c89769dc3e638ef72915d97058411ddf79b64b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:50 2014 +0100

      qcow2: Prevent numerical overflow

      In qcow2_alloc_cluster_offset(), *num is limited to
      INT_MAX >> BDRV_SECTOR_BITS by all callers. However, since remaining is
      of type uint64_t, we might as well cast *num to that type before
      performing the shift.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2247798d13e5295a097da0a42f9d0d70d88690a4
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:49 2014 +0100

      iotests: Add test for unsupported image creation

      Add a test for creating and amending images (amendment uses the creation
      options) with formats not supporting creation over protocols not
      supporting creation.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f798068c565918ead63218d083ff814b7635be72
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:48 2014 +0100

      iotests: Only kill NBD server if it runs

      There may be NBD tests which do not create a sample image and simply
      test whether wrong usage of the protocol is rejected as expected. In
      this case, there will be no NBD server and trying to kill it during
      clean-up will fail.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b2439d26f078c826e5e06b34d978a6f6d5c7c56f
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:47 2014 +0100

      qemu-img: Check create_opts before image amendment

      The image options which can be amended are described by the .create_opts
      field for every driver. This field must therefore be non-NULL so that
      anything can be amended in the first place. Check that this holds true
      before going into qemu_opts_create() (because if .create_opts is NULL,
      the create_opts pointer in img_amend() will be NULL after
      qemu_opts_append()).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f75613cf2488a37fb8019bc32a06ddbcd477d0ce
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:46 2014 +0100

      qemu-img: Check create_opts before image creation

      If a driver supports image creation, it needs to set the .create_opts
      field. We can use that to make sure .create_opts for both drivers
      involved is not NULL for the target image in qemu-img convert, which is
      important so that the create_opts pointer in img_convert() is not NULL
      after the qemu_opts_append() calls and when going into
      qemu_opts_create().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6149724080af7b3d5d61eac8942655e6d212783
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:45 2014 +0100

      block: Check create_opts before image creation

      If a driver supports image creation, it needs to set the .create_opts
      field. We can use that to make sure .create_opts for both drivers
      involved is not NULL in bdrv_img_create(), which is important so that
      the create_opts pointer in that function is not NULL after the
      qemu_opts_append() calls and when going into qemu_opts_create().

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit fd752801ae1cc729359a37f29e32265de6948d37
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:44 2014 +0100

      block/nfs: Add create_opts

      The nfs protocol driver is capable of creating images, but did not
      specify any creation options. Fix it.

      A way to test this issue is the following:

      $ qemu-img create -f nfs nfs://127.0.0.1/foo.qcow2 64M

      Without this patch, it segfaults. With this patch, it does not. However,
      this is not something that should really work; qemu-img should check
      whether the parameter for the -f option (and -O for convert) is indeed a
      format, and error out if it is not. Therefore, I am not making it an
      iotest.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 1bcb15cf776a57e8963072c1919a59a90aea8e94
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:43 2014 +0100

      block/vvfat: qcow driver may not be found

      Although virtually impossible right now, bdrv_find_format("qcow") may
      fail. The vvfat block driver should heed that case.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Kevin Wolf <kwolf@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit ef8104378c4a0497be079e48ee5ac5a89c68f978
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:42 2014 +0100

      block: Omit bdrv_find_format for essential drivers

      We can always assume raw, file and qcow2 being available; so do not use
      bdrv_find_format() to locate their BlockDriver objects but statically
      reference the respective objects.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5f535a941e52229d81e55603eb69b2bd449b937a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Dec 2 18:32:41 2014 +0100

      block: Make essential BlockDriver objects public

      There are some block drivers which are essential to QEMU and may not be
      removed: These are raw, file and qcow2 (as the default non-raw format).
      Make their BlockDriver objects public so they can be directly referenced
      throughout the block layer without needing to call bdrv_find_format()
      and having to deal with an error at runtime, while the real problem
      occurred during linking (where raw, file or qcow2 were not linked into
      qemu).

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b89689f5b2d2686ef83d2be0c854a5ef6e961e13
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Wed Dec 3 10:15:04 2014 +0100

      iotests: Specify qcow2 format for qemu-io in 059

      There are two instances of iotest 059 using qemu-io on a qcow2 image. As
      of "qemu-iotests: Use qemu-io -f $IMGFMT" the iotests can no longer rely
      on $QEMU_IO doing probing, therefore the qcow2 format has to be
      specified explicitly here.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d20051856cd2fa8f10fed2d2a0b2751de5f7b20d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Dec 3 13:21:32 2014 +0100

      ide: Check validity of logical block size

      Our IDE emulation can't handle logical block sizes other than 512. Check
      for it.

      The original assumption was that other values would silently be ignored
      (which is bad enough), but it's not quite true: The physical block size
      is exposed in IDENTIFY DEVICE as a multiple of the logical block size.
      Setting a logical block size therefore also corrupts the physical block
      size (4096/4096 doesn't silently downgrade to 4096/512, but 512/512).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>

  commit be0677a93cd4578122955db3c377c3de7e81fcd0
  Author: Anton Blanchard <anton@samba.org>
  Date:   Thu Nov 27 14:39:21 2014 +1100

      nvme: 64kB page size fixes

      Initialise our maximum page size capability to 64kB and increase
      the page_size variable from 16 to 32 bits.

      Signed-off-by: Anton Blanchard <anton@samba.org>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d11032315ac652d9283ffada7f9b679f368ee175
  Author: Michael Mueller <mimu@linux.vnet.ibm.com>
  Date:   Thu Nov 27 17:28:01 2014 +0100

      qemu-iotests: 082: Filter the real disk size

      The real on-disk size of an image depends on things like the host
      filesystem. _img_info already filters it out, use the function in 082.

      Signed-off-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e800e5d4e25192a6783c1a17e4df8261d9357e01
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 27 15:03:53 2014 +0100

      qemu-iotests: 060: Filter the real disk size

      The real on-disk size of an image depends on things like the host
      filesystem. _img_info already filters it out, use the function in 060.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Michael Mueller <mimu@linux.vnet.ibm.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>

  commit a56ebc6ba4be1b6060d87b115c48ff57236c8def
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Fri Nov 28 11:38:03 2014 +0000

      block: do not use get_clock()

      Use the external qemu-timer API instead.

      No one else should be calling cpu_get_clock(), get_clock() and
      get_clock_realtime() directly; they are internal functions and they
      should be confined to qemu-timer.c and cpus.c (where the icount
      implementation resides).  All accesses should go through
      qemu_clock_get_ns.

      Cc: kwolf@redhat.com
      Cc: stefanha@redhat.com
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1417010463-3527-2-git-send-email-pbonzini@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c5f6e493bb5339d244eae5d3f21c5b6d73996739
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:42 2014 +0100

      block: Don't probe for unknown backing file format

      If a qcow2 image specifies a backing file format that doesn't correspond
      to any format driver that qemu knows, we shouldn't fall back to probing,
      but simply error out.

      Not looking up the backing file driver in bdrv_open_backing_file(), but
      just filling in the "driver" option if it isn't there moves us closer to
      the goal of having everything in QDict options and gets us the error
      handling of bdrv_open(), which correctly refuses unknown drivers.

      Cc: qemu-stable@nongnu.org
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-4-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8884dd1bbc5ce42cd657ffcbef3a477443468974
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:41 2014 +0100

      qcow2.py: Add required padding for header extensions

      The qcow2 specification requires that the header extension data be
      padded to round up the extension size to the next multiple of 8 bytes.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-3-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2ebafc854d109ff09b66fb4dd62c2c53fc29754a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Tue Nov 25 18:12:40 2014 +0100

      qcow2: Fix header extension size check

      After reading the extension header, offset is incremented, but not
      checked against end_offset any more. This way an integer overflow could
      happen when checking whether the extension end is within the allowed
      range, effectively disabling the check.

      This patch adds the missing check and a test case for it.

      Cc: qemu-stable@nongnu.org
      Reported-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 3dc7ca3c97dff8732e38828b38e0497efba0fedf
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:49:00 2014 +0000

      blockdev: check for BLOCK_OP_TYPE_INTERNAL_SNAPSHOT

      The BLOCK_OP_TYPE_INTERNAL_SNAPSHOT op blocker exists but was never
      used!  Let's fix that so internal snapshots can be blocked.

      [Fixed s/external/internal/ typo as pointed out by Paolo Bonzini and Max
      Reitz.
      --Stefan]

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-5-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 5d6e96efb81f94f39a50110e8178584fb1817f66
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:59 2014 +0000

      blockdev: acquire AioContext in QMP 'transaction' actions

      The transaction QMP command performs operations atomically on a group of
      drives.  This command needs to acquire AioContext in order to work
      safely when virtio-blk dataplane IOThreads are accessing drives.

      The transactional nature of the command means that actions are split
      into prepare, commit, abort, and clean functions.  Acquire the
      AioContext in prepare and don't release it until one of the other
      functions is called.  This prevents the IOThread from running the
      AioContext before the transaction has completed.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-4-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 73f1f7564d58963fc692334bcf0c529e1e3536fb
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:58 2014 +0000

      blockdev: drop unnecessary DriveBackupState field assignment

      drive_backup_prepare() assigns DriveBackupState fields to NULL in the
      error path.  This is unnecessary because the DriveBackupState is
      allocated using g_malloc0() and other functions like
      external_snapshot_prepare() already rely on this.

      Do not explicitly assign fields to NULL so that the error path is
      concise and does not require modification when fields are added to
      DriveBackupState.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b756b9ce8a81cd0d95ae691cee541a149463c8c9
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Fri Nov 21 10:48:57 2014 +0000

      blockdev: update outdated qmp_transaction() comments

      Originally the transaction QMP command was just for taking snapshots.
      The command became more general when drive-backup and abort were added.

      It is more accurate to say the command is about performing operations on
      an atomic group than to say it is about snapshots.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416566940-4430-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 00e047926e0e90cf25e39d6a5b3b1e4f3701d69c
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:14 2014 +0100

      qemu-iotests: Test writing non-raw image headers to raw image

      This is forbidden if the raw driver was probed.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-10-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit d71a8b0686b87e54587a2219ab0e502f0a889839
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:13 2014 +0100

      qemu-iotests: Fix stderr handling in common.qemu

      The original intention was to pipe stderr of qemu into $fifo_out.
      However, the redirections were specified in the wrong order for this.
      This patch fixes it.

      Now qemu's output on stderr can be retrieved with _send_qemu_cmd, which
      applies several useful filters on the output that were missing before.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-9-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 38f3ef574b48afc507c6f636ae4393fd36bda072
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:12 2014 +0100

      raw: Prohibit dangerous writes for probed images

      If the user neglects to specify the image format, QEMU probes the
      image to guess it automatically, for convenience.

      Relying on format probing is insecure for raw images (CVE-2008-2004).
      If the guest writes a suitable header to the device, the next probe
      will recognize a format chosen by the guest.  A malicious guest can
      abuse this to gain access to host files, e.g. by crafting a QCOW2
      header with backing file /etc/shadow.

      Commit 1e72d3b (April 2008) provided -drive parameter format to let
      users disable probing.  Commit f965509 (March 2009) extended QCOW2 to
      optionally store the backing file format, to let users disable backing
      file probing.  QED has had a flag to suppress probing since the
      beginning (2010), set whenever a raw backing file is assigned.

      All of these additions that allow to avoid format probing have to be
      specified explicitly. The default still allows the attack.

      In order to fix this, commit 79368c8 (July 2010) put probed raw images
      in a restricted mode, in which they wouldn't be able to overwrite the
      first few bytes of the image so that they would identify as a different
      image. If a write to the first sector would write one of the signatures
      of another driver, qemu would instead zero out the first four bytes.
      This patch was later reverted in commit 8b33d9e (September 2010) because
      it didn't get the handling of unaligned qiov members right.

      Today's block layer that is based on coroutines and has qiov utility
      functions makes it much easier to get this functionality right, so this
      patch implements it.

      The other differences of this patch to the old one are that it doesn't
      silently write something different than the guest requested by zeroing
      out some bytes (it fails the request instead) and that it doesn't
      maintain a list of signatures in the raw driver (it calls the usual
      probe function instead).

      Note that this change doesn't introduce new breakage for false positive
      cases where the guest legitimately writes data into the first sector
      that matches the signatures of an image format (e.g. for nested virt):
      These cases were broken before, only the failure mode changes from
      corruption after the next restart (when the wrong format is probed) to
      failing the problematic write request.

      Also note that like in the original patch, the restrictions only apply
      if the image format has been guessed by probing. Explicitly specifying a
      format allows guests to write anything they like.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 1416497234-29880-8-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 7cddd3728e964164e99c59e5c9443508d9ee0161
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:11 2014 +0100

      block: Read only one sector for format probing

      The only image format driver that even potentially accesses anything
      after 512 bytes in its bdrv_probe() implementation is VMDK, which reads
      a plain-text descriptor file. In practice, the field it's looking for
      seems to come first and will be well within the first 512 bytes, too.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-7-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit c6684249fd35f7e692bcf3039d2fc4b13dd32308
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Nov 20 16:27:10 2014 +0100

      block: Factor bdrv_probe_all() out of find_image_format()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-6-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit b8e665e4d8c6aece216e373da062ee60c82e0b6f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:09 2014 +0100

      qtests: Specify image format explicitly

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-5-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 90c9b1671e79a978b918ed4f93f9aa0d2d2bb72f
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:08 2014 +0100

      qemu-iotests: Add qemu-io format option in Python tests

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-4-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8f9e835fd2e687d2bfe936819c3494af4343614d
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:07 2014 +0100

      qemu-iotests: Use qemu-io -f $IMGFMT

      This patch changes $QEMU_IO so that all tests by default pass a format
      argument to qemu-io.

      There are a few cases where -f $IMGFMT is not wanted because it selects
      the wrong driver or json: filenames including a driver are used. They
      are changed to use $QEMU_IO_PROG, which doesn't include any options.

      Tests 071 and 081 have output changes because now the actual request
      fails instead of reading the 2k probing buffer.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-3-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit be6273da9e31d30fc95a65b09a0b819a89f1cc62
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu Nov 20 16:27:06 2014 +0100

      qemu-io: Allow explicitly specifying format

      This adds a -f option to qemu-io which allows to explicitly specify the
      block driver to use for the given image.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Message-id: 1416497234-29880-2-git-send-email-kwolf@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e465ce7d09939d631f1861e0bd8873417c1c0d65
  Author: Fam Zheng <famz@redhat.com>
  Date:   Wed Nov 19 15:07:12 2014 +0800

      tests: Use "command -v" instead of which(1) in shell scripts

      When which(1) is not installed, we would complain "perl not found"
      because it's the first set_prog_path check. The error message is
      wrong.

      Fix it by using "command -v", a native way to query the existence of a
      command.

      Suggested-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1416380832-9697-1-git-send-email-famz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4c58e80acd61e24f307c1b2557079cc77dc9150a
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:19 2014 +0100

      qemu-nbd: Use BlockBackend where reasonable

      Because qemu-nbd creates the BlockBackend by itself, it should create
      the according BlockDriverState tree by itself as well; that means, it
      has call bdrv_open() on its own. This is one of the places where
      qemu-nbd still needs to use a BlockDriverState directly (the root BDS
      below the BB); other places are the configuration of zero detection
      (which may be lifted into the BB eventually, but is not yet) and
      temporarily loading a snapshot.

      Everywhere else, though, qemu-nbd can and thus should use BlockBackend.

      Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-7-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit aadf99a792be864c8feb1cc61e2c8fd225fa7c01
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:18 2014 +0100

      nbd: Use BlockBackend internally

      With all externally visible functions changed to use BlockBackend, this
      patch makes nbd use BlockBackend for everything internally as well.

      While touching them, substitute 512 by BDRV_SECTOR_SIZE in the calls to
      blk_read(), blk_write() and blk_co_discard().

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-6-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e140177d9cd067050004be6f725c3a0750ccdd94
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:17 2014 +0100

      nbd: Change external interface to BlockBackend

      Substitute BlockDriverState by BlockBackend in every globally visible
      function provided by nbd.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-5-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2c28b21f7c97ae4e2082536f36e97b1337e3d195
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:16 2014 +0100

      block: Add blk_add_close_notifier() for BB

      Adding something like a "delete notifier" to a BlockBackend would not
      make much sense, because whoever is interested in registering there will
      probably hold a reference to that BlockBackend; therefore, the notifier
      will never be called (or only when the notifiee already relinquished its
      reference and thus most probably is no longer interested in that
      notification).

      Therefore, this patch just passes through the close notifier interface
      of the root BDS. This will be called when the device is ejected, for
      instance, and therefore does make sense.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-4-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2019ba0a0197afc85495546f337345a7150710fc
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:15 2014 +0100

      block: Add AioContextNotifier functions to BB

      Because all BlockDriverStates behind a single BlockBackend reside in a
      single AioContext, it is fine to just pass these functions
      (blk_add_aio_context_notifier() and blk_remove_aio_context_notifier())
      through to the root BlockDriverState.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2bb0dce76245762dbc0a8fe12516faa127a64e5b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 18 12:21:14 2014 +0100

      block: Lift more functions into BlockBackend

      There are already some blk_aio_* functions, so we might as well have
      blk_co_* functions (as far as we need them). This patch adds
      blk_co_flush(), blk_co_discard(), and also blk_invalidate_cache() (which
      is not a blk_co_* function but is needed nonetheless).

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Message-id: 1416309679-333-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 17fcb74af922ba9f761d11e874314c32a3445e97
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Nov 13 10:24:41 2014 +0000

      ahci: replace SATA FIS type magic numbers with constants

      SATA 3.0 "10.3.1 FIS Type values" defines the constants used to
      differentiate between FIS types.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1415874281-7371-3-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 192cf55cc02dc0838bbfa5ac17feb7f6c1651441
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Thu Nov 13 10:24:40 2014 +0000

      ahci: avoid #ifdef DEBUG_AHCI bitrot

      Debug code using #ifdef is susceptible to bitrot because the compiler
      never checks the debug code.

      This is easy to avoid, change the DPRINTF() macro to use if (DEBUG_AHCI)
      and always give it a 0 or 1 value.

      This also allows us to drop an #ifdef DEBUG_AHCI in ahci_start_dma()
      since the compiler can now see the local variable is used.

      The motivation for this change is a recent DEBUG_AHCI build failure due
      to an outdated DPRINTF() format string.  From now on the compiler will
      catch these errors.

      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: John Snow <jsnow@redhat.com>
      Message-id: 1415874281-7371-2-git-send-email-stefanha@redhat.com
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f48a33b608b6d98cbe2eaba27cbae925fc221284
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 11 10:23:45 2014 +0100

      iotests: Plain blkdebug filename generation

      Add one test whether blkdebug is able to generate a plain filename if
      given a configuration file and a file to be tested only; and add another
      test whether blkdebug is able to do the same without being given a
      configuration file.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1415697825-26678-3-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8779441b1b0e03bd3e5213dee447ab0c955e374b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Tue Nov 11 10:23:44 2014 +0100

      blkdebug: Simplify and improve filename generation

      Instead of actually recreating the options from scratch, just reuse the
      options given for creating the BDS, which are the configuration file
      name and additional options. In case there are no additional options we
      can thus create a plain filename.

      This obviously results in a different output for qemu-iotest 099 which
      exactly tests this filename generation. Fix it up as well.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 1415697825-26678-2-git-send-email-mreitz@redhat.com
      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 48fe86f6400574165979e0db6f5937ad487b6888
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Wed Nov 12 16:24:02 2014 +0100

      monitor: Fix HMP tab completion

      Commands with multiple boolean flag options (like 'info block') didn't
      provide correct completion because only the first one was skipped.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e6bb31ec6f7ef7c78c897390ecc6c6a34a7f9f5a
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:19:14 2014 +0200

      block/hmp: Allow node-name in 'info block'

      The optional parameter specifying a block device allows now to use a
      node-name instead of a drive name (and therefore to inspect any node in
      the graph). The new -n options allows listing all named nodes instead of
      BlockBackends.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 8d6adccda25d75dc152b68d15ac75e1670e59b23
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:12:52 2014 +0200

      block/hmp: Allow info = NULL in print_block_info()

      This allows printing infos of BlockDriverStates that aren't at the root
      of the graph (and logically implementing a BlockBackend).

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 289b276c69a8b5f90531b41917a536e16bf71837
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Mon Sep 15 12:06:39 2014 +0200

      block/hmp: Factor out print_block_info()

      The new function prints the info for a single BlockDriverState.

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 9e193c5a652faff719d7186e27f680e3888925a6
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   Thu May 22 13:28:45 2014 +0200

      block/qapi: Add cache information to query-block

      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>

  commit 729962f6db43bf262a446f5e13d900ffb3c54a88
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:45 2014 +0000

      blockdev: acquire AioContext in change-backing-file

      Add dataplane support to the change-backing-file QMP commands.  By
      acquiring the AioContext we avoid race conditions with the dataplane
      thread which may also be accessing the BlockDriverState.

      Note that this command operates on both bs and a node in its chain
      (image_bs).  The bdrv_chain_contains(bs, image_bs) check guarantees that
      bs and image_bs are in the same AioContext.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit e3442099a2794925dfbe83711cd204caf80eae60
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:44 2014 +0000

      blockdev: acquire AioContext in eject, change, and block_passwd

      By acquiring the AioContext we avoid race conditions with the dataplane
      thread which may also be accessing the BlockDriverState.

      Fix up eject, change, and block_passwd in a single patch because
      qmp_eject() and qmp_change_blockdev() both call eject_device().  Also
      fix block_passwd while we're tackling a command that takes a block
      encryption password.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 0b92885420c9cf42da27c63939d388e276a7ddde
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:43 2014 +0000

      blockdev: check for BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE

      The BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE op blocker exists but was
      never used!  Let's fix that so snapshot delete can be blocked.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4ef3982a99f9d2634588b4785c8d841605517946
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   Wed Nov 19 14:19:42 2014 +0000

      blockdev: acquire AioContext in blockdev-snapshot-delete-internal-sync

      Add dataplane support to the blockdev-snapshot-delete-internal-sync QMP
      command.  By acquiring the AioContext we avoid race conditions with the
      dataplane thread which may also be accessing the BlockDriverState.

      Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 2389eeae690b68e9d6a17cb10a5a7c7ec58009a1
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:06 2014 +0100

      iotests: Use -qmp-pretty in 067

      067 invokes query-block, resulting in a reference output with really
      long lines (which may pose a problem in email patches and always poses a
      problem when the output changes, because it is hard to see what has
      actually changed). Use -qmp-pretty to mitigate this issue.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit cc20b07a421ba39413111813b4016745fee11f08
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:05 2014 +0100

      iotests: _filter_qmp for pretty JSON output

      _filter_qmp should be able to correctly filter out the QMP version
      object for pretty JSON output.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4821cd4cfd50185979d9a8c335acb62d97972dbb
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Mon Nov 17 13:31:04 2014 +0100

      chardev: Add -qmp-pretty

      Add a command line option for adding a QMP monitor using pretty JSON
      formatting.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4b58554a0e60aba6f1c6f391759f148f7bca181b
  Author: Max Reitz <mreitz@redhat.com>
  Date:   Fri Nov 21 10:29:59 2014 +0100

      qjson: Drop trailing space for pretty formatting

      For the pretty formatting, the functions converting QDicts and QLists to
      JSON should not print a space after the comma separating objects,
      because a newline will emitted immediately afterwards, making the
      whitespace superfluous.

      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit f71eaa74c0bf2cf9da9a00b571d4b8162c61e29d
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:57 2014 +0800

      qmp: Add optional switch "query-nodes" in query-blockstats

      This bool option will allow query all the node names. It iterates all
      the BDSes that are assigned a name, also in this case don't query up the
      backing chain.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 4875a77950811631c26e156592e8b8df22208085
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:56 2014 +0800

      block: Include "node-name" if present in query-blockstats

      Node name is a better identifier of BDS.

      We will want to query statistics of a BDS node buried in the BDS graph,
      so reporting the node's name if there is one will do the trick.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 20a9e77dfabb3e664c0873726be1540175a4fda1
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:55 2014 +0800

      block: Add bdrv_get_node_name

      This returns the node name of a BDS. Remove the TODO comment and expect
      the callers to be explicit.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 04df765ab449df24666269b0de0caf6ff250c568
  Author: Fam Zheng <famz@redhat.com>
  Date:   Fri Oct 31 11:32:54 2014 +0800

      block: Add bdrv_next_node

      Similar to bdrv_next, this traverses through graph_bdrv_states. Will be
      useful to enumerate all the named nodes.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>

  commit 43948386bb109b97b3de0bb48573f317bdcb5008
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:39:05 2014 +0800

      keymaps: correct keymaps.c following Qemu coding style

      It's hard to read because of the confused coding
      style in this file. Let's correct it following Qemu
      coding style.

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit 525965b85dcd9e0d0359f1cdb04b3f25d754ffd9
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 20 17:07:06 2014 +0800

      vnc-enc-tight: fix Arguments in wrong order

      Arguments in wrong order (SWAPPED_ARGUMENTS)
      The positions of arguments in the call to
      tight_fill_palette do not match the ordering of the parameters:
       &fg is passed to bg
       &bg is passed to fg

      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

  commit b196d969efa3987148994f0f8da79a10ebda7641
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Tue Dec 9 15:15:59 2014 +0800

      vt82c686: fix coverity warning about out-of-bounds write

      Refactor superio_ioport_writeb to fix the out of bounds write warning.

      In addition, fix two typos: s/chage/change/

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7766aa0c0e9e1b84c80c3a8168c6d97c4a3d49b8
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Tue Dec 9 10:09:22 2014 +0800

      virtio: remove useless declaration of virtio_net_init()

      commit 1773d9ee (virtio-net: cleanup: init and exit function)
      removed the definition of virtio_net_init(), but didn't remove its
      declaration in the header.  Clean that up.

      Cc: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1c854067b31a7764fa346ea74e0f0fa0ae718458
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:40:19 2014 +0800

      qapi-schema: fix typo about change-vnc-password

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit d504fb4cecdb7c6f3b18c4d83296e84b6e970595
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Mon Dec 8 19:52:41 2014 +0800

      fw_cfg: remove superfluous blank line

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 80b57dda897f541dcaa66369241eebc6f2a18a78
  Author: Thomas Huth <thuth@linux.vnet.ibm.com>
  Date:   Wed Oct 22 14:28:38 2014 +0200

      get_maintainer.pl: Remove the --git-chief-penguins option

      Linus likely does not want to get e-mails about QEMU, so let's
      just remove this option.

      Suggested-by: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
      Reviewed-by: Don Slutz <dslutz@verizon.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8ccefb91bf0b4be7a7434c55dae77ed3acb39f68
  Author: Fam Zheng <famz@redhat.com>
  Date:   Thu Dec 4 14:18:16 2014 +0800

      configure: Replace which(1) with "has"

      Using "has" is more slick because which(1) is not always there.

      Signed-off-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Stefan Weil <sw@weilnetz.de>
      Reviewed-by: Amos Kong <akong@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit e1cf5582644ef63528993fb2b88dd3b43b9914c6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:03 2014 +0100

      util: Use g_new() & friends where that makes obvious sense

      g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
      for two reasons.  One, it catches multiplication overflowing size_t.
      Two, it returns T * rather than void *, which lets the compiler catch
      more type errors.

      This commit only touches allocations with size arguments of the form
      sizeof(T).

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 9be71be5bda27b068176ab9b982cf3d7d41a4acd
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:02 2014 +0100

      util: Fuse g_malloc(); memset() into g_new0()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 44c2286b5df1f50fc9fedabd7b1a5a8022e583fc
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 15:00:01 2014 +0100

      util: Drop superfluous conditionals around g_free()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 24588100ab39afead7b9a0e9c61182a02320a1b9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Thu Dec 4 10:26:55 2014 +0100

      Drop superfluous conditionals around g_strdup()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 4ad608803c46c0acc09114a2e8352742ffd20b6b
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   Wed Dec 3 11:28:02 2014 +0100

      Drop superfluous conditionals around qemu_opts_del()

      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7251711472a8b406640a62f25f860628d3056bb1
  Author: lijun <junmuzi@gmail.com>
  Date:   Wed Nov 19 14:57:43 2014 +0800

      usb: delete redundant brackets in usb_host_handle_control()

      When see usb codes, find there are redundant brackets !((udev->port->speedmask
      & USB_SPEED_MASK_SUPER)) here. So delete it.

      Signed-off-by: Jun Li <junmuzi@gmail.com>
      Reviewed-by: Fam Zheng <famz@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 2c80ab15e218a0438627c2a79d74d5a13b864e15
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:39:32 2014 +0800

      virtio-bus: avoid breaking build when open DEBUG switch

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 8b310fc4f9eb2570bfb92a725bd094ce203800da
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:59:37 2014 +0800

      acpi-build: Make DPRINTF working for acpi-build

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit fcf55f580d4c4755dfacabd7ac86501ebbb4167e
  Author: Gonglei <arei.gonglei@huawei.com>
  Date:   Thu Nov 13 10:59:36 2014 +0800

      acpi-build: adjust indention 8 -> 4 spaces

      Signed-off-by: Gonglei <arei.gonglei@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 1a71992376792a0d11ea27688bd1a21cdffd1826
  Author: zhanghailiang <zhang.zhanghailiang@huawei.com>
  Date:   Mon Nov 24 10:47:45 2014 +0800

      target-s390x: fix possible out of bounds read

      Array index starts at 0, so the valid index of ext_queue array,
      io_queue array, mchk_queue array should be MAX_EXT_QUEUE - 1,
      MAX_IO_QUEUE - 1, MAX_MCHK_QUEUE - 1.

      The original checks missed the invalid bound value, which will lead
      possible out of bounds read in the follow codes.

      Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit b5369dd841b55aa24dd107223e0a08d8624d1b19
  Author: Amos Kong <akong@redhat.com>
  Date:   Tue Nov 25 16:05:56 2014 +0800

      qmp: fix typo in input-send-event examples

      Lack of two closed bracket in json commands.

      Signed-off-by: Amos Kong <akong@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

  commit 7fb8da2b8861795e0013e6ee97acd0363d868a35
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   Tue Dec 9 21:48:34 2014 +0000

      Open 2.3 development tree

      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

pnmtopng: 174 colors found
Revision graph left in /home/logs/results/bisect/libvirt/test-amd64-amd64-libvirt-vhd.debian-di-install.{dot,ps,png,html,svg}.
----------------------------------------
65231: tolerable FAIL

flight 65231 libvirt real-bisect [real]
http://logs.test-lab.xenproject.org/osstest/logs/65231/

Failures :-/ but no regressions.

Tests which did not succeed,
including tests which could not be run:
 test-amd64-amd64-libvirt-vhd  9 debian-di-install       fail baseline untested


jobs:
 build-amd64-libvirt                                          pass
 test-amd64-amd64-libvirt-vhd                                 fail


------------------------------------------------------------
sg-report-flight on osstest.test-lab.xenproject.org
logs: /home/logs/logs
images: /home/logs/images

Logs, config files, etc. are available at
    http://logs.test-lab.xenproject.org/osstest/logs

Explanation of these reports, and of osstest in general, is at
    http://xenbits.xen.org/gitweb/?p=osstest.git;a=blob;f=README.email;hb=master
    http://xenbits.xen.org/gitweb/?p=osstest.git;a=blob;f=README;hb=master

Test harness code can be found at
    http://xenbits.xen.org/gitweb?p=osstest.git;a=summary



[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2015-11-29 20:59 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-11-29 20:59 [libvirt bisection] complete test-amd64-amd64-libvirt-vhd osstest service owner

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.